State involvement in battle against cyber threat can lead to conflicts of interest–Portugal

But, during this year’s Portuguese Risk Frontiers roundtable in Porto, they also said that important efforts are being made by public and private entities alike to fight off a threat that looks more severe by the day. “Entities like the American government and the European Union are making a huge effort to create mechanisms to fight cyber risks,” said Jose Luis Amorim, Risk Manager at Sonae. “These mechanisms are likely to result in regulation that will generate enormous costs for companies that do not comply with it,” he said. “There is a conflict of interests involved in the subject of cyber risks,” added António Cândido, Chief Risk Officer at EFACEC. “For example, some companies have developed very sophisticated encryption communication systems, however security forces claim that because of that they would have to work harder to fight terrorism,” he said.hideMr Cândido said that nation states fear that the same technologies that can help companies to better protect their businesses against cyber risk can also be employed by terrorist groups to enhance their capabilities. Sometimes even the search for new solutions by the insurance market can raise such concerns. “The technology to encrypt everything exists today,” said Mr Cândido. “The problem is that the personal interest of the individual to protect themselves conflicts with the interests of society as a whole. For insurance companies this creates a challenge too. Their mission to provide protection against this kind of threat clashes with the interest of states to act against the illegal use of technologies,” he added. But, the rising involvement of states in the fight against cyber threats also brings advantages. For instance, it could result in a better understanding of the risk by promoting more transparency. “States and companies have forged partnerships to enhance awareness about cyber risks, and this is important,” said Mr Cândido. “As cyber risk events have a big potential impact on the reputation of companies, they tend not to be reported. There are estimates that around 80% of all incidents remain unreported,” he explained. The insurance market itself is striving to improve knowledge about the risk, often channeling a lot of work and investments to that end. “Insurers now have their own forensic resources to do their own assessment of cyber risk events,” Mr Amorim said. “There are several companies that have expertise in performing this kind of service, but large insurers also have their own teams doing it. They want to do their own assessment, which boosts prevention as they are able to test the IT defence systems implemented by their clients, detect possible attacks that have already taken place and suggest measures to boost defences.” According to Mr Cândido, this is the kind of initiative that can help buyers better understand their cyber risks. “We have done an assessment of our cyber risks exposures recently,” he said. “They assessed the risk of attacks to our system both from outside and from within the company. In the latter case, they tried to find out whether a staff member could access information that they should not have access to. The fact is that we perform this exercise every year, and we always find new issues that need to be acted upon. You can never fill all the gaps.” This is partly because attackers are becoming ever more sophisticated, making it hard for security systems to keep up. “We have recently been to a meeting in Germany where a professional hacker turned consultant showed what can be done in terms of hacking,” Mr Aznar of HDI-Gerling said. “People can be spied upon even via a mobile phone that is turned off. They can even get into computers that are not on.” Some of the solutions offered to corporations by IT security experts can create their own issues. One example is the use of the cloud to optimise costs and boost data protection. “When a company subcontracts services to a cloud service, it loses control over actions to mitigate the risk because they will be outsourced to the cloud provider,” Mr Amorim said. “ There are contracts and guarantees in place, but the control rests with the cloud provider.” “Big cloud providers employ IT security top guns in their ranks,” Mr Cândido pointed out. “Companies do not usually have staff with the same kind of expertise. Statistically, it would be safer to be in the cloud because companies cannot spend the same level of effort on IT security, which is not their main business,” he added.

State involvement in battle against cyber threat can lead to conflicts of interest–Portugal

Want to read this article?

Read Next

AXA P&C increases premiums by 7% as rates rise at AXA XL

Swiss broker Kessler names head of special risks

Four in five non-EU companies to align with CSRD

Multinational corporate client practice launched by Crawford

Hiscox London market rates up 3% in Q1

AXA P&C increases premiums by 7% as rates rise at AXA XL

Swiss broker Kessler names head of special risks

Four in five non-EU companies to align with CSRD

Multinational corporate client practice launched by Crawford

Hiscox London market rates up 3% in Q1

Want to read this article?

Read Next

AXA P&C increases premiums by 7% as rates rise at AXA XL

Swiss broker Kessler names head of special risks

Four in five non-EU companies to align with CSRD

Multinational corporate client practice launched by Crawford

Hiscox London market rates up 3% in Q1

Related Articles