Risk managers urged to help create shared cyber language to boost resilience

Risk managers have been encouraged to help develop a common language, or taxonomy, for digital risks that will enable different stakeholders to understand each other, create common data and ultimately boost resilience. Companies and governments struggle with limited and fragmented data while trying to understand, mitigate and quantify risks from increasing digital dependency. The lack of understanding about what digital, or cyber, resilience means, as well as a language that enables different specialists to communicate, complicates an already challenging topic. The CRO Forum, a group of professional risk managers from the insurance industry that focuses on developing and promoting industry best practices, has set about trying to help solve this issue. It set up a working group of information security experts, risk managers and underwriters in 2016 to devise a common taxonomy, or language, to describe cyber events. During a period of 12 months, the CRO Forum trialled the taxonomy among its insurance members to see how it worked in practice. The trial wanted to find out if the taxonomy could deliver insights that could be shared externally to enable benchmarking and boost digital resilience. Speaking at the Ferma seminar in Antwerp this week, Swiss Re’s Nick Kitching, who helped lead the CRO Forum’s work in this area, said the trial proved a shared cyber language is possible and can deliver results. He said the time is right to push ahead and further develop the taxonomy for the benefit of all. Speaking on the second day of the Ferma seminar dedicated to cyber risk, Mr Kitching said: “If we only work on one thing, we should try and embrace a shared taxonomy. The benefits are clear and the time is right to engage on this topic and take forward a common way to describe these events. “We need to [pick up] where we left [off] with the CRO Forum work and see whether or not this is a standard of description that can be developed further and accepted within a wider community,” he added. “If a common taxonomy is used it can build resilience, and it is critical to enable all stakeholders to understand each other and deliver on our promises to protect data, operate efficiently and deliver services,” continued Mr Kitching, who is chief risk officer at Swiss Re Europe. A taxonomy would allow risk managers, IT specialist, insurers, regulators and other stakeholders to begin speaking the same language and understand what each person is talking about when it comes to cyber risk. In turn, this could develop data needed to improve resilience, including better insurance coverage. But Mr Kitching said the process of developing a shared taxonomy will not be not easy and more work is needed. “It requires stakeholders to adapt, as well as new methods. It will take time to learn and understand how to use and collect information, [which] can only show improvement over time,” he said. Speaking at the seminar session entitled ‘Cybergeddon or a manageable risk?’, Mr Kitching began by explaining the problem when it comes to trying to deal with cyber risk. If a burglary takes place you can see where it has taken place, how the break-in occurred and what was taken, he said. But in the digital world it is much harder to see where, how and what was taken, the CRO added. Most importantly of all, it is very difficult to tell the police, locksmith and insurer exactly what happened and what was taken, continued the speaker. “In the digital environment, any crime or problem is hard to explain. Different approaches are being adopted to explain what happens, with different amounts of detail all from different perspectives. This is exacerbated by the different requirements that are evolving, whether it be from regulatory authorities, law enforcement authorities or data governance authorities…This is creating silos of understanding,” he told delegates at the seminar. Because reports into cyber incidents often do not tell the whole story from start to finish in language that everyone can understand, we need to develop a common understanding of terms to describe them – a common taxonomy – that is understood across specialisms and industries, and can create shared data, said the risk manager. The CRO Forum’s taxonomy trial published its findings in February this year and showed there is light at the end of the tunnel. During a period of 12 months it managed to capture, describe and share nearly 700 cyber events. “We saw we could bring together different taxonomies that already existed to create a common language for describing these events. It could be used for multiple purposes, with IT people, risk managers and underwriters all able to look at the information and understand it. This encouraged communication among specialists,” said Mr Kitching. He said the trial also helped build an understanding of the types of event that might affect a particular industry, in this instance insurance. Just as importantly, it provided event descriptions that could be shared, Mr Kitching added. “This last point is key. Even though we all know it is a matter of if not when with cyber, people are still unwilling to share, even in a very anonymised way, what goes wrong. This is key to building resilience. If we are going to build resilience we can only improve if we have reliable data that enables us to understand and work out what needs to happen,” he told more than 200 risk professionals gathered for the Ferma event.

Risk managers urged to help create shared cyber language to boost resilience

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles