Cybersecurity, Risk, And Credit In U.S. Public Finance

Transcription

1 Credit FAQ: Cybersecurity, Risk, And Credit In U.S. Public Finance Primary Credit Analyst: Geoffrey E Buswick, Boston (1) ; geoffrey.buswick@spglobal.com Secondary Contacts: Theodore A Chapman, Dallas (1) ; theodore.chapman@spglobal.com David N Bodek, New York (1) ; david.bodek@spglobal.com J. Kevin K Holloran, Dallas (1) ; kevin.holloran@spglobal.com Table Of Contents Frequently Asked Questions Related Research MARCH 13,

2 Credit FAQ: Cybersecurity, Risk, And Credit In U.S. Public Finance Cyberattacks on all types of companies, governments and other organizations are regular news headlines. Motivations of the attackers vary and while it may appear that there is little discrimination as to the type of entity targeted, with retail stores, political national committees, and major tech giants all reporting incidents, almost all cyberattacks have an intended result. Entities in the U.S. public finance sector are attacked with increasing regularity. While these instances may not always make the news, attacks on state and local governments, utilities, hospitals, and schools underscore the vulnerability of the nation's infrastructure to well-designed cyberattacks. Most of the physical and much of the social infrastructure in the United States is funded by state and local governments and public enterprises. Taxpayers and customers generally have expectations for the services provided by government to be efficient and low-cost. As technology and costs have allowed it, government has become increasingly reliant on technology as a vehicle for delivering these services more efficiently. The use of technology, however, ideally also requires an additional and critical level of risk management to protect the integrity of the services and confidentiality of those being serviced. Overview Although no cyberattack to date has caused S&P Global Ratings to change a U.S. public finance entity's rating, we do see these attacks as introducing additional credit risk. Post-attack costs of responding and remediating the damage attributable to an attack pose the greatest risk to credit quality in our view, although these have been modest so far. U.S. public finance issuers are exposed to various credit risks through the increasing regularity of cyberattacks. There are prudent good-governance actions that could help mitigate the risks, but with the increasing sophistication and diversity of types of attacks, no measures fully insulate against the risks. The term "cyberattack" covers a variety of actions. There are four types in particular that we see introducing risk to public finance issuers. The first is "hacking" which is straightforward and motivated by the simple theft of money or information. The second type of attack we see in public finance is "ransomware," where key data is stolen and encrypted until a ransom payment has been made and a decryption key is given. Third is "hacktivism," where to protest a policy action or from a desire to change a policy action, sensitive information is stolen and used against either an individual (e.g., sensitive personal health information) or an organization. Finally there is "malware," where malicious software is planted into an organization's electronic system in order to steal, observe or cause business or reputational disruption--often at some later date. Any of these have the ability to affect liquidity, public policy, and constituent confidence, and all could affect credit quality if improperly handled. The total annual cost to the global economy from cybercrimes has been estimated at over $400 billion by the Center For Strategic And International Studies and McAfee. There are a number of root causes of cybersecurity breaches, MARCH 13,

3 Credit FAQ: Cybersecurity, Risk, And Credit In U.S. Public Finance most commonly inappropriate downloading or clicking on s or web pages where employee awareness or weak controls do not prevent such practices. In the United States, risk management standards and requirements as well as best practices do exist, but we have observed that they vary. There are no minimum standards which public finance issuers are required to meet. No entity--local government, utility or hospital-- can guarantee itself protection against every one of these threats. Therefore, could an incident affect credit quality, and if so, how? Following are some questions that have been posed to S&P Global Ratings U.S. public finance analysts. Frequently Asked Questions What are the most common causes of breaches? S&P Global Ratings typically hears that the most common "point of access" for a hacker is human error, or "curiosity clicking" on what have become commonly known as phishing-mails Brute force attacks, while in existence and a constant threat, have a surprisingly low success rate. The other most common cause of a breach is an organization failing to see the connected nature of all of its access points hardening some databases, but leaving unknown or un-thought-of backdoor access points that hackers can exploit. Isn't there cyber insurance against these types of incidents? Yes, but it can be costly and if the insurer believes that the issuer has not taken all reasonable steps for protections (e.g., robust IT architecture, policies and standard procedures and training around them) then it will deny the claim. That said, we are hearing with greater frequency of various levels of insurance being purchased. How do we factor cyber risk into ratings? For each security type that we rate there is a publicly available criteria article that discusses how we look at the associated credit risks for that security. Within these articles, there are not specific sections carved out for cyber security but we see the cyber issue touching many criteria sections, including: management, liquidity, and operations. Post-attack costs of responding and remediating the damage attributable to an attack pose the greatest risk to credit quality in our view, although have been modest so far. Business disruption, adverse legal outcomes and loss of reputation are among myriad potential consequences. The most likely adverse ratings impact would stem from an attack weakening the financial-risk profile, most likely in terms of future revenue, and by causing deterioration in credit metrics. Overall, this is a difficult risk to assess for ratings given the following characteristics: Limited, asymmetric information, with issuers having knowledge of their preparations but limited visibility as to the risks they face. A type of risk that is close to being random in occurrence, but also with high correlation risk (if a building burns down, others aren't at risk unless very close by, whereas the nature of cyber risk means a virtual "fire" in one location can easily spread to almost any other). This is a factor that makes the pooling of cyber risk something that helps insurers manage many other forms of risk more difficult. An absence of linear risk tradeoffs, most crucially in that the amount spent on risk-prevention is no guide as to the relative likelihood of attack, nor of the magnitude of any subsequent damage. There are some predisposing risk factors that make some entities appear more at risk such as reliance on MARCH 13,

4 Credit FAQ: Cybersecurity, Risk, And Credit In U.S. Public Finance electronic payment systems, storage of large volumes of personal identifying information but the ubiquity of mass data storage and network connectivity means that most municipal entities have some form of vulnerability. Given the risk profile of cyber risk, we think it is better assessed as a form of event risk. For ratings, the most transparent factors that we can seek to understand are: The cost and level of preventative security measures; The cost of insurance premiums; An assessment of risk preparedness and disclosure; and Costs resulting from successful attacks and their impact on financial metrics. Have there been any publicly documented instances of breaches in public finance? Did these incidents result in a rating change? There have been instances across the public finance rated universe of state-level breaches, to data stolen from a hospital system, to utility companies held up until a ransom was paid, to malware installed to disrupt the local economy. South Carolina's Department of Revenue was hacked in October 2012 and private tax return data was released publicly. In health care, there have been a few notable data breaches that are worth mentioning. Several years ago, MedStar Health (Maryland) suffered a data breach, and more recently, Banner Health (Arizona) also disclosed one. MedStar Health has gone on to be an industry expert on how to best prepare and respond to potential cybersecurity issues. The Lansing Board of Water and Light's payment of $25,000 in 2016 to regain access to its system underscores the nefarious and economic incentives underlying these attacks. Attacks could be significantly more malignant, such as those aimed at crippling critical infrastructure and, in turn, the U.S. economy. All organizations responded rapidly and appropriately to contain the loss of information, no ratings were affected, and reputational damage was limited. Is every cyberattack disclosed? No, and that is part of the credit concern around cyberattacks. There is no specific standard requiring disclosure when a system has been targeted. Many public finance entities are learning from the experiences of being attacked and changing protocols to improve internal controls, but others believe that once the event is behind them it is best to keep the attack hidden for fear of losing constituent confidence. We understand that governments may wish to be discreet about the measures they have adopted, given that a statement of strength might be seen as a provocation and incentive to cyber criminals. Securities laws, primarily Securities and Exchange Commission Rule 15c2-12, are, in part, designed to elicit disclosure of timely, comprehensive and accurate information about risks and events important to investment decisions. There is growing pressure from regulators, politicians and investors to improve disclosure of cyber incidents, as part of a broader move to recognize the risks at hand and ensure adequate preparation. At S&P Global Ratings, we encourage full disclosure of any attack and will be asking about such events in our rating and surveillance meetings. Don't these issuers have regulatory requirements for risk management and hacking prevention? Hospitals and health systems have long had a duty to protect patients' clinical information, which would likely be a part of any hacking attack, either for ransom or potentially individual or organizational blackmail purposes. In 2007, the Federal Energy Regulatory Commission essentially deputized the North American Electric Reliability MARCH 13,

5 Credit FAQ: Cybersecurity, Risk, And Credit In U.S. Public Finance Organization (NERC) to establish and police cybersecurity standards for electric utilities. Compliance with NERC's cybersecurity standards is mandatory. For most of the rest of the public finance sector (states, local governments, water and sewer utilities, and educational facilities) there is no standard, but the situation is generally addressed through an amalgam of recommended best practices to try to protect not only personal information but also critical infrastructure. What kind of best practices exist to help manage risk? As stated above, there are various recognized "best practices" to mitigate the risks introduced by cyberattacks. In general they can be summarized as follows: Harden systems and backups -- separate the "enterprise" (customer accounts, back office) from the operations (critical assets); and backup all critical information regularly and offline. Identify vulnerabilities -- perform a risk analysis or generate a heat map of where your government or enterprise is exposed to cyber threats. Have written policies and train on them ensure that staff understands what is allowed on the system and regularly train on the policies. Test policies and system for weaknesses run regular tests to ensure that the staff knows how to run the enterprise without various systems for a period of time if need be and know who and when decides to "pull the plug" from the outside network. Related Research Credit FAQ: How Ready Are Banks For The Rapidly Rising Threat Of Cyberattack?, Sept. 28, 2015 Looking Before They Leap: U.S. Insurers Dip Their Toes In The Cyber-Risk Pool, June 9, 2015 Cyber Risk And Corporate Credit, June 9, 2015 Only a rating committee may determine a rating action and this report does not constitute a rating action. MARCH 13,

6 Copyright 2017 by Standard & Poor s Financial Services LLC. All rights reserved. No content (including ratings, credit-related analyses and data, valuations, model, software or other application or output therefrom) or any part thereof (Content) may be modified, reverse engineered, reproduced or distributed in any form by any means, or stored in a database or retrieval system, without the prior written permission of Standard & Poor's Financial Services LLC or its affiliates (collectively, S&P). The Content shall not be used for any unlawful or unauthorized purposes. S&P and any third-party providers, as well as their directors, officers, shareholders, employees or agents (collectively S&P Parties) do not guarantee the accuracy, completeness, timeliness or availability of the Content. S&P Parties are not responsible for any errors or omissions (negligent or otherwise), regardless of the cause, for the results obtained from the use of the Content, or for the security or maintenance of any data input by the user. The Content is provided on an "as is" basis. S&P PARTIES DISCLAIM ANY AND ALL EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE, FREEDOM FROM BUGS, SOFTWARE ERRORS OR DEFECTS, THAT THE CONTENT'S FUNCTIONING WILL BE UNINTERRUPTED, OR THAT THE CONTENT WILL OPERATE WITH ANY SOFTWARE OR HARDWARE CONFIGURATION. In no event shall S&P Parties be liable to any party for any direct, indirect, incidental, exemplary, compensatory, punitive, special or consequential damages, costs, expenses, legal fees, or losses (including, without limitation, lost income or lost profits and opportunity costs or losses caused by negligence) in connection with any use of the Content even if advised of the possibility of such damages. Credit-related and other analyses, including ratings, and statements in the Content are statements of opinion as of the date they are expressed and not statements of fact. S&P's opinions, analyses, and rating acknowledgment decisions (described below) are not recommendations to purchase, hold, or sell any securities or to make any investment decisions, and do not address the suitability of any security. S&P assumes no obligation to update the Content following publication in any form or format. The Content should not be relied on and is not a substitute for the skill, judgment and experience of the user, its management, employees, advisors and/or clients when making investment and other business decisions. S&P does not act as a fiduciary or an investment advisor except where registered as such. While S&P has obtained information from sources it believes to be reliable, S&P does not perform an audit and undertakes no duty of due diligence or independent verification of any information it receives. To the extent that regulatory authorities allow a rating agency to acknowledge in one jurisdiction a rating issued in another jurisdiction for certain regulatory purposes, S&P reserves the right to assign, withdraw, or suspend such acknowledgement at any time and in its sole discretion. S&P Parties disclaim any duty whatsoever arising out of the assignment, withdrawal, or suspension of an acknowledgment as well as any liability for any damage alleged to have been suffered on account thereof. S&P keeps certain activities of its business units separate from each other in order to preserve the independence and objectivity of their respective activities. As a result, certain business units of S&P may have information that is not available to other S&P business units. S&P has established policies and procedures to maintain the confidentiality of certain nonpublic information received in connection with each analytical process. S&P may receive compensation for its ratings and certain analyses, normally from issuers or underwriters of securities or from obligors. S&P reserves the right to disseminate its opinions and analyses. S&P's public ratings and analyses are made available on its Web sites, (free of charge), and and (subscription) and (subscription) and may be distributed through other means, including via S&P publications and third-party redistributors. Additional information about our ratings fees is available at STANDARD & POOR'S, S&P and RATINGSDIRECT are registered trademarks of Standard & Poor's Financial Services LLC. MARCH 13,