Supporting digital risk management - CRO Forum work on digital incident categorisation

Transcription

1 General Public Release Supporting digital risk management - CRO Forum work on digital incident categorisation OECD Expert Group meeting 12/13 May 2017 Nick Kitching, CRO Swiss Re Europe S.A.

2 CRO Forum cyber risk work General Public Release The CRO Forum is currently trialling an updated version of the proposed categorisation. The trial is supported by ORX and ORIC. The trial looks to test the tracking, reporting and sharing data (on anonymized/aggregated basis) regarding digital incidents with a view to understanding whether the categorization methodology can: 1. enhance information security practices; 2. provide useful aggregate empirical benchmark data; and 3. support cyber underwriting practices. Aims learn from the challenges and opportunities; and identify consistent data identification/collection practices. 2

3 Trial categorisation General Public Release Step one incident identified as high or medium on severity matrix thresholds High Medium Severity matrix thresholds based on factors such as customers affected, direct financial impact, privacy, legal/regulatory impact, reputational impact & business interruption (service criticality, duration and service impact) Step two categorisation methodology used to describe incident (13 factors) INCIDENT EVENT TYPE ROOT CAUSE IMPACT/COVER Leveraging VERIS definitions Capture: Incident type (technical impact) Action Asset Affected kind of data Actor Identifies what happened Existing op risk framework Specifies why the cyber event occurred Existing op risk framework Business impact based on RMS/AIR schema (22 types) Financial impact Date of detection Impact location IT focused. Operational risk. focused Underwriting. focused The trial looks at whether the concept built using existing internationally accepted frameworks for categorisation of incidents/events can provide empirical descriptions of an IT incident/attack that supports risk management. 3

4 Challenges, opportunities and observations General Public Release Challenges issues around assessing incident costs, duplication with other internal requirements, application of each Member s unique severity assessment matrix for rating incidents, definitional refinement of data points, tracking of so-called near-misses. Existing internal silos Opportunities increased communication, coordination and engagement across the key internal stakeholders of each Member applicability to emerging regulatory requirements (e.g., GDPR) and other cyber incident frameworks (e.g., STIX); embedding operationally leveraging emerging technologies (e.g., end-to-end automated IT Incident Management tools, etc.) Aggregated empirical benchmark data It is too early to draw any firm conclusions from the incidents captured so far and whether the trial could deliver the full benefits anticipated. However, it is clear that Members appear to be experiencing good internal dialogue as a result of applying the trial within their organisations. 4

5 General Public Release 5

6 General Public Release Legal notice 2017 Swiss Re. All rights reserved. You are not permitted to create any modifications or derivative works of this presentation or to use it for commercial or other public purposes without the prior written permission of Swiss Re. The information and opinions contained in the presentation are provided as at the date of the presentation and are subject to change without notice. Although the information used was taken from reliable sources, Swiss Re does not accept any responsibility for the accuracy or comprehensiveness of the details given. All liability for the accuracy and completeness thereof or for any damage or loss resulting from the use of the information contained in this presentation is expressly excluded. Under no circumstances shall Swiss Re or its Group companies be liable for any financial or consequential loss relating to this presentation. 6