Zurich Insurance Co. and The Atlantic Council, in their excellent April 2014 Risk Nexus report, share these sobering thoughts about how cyber attacks could potentially unravel the internet: "The growing number and sophistication of cyber attacks is threatening to outstrip our efforts to increase resiliency against them." They go onto report 730 million data files were potentially viewed or stolen worldwide in 2013.

What is even more troubling is in the not-too-distant future, these may be remembered as the good old days.

Why so gloomy?

Until now, cyber events have been limited in scope, scale and effect. Even following such robust attacks as Heartbleed, skilled programmers quickly restored order to the internet by fixing broken code and applying patches. At no time was the business of the world, or even local communities, brought to a sudden, lingering, ruinous halt.

According to the Risk Nexus report, though, cyber fixes may be no match for future cyber disorder: "While our society's reliance on the internet grows exponentially, our control of it only grows linearly, limited by outdated government procedures and ineffective governance."

In other words, as our need for the Internet continues to grow, our ability to control, monitor and maintain it will not keep pace.

It is interesting to note, cyber attacks have so far disrupted only the Internet. But as the Internet increasingly becomes the nerve center of daily life–by controlling smart electrical grids, water supplies, weapons systems, satellites, food supply chains and communications networks–cyber events including cyber attacks could potentially disrupt our ability to conduct our daily existence as we now live. It doesn't take much imagination to realize a busted oil refinery, power grid, railroad, draw bridge, hydroelectric dam or electrical switching station will not be nearly as easy to repair as broken code.

The report uses the 2008 financial crisis as an analog of how the Internet could potentially unravel, and the business of the world along with it. Just as complex, toxic subprime mortgages, reckless credit policies and organizations deemed " too big to fail" nearly brought down the global economy, a catastrophic cyber event could cripple the global community.

According to the Risk Nexus report, "The Internet is the most complex system humanity has ever devised, and our track record of successfully managing complex systems is far from perfect."

Zurich and The Atlantic Council worry we simply aren't worrying enough about the magnitude of risk posed by a catastrophic cyber event. "This increasingly tight coupling of the internet with the real economy and society means a full-scale cyber shock is far more likely to occur than some risk managers (and internet professionals) care to admit."

The Internet could potentially be a victim of its own remarkable success. While the first email was sent only 42 years ago, the Internet is today the backbone of global communications and economic activity. When analysts and commentators discuss the Federal Communications Commission's net neutrality rules, they regard the regulatory back and forth as being critical to our nation's financial future.

The Internet's critical level of importance makes it a tempting target for cyber terrorists, according to the report: "On the Internet, it has been easier to attack than defend for decades. The original architecture of the internet was founded on trust, not security, software is still poorly written and secured, and the system is so complex that it is difficult to defend."

While these are not comforting words, it could get worse. According to the World Economic Forum, Global Risks Report 2014, "A future in which attackers–whether hackers, organized crime or national militaries–have an overwhelming, dominant and lasting advantage over defenders could be just one disruptive technology away.

"Attackers in the future could achieve a wide-ranging impact with little input, making large-scale, internet-wide disruptions easy and common. The internet would cease to be a trusted medium for communication or commerce, increasingly abandoned by consumers and enterprises. Cyberspace would no longer be divided between attackers and defenders, but between predators and prey."

This is not your run of the mill, everyday cyber attack. It sounds more like World War Z.

How can we, as insurance professionals and risk managers, help to manage this stew of bad news and potential cyberastrophe? We can begin by encouraging legislators and regulators to address these risks in a thoughtful, constructive manner. These are real issues with real consequences that cannot be ignored. We can also join in encouraging technology vendors to add increased security and resilience to their cyber products.

For our clients, we can continue to aggressively support cyber insurance products. These products are no longer "nice to have." They belong to the "must have" category, along with business auto and workers compensation insurance. We "get it" that cyber insurance is essential to transfer cyber risks, including third party risks associated with data breaches and business interruption. It is now our job to bring our clients to the same level of awareness before the next cyber event occurs.

Special Reports /

When the 'Internet of Things' Meets Crime, It's a 'Cyberastrophe'

Related Stories

Recommended For You