Chubb CEO Urges Businesses to Take Holistic Approach to Combating Attacks On Critical Technology Infrastructure.

Business Editors

WASHINGTON--(BUSINESS WIRE)--Feb. 27, 2002

O'Hare Advocates Raising Cyber Risk Management to Corporate Governance 

Level And Supporting Legislation, Regulation & Partnerships that

Encourage Information Sharing 

In a special address to corporate risk management and information technology officers, the chief executive of a major U.S. insurance company stressed that technology threats cannot be managed "within any one silo" of an organization but must instead be addressed cooperatively across divisions, companies and industries, between the public and private sectors and around the globe.

Speaking before the Bureau of National Affairs' (BNA) second annual cybersecurity summit, Dean R. O'Hare, chairman and CEO of The Chubb Corporation, cautioned against segregating the management of cyber risks in a company's IT department. The involvement of all functions is necessary, he noted, and can occur only if physical and cyber security, as well as business continuation and disaster recovery, become a core corporate governance issue.

"It is increasingly clear that we cannot manage these risks within any one silo. Cybersecurity must be an integral part of a company's overall security planning - with support and oversight by the company's most senior management and board of directors," he said. "Information technology experts cannot do this alone. They must work with security, human resources, risk management, general counsel and line management across the entire enterprise to develop policies and procedures to minimize risks."

Taking that collaborative approach several steps further, Mr. O'Hare told the audience that the interdependent nature of the economy mandates coordination within the business community and between government and private entities. As examples of how this is already being implemented, he cited: BITS, the technology group for The Financial Services Roundtable, which was formed by CEOs of the largest bank-holding institutions in the United States as a strategic "brain trust" for the financial services industry in the e-commerce arena; the National Association of Manufacturers' Homeland Security Committee, which was recently formed to help member companies understand key operational and policy issues, including cyber security; and the Critical Infrastructure Protection Board formed by President Bush's chief cyber security adviser, Richard Clarke, to improve coordination between federal agencies and businesses.

Cooperation between business and law enforcement authorities is equally critical, Mr. O'Hare noted, even as many businesses continue to fear that reporting a cyber crime may rouse negative publicity and alarm various constituencies. Only 36 percent of those that experience an electronic intrusion report it to authorities, according to the Computer Security Institute.

"It is understandable why business leaders are concerned about their corporate reputations. There is, perhaps, nothing of greater value to a company, its customers and its shareholders. However, when a company fails to reach out to law enforcement, it leaves itself more vulnerable to future crimes," he warned. "Law enforcement also needs to establish relationships of greater trust with private industry. Investigators need to seek out companies when they have leads on a crime. And they need to play a greater role in concert with the private sector in helping to prevent as well as solve these kinds of crimes."

To ensure that federal, state and local law enforcement agencies have the tools necessary to battle cyber-age criminals and terrorists - and to ensure that the sharing of vital security information between public and private organizations is encouraged and systematized - Mr. O'Hare told his audience to become more active in shaping and supporting key legislative and regulatory changes. Those changes might include revising public disclosure laws that inhibit the sharing of sensitive information and increasing the penalties for committing cyber crimes.

Mr. O'Hare also emphasized the importance of contingency planning and how CEOs and directors must ensure that their firms are prepared for all possible threats. "A lack of oversight on their part may expose them to personal liability. Shareholders and their attorneys may try to prove that the chief executives and board members were negligent in their management and hold them responsible for stock losses. Or, business customers may hold the CEOs and board members responsible for revenues lost when the company fails to provide the product or service they need to continue their own operations," he said.

Mr. O'Hare closed by describing how Chubb is striving to become a "center of excellence" on cybersecurity matters and introducing products that help companies cover gaps in traditional liability policies. On the partnership front, the company is also forging relationships with groups ranging from The Business Roundtable and Financial Services Roundtable to the FBI and International Association of Police Chiefs. Chubb also is involved in trying to break down the barriers that prevent partnerships between business and government. Prior to BNA's summit, Chubb hosted a discussion forum between risk management experts from financial institutions and John Tritak, director of the Critical Infrastructure Assurance Office, and Patrick M. Ford, Internet fraud expert with the Federal Bureau of Investigation.

"To defeat cyber terrorism and crime, the emphasis must be placed on teamwork among business, government and law enforcement. That cooperation must exist both within, and beyond, the borders of any single country," he concluded. "I ask you to join us and get involved in similar private-public partnerships both here and elsewhere around the world. Now more than ever, it's time for all of us to take up arms together in the war against cyber crime."

With more than $25 billion in assets, The Chubb Corporation is a holding company for a family of property and casualty insurance companies known informally as the Chubb Group of Insurance Companies. The member insurers of the Chubb Group of Insurance Companies form a multi-billion dollar organization providing property and casualty insurance for personal and commercial customers worldwide through 5,000 independent agents and brokers. Chubb's global network includes branches and affiliates throughout North America, Europe, Latin America, Asia and Australia.