What's Happening?

Facebook Twitter Youtube Linkedin

NEED HELP? QUESTIONS@FIA.ORG.ZA

become A FIA member TODAY
member login

The Imminent Reality of Cyberattacks for Business

ARTICLE BY

  • Aon

SHARE THIS POST

Participants in Aon’s 2019 Global Risk Management Survey ranked cyberattacks and data breaches as #6 in the top 10 risks facing organisations today. The risk entered the Top 10 list for the first time (at #9) in 2015 and is projected to go from #6 to #3 in the next three years. Startling figures have changed the public perception of cyberattacks:

“When we break it down by industry; banks, retail, healthcare, insurance and technology companies consider cyberattacks or data breaches the top risk. These sectors rely heavily on digital advances to improve operational efficiency and increase their competitiveness. They were also the targets for the majority of mega cyberattacks in 2018,” says Zamani Ngidi, Principal Cyber Risk Consultant at Aon South Africa. 

Why have cyberattacks and data breaches become so rampant?

Aon’s 2019 Cyber Security Risk Report highlights some of the vulnerabilities:

  1. The rapid expansion of operational data from mobile and edge devices, along with growing reliance on third-party—and sometimes even fourth-party—vendors and service providers, are heightening cyber risks. 
  2. The combination of faster networks and vulnerable devices – Internet of Things (IoT) and the forthcoming transition to 5G – opens more doors to destructive threats.
  3. Employees remain one of the most common causes of breaches. In a 2018 Aon survey, 53% of respondents said their companies experienced an insider-related attack within the previous year. When an employee of a large healthcare company inadvertently opened a phishing email, nearly 80 million patient records on his system ended up in the hands of a foreign government.
  4. As the number of merger and acquisition deals rises (M&A deal value topped US$4 trillion in 2018), companies with a flawless approach to cyber security might have acquired a target that lacks cyber protection measures.
  5. Organised crime is now using former intelligence members for more sophisticated attacks, while state actors are both broadening the nature of their attacks and increasing their frequency.
  6. Lastly, an ever-changing set of regulations from governments around the world compounds the difficulties of managing cyber risks.

“Despite the fact that the breadth and scope of cyber coverage has increased substantially since 2017, only 27% of participants in Aon’s 2019 Global Risk Management Survey from the Middle East and Africa region purchased cyber insurance,” says Zamani.

Top industries purchasing cyber insurance are as follows:

  • Investment and Finance – 83%
  • Healthcare – 81%
  • Retail Trade – 78%
  • Banking – 75%
  • Insurance – 73%

Given that technology continues to impact every job function, from the CEO to the entry-level intern, Zamani believes that it is imperative for organisations to establish a comprehensive approach to cyber risk. “Businesses must continually assess their overall cyber risk profile, remediate where recommended and proactively manage their defences.”

Cyber risk assessment

The use of cyber risk assessments has risen 16% since 2015. However, only 59% apply any formal process to identify and evaluate cyber risks. “This means that a significant number of boards and executives are making strategic risk management decisions with little to no data-driven insights when they tackle one of the most rapidly evolving risks,” explains Zamani.

Of those risk management teams that are involved in cyber risk assessment activities, there has been a positive increase in the application of quantification techniques to 40%, up from 23% in 2017, to evaluate the financial exposures from cyber risks.

Despite the increase, the majority of risk assessments are still not using any financial metrics to communicate the materiality of cyber exposure. The outputs from these assessments are not presented in a way that senior executives can understand their financial risk appetite, nor does it support data-informed capital allocation decision-making.

“Although there appears to be a positive correlation between the upward trending of risk assessments and quantitative techniques and the increase in captive utilisation (from 8% in 2015 to 16% in 2019) and insurance procurement (21% in 2017 to 54% in 2019), risk management teams need to be more actively involved in bridging the gap between technical cyber risk assessment activity and the enterprise risk management framework,” says Zamani.

It is important for risk managers to gain a better understanding of the impact of cyber risk.  “The risk that cyber-crime poses affect all companies, big and small.  This is where the insights and guidance from an expert broker that provides a holistic offering of advisory and security services is invaluable to enable organisations to anticipate and effectively manage their exposures,” Zamani concludes. 

Subscriber Terms and Conditions

  1. APPLICATION OF TERMS
    • These terms and conditions (“Subscriber Terms”) apply to the subscription by any qualifying member of the South African Underwriting Managers Association NPC (“SAUMA”) to the services and benefits offered by FIA Services (Pty) Ltd (“FIA Services”) under the SAUMA affiliation arrangement (“Subscription”).

  2. NATURE OF SUBSCRIPTION
    • A Subscription under this arrangement:
      • does not constitute membership of FIA NPC;
      • does not confer any voting rights or governance participation in FIA NPC; and
      • is governed solely by the contractual relationship between the Subscriber and FIA Services.

  1. ELIGIBILITY
    • To qualify for the Subscription, the applicant must, at the time of application, be a current paid-up member of SAUMA.
    • FIA Services will verify the applicant’s SAUMA membership status with SAUMA prior to activation, and may re-verify such status periodically.
    • If a Subscriber ceases to be a paid-up member of SAUMA, the Subscription will correspondingly be terminated.
    • Applicants are required to authorise FIA Services to confirm their SAUMA membership status with SAUMA as part of the application process.

  1. SERVICES
    • The Subscription entitles the Subscriber to the following benefits:
      • Complimentary access to the FIA CPD Platform;
      • Complimentary access to the FIA Insight Magazine (digital edition);
      • Advertising opportunities on FIA platforms at a discounted rate of 15% (fifteen percent) off the prevailing published rates; and
      • Invitations to attend FIA Technical Webinars annually.
    • FIA Services reserves the right to update, vary or substitute the Services from time to time, provided that the overall value and nature of the benefits remain materially the same.

  1. FEES AND PAYMENT
    • The monthly subscription fee is R260.00 (two hundred and sixty rand) for up to seven registered individuals (Key Individuals and Representatives), and R36.00 (thirty-six rand) per additional registered individual thereafter, excluding VAT.
    • The Subscriber shall provide FIA Services with the required details of each individual to be registered under the Subscription for the purposes of activation and billing.
    • All fees are exclusive of VAT, which shall be charged at the prevailing statutory rate.
    • Subscription fees are reviewed annually in March and may be adjusted with effect from 1 April.
    • Any changes to the Subscription, including but not limited to the number of Representatives and Key Individuals registered under the Subscription, may only be effected once annually during the annual review period in March of each year, with such changes taking effect from 1 April.
    • Subscription fees shall be billed monthly in arrears, unless the Subscriber elects an annual billing cycle at the time of application.
    • The Subscriber shall ensure that all billing information (including contact details, authorised signatories and bank account details) is kept accurate and up to date.
    • Non-payment of subscription fees may result in suspension of access to the Services until such fees are brought up to date.
    • The Subscriber acknowledges and agrees that all subscription fees payable under these Subscriber Terms may be collected by way of debit order, which shall be processed by the holding company, FIA NPC (The Financial Intermediary Association of South Africa), on behalf of FIA Services. Payment to FIA NPC shall be deemed to constitute valid and sufficient discharge of the Subscriber’s payment obligations to FIA Services under these Subscriber Terms.

  1. ONBOARDING
    • Onboarding will be conducted as a Subscription with FIA Services under the SAUMA affiliation arrangement.
    • Onboarding will not confer FIA NPC membership status or any associated rights.
    • Onboarding is conditional on confirmation of the Subscriber’s current SAUMA membership at the time of application

  1. DATA PROTECTION
    • FIA Services will process all personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) as set out in our POPIA policies.
    • By subscribing, the Subscriber authorises FIA Services to confirm their SAUMA membership status with SAUMA and to process personal information for the purposes of fulfilling the Subscription.

  1. TERMINATION
    • The Subscriber may terminate the Subscription by giving FIA Services one calendar month’s written notice.
    • FIA Services may terminate the Subscription on one calendar month’s written notice, or immediately if the Subscriber breaches these Subscriber Terms and fails to remedy such breach within 14 (fourteen) days of receiving written notice.
    • Termination of the SAUMA–FIA Services affiliation agreement shall not automatically terminate these Subscriber Terms.
    • Termination by the Subscriber shall not relieve the Subscriber of liability for any subscription fees accrued up to the effective date of termination.
    • FIA Services may suspend or terminate the Subscription with immediate effect in the event of non-payment of fees by the Subscriber.

  1. GENERAL
    • These Subscriber Terms are governed by the laws of the Republic of South Africa.
    • Any disputes arising under these Subscriber Terms shall be dealt with in accordance with the dispute resolution provisions contained in the FIA NPC membership terms and conditions, as modified to reflect that the contractual relationship is with FIA Services.
    • Any notices required under these Subscriber Terms may be validly delivered by email to the addresses provided in the Subscriber’s application form, and such notices shall be deemed received on the day of transmission if sent during business hours.
    • The Subscriber may not assign, cede or transfer any of its rights or obligations under these Subscriber Terms without the prior written consent of FIA Services.
    • No variation of these Subscriber Terms shall be of any force or effect unless reduced to writing and signed by both FIA Services and the Subscriber.