This week, more than 4,000 risk managers and insurance industry professionals are in Denver for the 2014 RIMS Annual Conference & Exhibition. They've come to better understand and protect their organizations from all kinds of risks, including risks associated with Internet security.
Concerns about cyber risk are evolving as the Internet continues to grow in size, influence and increased connectivity, but they are not new.
Twenty-five years ago, the Internet's first "worm" spread quickly — a malicious piece of software that took down 10 percent of the early Internet within hours. The disruption, which lasted a few days, was the first "near miss" of a cyber catastrophe. Others followed, such as the 2006 earthquakes that severed most Asia undersea cables.
We have gotten used to the Internet being slow at times, but essentially always being there. It has proven resilient because of a combination of stable technology and dedicated technicians keeping it working invisibly and reliably.
Yet near misses hint at a larger truth: Just because the Internet has remained resilient in the face of accident and insult, it need not stay that way forever. The Internet of tomorrow will likely be less resilient, less available and less robust than today.
The Internet is the most complex system humanity has ever devised, and our track record of successfully managing complex systems is far from perfect. When that worm disrupted the Internet in 1988, it did not matter much. That Internet was an obscure research tool.
But today's Internet is highly interconnected and tightly coupled with society. Even local failures can cascade directly to Internet-dependent banks, water systems, cars, medical devices, hydroelectric dams, electric transformers and the like. A full-scale cyber shock is far more likely than most risk managers admit.
This understatement of risk is painfully similar to attitudes toward financial risks prior to the 2008 financial crash. Stakeholders imagined that each organization contained its own risks, and ignored the complex interconnections of those risks. Like our financial system, the very complexity needed to sustain our broad cyber system creates tinder that could take a spark to become a wildfire. But with cyber risks, the world is highly leveraged on information technology, not derivatives or other financial products. And like turn-of-the-century financial risk management, modern cyber risk management does not give much thought to aggregations of risk that lie outside an organization's own firewalls: risks with contractual partners, in the supply chain, and in upstream infrastructure.
Governments and organizations with Internet-wide responsibilities have the most to do. They must expand their horizons to focus more on the resilience of the system as a whole, rather than risks at individual organizations. Systemwide risk management and response will be critical and, here again, the "cyber subprime" analogy to the financial sector provides ideas.
During the 2008 financial crash, global stakeholders improved on the overwhelmed or ineffective crisis response mechanisms (such as the G-8 group of industrialized nations) in part by making them more inclusive. The Internet is dominated by the private-sector companies that create and maintain it on a daily basis. Microsoft has therefore informally proposed the convening of a "G20+20" group — 20 governments and 20 global information and communications technology firms — an idea that could form a larger platform to deal with cyber shocks.
The financial crash showed the value of managing interconnected risk, and the potential for catastrophe if it is ignored. Similar risks are aggregating in cyberspace, and the need for action is clear. We must lift our eyes to look for risk not just within our own perimeters, but with others we depend on for that distant digital perfection.
Jason Healey is director of the Atlantic Council's Cyber Statecraft Initiative. Dan Riordan is CEO of Zurich Insurance Global Corporate in North America.