Cyber scenarios keep experts awake at night

  • cyber security panel

  • Worrying trends: George Do, left, Jeremy Gittler and Brian Middlebrook were on a cybersecurity panel discussing case studies that keep them awake at night (Photograph by Blaire Simmons)

    Worrying trends: George Do, left, Jeremy Gittler and Brian Middlebrook were on a cybersecurity panel discussing case studies that keep them awake at night (Photograph by Blaire Simmons)


Cybersecurity case studies that keep a group of experts awake at night were discussed at the International Cyber Risk Management Conference at the Hamilton Princess&Beach Club.

George Do, chief information security officer at Gojek, spoke about the impact of a major cloud service provider going down, such as could happen with a denial of service attack.

“Any cloud provider can go down because of a cyberattack or some disaster incident,” he said.

If there was a wide enough outage on a big service provider, such as Amazon Web Services, it has the potential to hit day-to-day devices people use, from refrigerators, to cameras and phones, which are connected as elements on the so-called Internet of Things.

In such a scenario, Mr Do said: “Multiple services that we are all used to, that we are happy with and use every day, would become unusable.”

He mentioned Uber, banking apps and banking services from the likes of Chase and Bank of America, and disruption to social media platforms such as Facebook and Twitter.

“Imagine on your phone you would not be able to use 75 per cent of the apps out there,” Mr Do said.

If a major cloud service like AWS went down, the effect would be “something of that magnitude” of disruption for people, he warned.

Also on the panel was Jeremy Gittler, practice leader and head of cyber claims, Americas, Axa XL. He spoke about cyberterrorism and the difficulty to classify an incident as an act of war, act of a foreign enemy, or as an act of terrorism.

In addition, he said because it is hard to attribute such attacks as being the work of a foreign government, he was unaware of any incident falling under insurance exclusion clauses that reference damage being caused by a confirmed act of war or terrorism.

He also said if, on a single day, 50 of the largest banks in the world “went down” due to a cyberattack there would be worldwide chaos.

“That’s not something that’s really insurable,” he said.

“Can the industry sustain an actual cyberwar by another country? The answer is no, it probably can’t.”

The third panellist was Brian Middlebrook, partner, Gordon Rees Scully Mansukhani. He spoke about major attacks that are on the scale of perceived nation state action.

He said: “NotPetya is a great example. It is the single largest event resulting in damage, calculated at this point at over $10 billion worldwide.”

He said 2017’s NotPetya was two exploits released simultaneously that had the ability to cross borders and “destroy anything it touched”.

“It was solely created to do damage,” Mr Middlebrook said.

Examples of businesses affected was a chocolate factory in Australia that had to close, the world’s largest container shipping company Maersk being put out of business for days, and some of its divisions being affected for weeks, while FedEx was another business impacted.

“The scale of damage done to institutions large and small; we are talking about hardware replacement, software replacement, man-hours to rebuild networks,” he said.

“But then you are also talking about the business interruption claims, the shareholder claims — there are limitless types and numbers of claims that arise from a catastrophic attack like that, and there is no discrimination between entities big and small.

“If you didn’t have insurance it’s a problem, but if you did have insurance, chances are it’s not enough.”

He added: “It is very difficult to plan for, but to date it is the best example of how catastrophic an attack like that is — which again, you’re talking about Russia targeting Ukraine and impacting the entire world as collateral damage.”

Meanwhile Mr Do warned the hardest cybersecurity incidents to guard against are those originating from within an organisation, caused by a rogue employee.

“If the attack is from inside the walls of the company you have a much greater problem — because the user or users behind the attack all ready have access to your system, so anything they do on the network is legitimate,” he said.

“They can do massive harm. It is extremely difficult for security teams to detect and protect against something like that.”

The panel was asked to summarise their biggest cybersecurity fears.

Mr Do said: “The Internet of Things. We are all very well trained on cybersecurity attacks on traditional networks and application systems, we are very bad around the world on how to secure the Internet of Things.

“I’m talking about security cameras, microwaves, the refrigerator that talks to you. All those things are now embedded in our daily lives, but they are very insecure.”

While Mr Gittler said: “It’s our insurance that don’t have enough coverage, so they might only have a tower of $10 million or $20 million, and then they get a fine of $50 million. And here they went out and bought cyber insurance — they took time to do it, and here they are still probably going to go out of business because they didn’t buy enough coverage.”

Mr Middlebrook said his biggest fear in the cybersecurity arena is clients who walk away against the advice of counsel in the face of a breach.

He said it is the clients who say “My IT told me everything is fine, thanks for your services”.

Mr Middlebrook said: “It creates a situation where, I believe, with the benefit of hindsight they are eventually sued because someone has had their information exposed. When it comes to light that they were the source, they didn’t investigate it, they didn’t report it, they didn’t notify about it.

“The question is going to be ‘Well, did you have counsel?’ and their answer is going to be ‘Yes, and I talked to counsel and I decided not to do it’.

“That’s a problem for me and the firm from a malpractice perspective, when I spent hours trying to convince you to do something about it.”

You must be registered or signed-in to post comment or to vote.

Published Dec 9, 2019 at 8:00 am (Updated Dec 9, 2019 at 11:25 am)

Cyber scenarios keep experts awake at night

What you
Need to
Know
1. For a smooth experience with our commenting system we recommend that you use Internet Explorer 10 or higher, Firefox or Chrome Browsers. Additionally please clear both your browser's cache and cookies - How do I clear my cache and cookies?
2. Please respect the use of this community forum and its users.
3. Any poster that insults, threatens or verbally abuses another member, uses defamatory language, or deliberately disrupts discussions will be banned.
4. Users who violate the Terms of Service or any commenting rules will be banned.
5. Please stay on topic. "Trolling" to incite emotional responses and disrupt conversations will be deleted.
6. To understand further what is and isn't allowed and the actions we may take, please read our Terms of Service
7. To report breaches of the Terms of Service use the flag icon

  • Take Our Poll

    • Do you think the Government has taken the necessary steps to protect the public against the risk of the Covid-19 virus?
    • Yes
    • 55%
    • No
    • 45%
    • Total Votes: 5216
    • Poll Archive

    Today's Obituaries

    eMoo Posts