Chubb Risk Management Specialist Urges Businesses to Cooperate With Public Sector in Cyber-Crime Fight.

Business Editors

LONDON--(BUSINESS WIRE)--Dec. 9, 2002

A high-tech risk management specialist urged corporate executives and government and law enforcement officials meeting today to work together to prepare for an anticipated increase in cyber crime.

Speaking at the E-Crime Congress, Bill Barr, vice president, Loss Control Services, Chubb Group of Insurance Companies, said all indicators point to cyber crime becoming a larger threat to U.K. and other companies around the world.

"While U.K. cyber crime statistics have not been as extreme as in the United States, it appears that more bad news may be on the horizon," said Barr. "It's been reported that as many as two-thirds of U.K. businesses had at least one malicious incident last year, double the number in 2000. And while the average loss was (pound)30,000, several businesses experienced a loss of more than (pound)500,000."

Barr said research in the U.S. shows that 90 percent of companies there have been the target of a cyber attack, with 80 percent suffering a financial loss. "In the past, we have seen how other high-tech crimes, such as the theft of computer chips and other high-tech components, have been, shall we say, exported from the United States to the United Kingdom," he said.

As a result, Barr suggested that U.K. firms might benefit from understanding how some U.S. firms and government and law enforcement officials have been trying to address the problem.

Barr urged companies to create an enterprise-wide risk management program, overseen by either the chief executive officer or a chief risk officer reporting to the CEO.

"Too many companies are making a mistake by managing risks in different departments, or what we like to call silos," he said. "IT executives, for example, should not try to manage the cyber problem by themselves. They don't have all the expertise in managing risk. In addition, cyber risks can generate non-IT-related risks involving physical, human and capital resources."

According to Barr, every company also should:

-- Establish a risk management council, which would bring together representatives from finance, legal, human resource, communications, line operations and other departments.

-- Create a culture, policies and procedures that encourage or direct every employee to play a role in identifying and managing risk.

-- Analyze their interdependencies. In other words, consider what would happen if an unprepared supplier or business partner or even customer were to experience a business interruption or go out of business due to a cyber or other disaster. Additionally, determine what measures these firms have taken to protect themselves.

-- Partner with law enforcement, which can put the cyber criminals behind bars, and government officials, who create the laws and regulations required to arrest them and who play a vital role in a disaster. Having a solid, mutually trusting relationships in place with law enforcement before a cyber crime occurs is often vital to apprehending the crooks.

-- Develop contingency management and disaster recovery plans that address cyber as well as all other potential disasters.

"If they're not already addressing the cyber issue comprehensively, companies must, if they are to survive or not impede their growth," concluded Barr.

The member insurers of the Chubb Group of Insurance Companies form a multi-billion dollar organization providing property and casualty insurance for personal and commercial customers worldwide through 5,000 independent agents and brokers. Chubb's global network includes branches and affiliates in North America, Europe, Latin America, Asia and Australia.