Cyber terrorism. (Security).

The aftermath of 9/11 and increasing tensions in the Middle East and with Iraq have heightened the risk of cyber-terrorism, and companies need to review their security procedures and insurance coverage.

While property and casualty insurers wrestle with the risks of terrorism in the aftermath of September 11, terrorism coverage provided by ebusiness insurance policies hasn't changed: Most of these policies continue to cover cyber-terrorism. In addition, some insurers that had excluded cyber-terrorism now offer terrorism coverage for an added premium.

The underwriters' position stems from their difficulty identifying perpetrators of cyber-terror attacks and the fact that damages from cyber-terrorism resemble consequences of other types of hacking incidents or Internet attacks. Most insurers feel that defenses against attacks on systems by hackers are identical to those needed to limit attacks by terrorists.

At this point, there is anecdotal evidence of an increase in systems attacks stemming from the Middle East unrest and the U.S. operations in the war against terrorism. Surveys by a leading information security company of attacks on information systems before and after September 11 found the number of attacks rose precipitously within two weeks of the terrorist attacks as the war against terrorism took shape.

Assessing the Risk

Although it is not clear whether these incidents were directly related to the 9/11 attacks, the evidence indicates that terrorism could have raised the intensity of attacks on information technology. The perceived increase in exposure from terrorist attacks focusing on technology is also apparent in two published reports -- one published well before September 11 and one immediately after.

A 1999 report by the Center for the Study of Terrorism and Irregular Warfare at the Naval Postgraduate School in Monterey, Calif., concluded the barrier to entry for anything beyond annoying hacks by terrorists is high. Terrorists, the authors thought, generally lacked the wherewithal and human capital needed to mount a meaningful operation. They saw cyber-terrorism as a phenomenon of the future.

The Monterey study estimated that it would take a group starting from scratch two to four years to reach an advanced level and 6-10 years to reach the level where the most serious potential damage could be done -- although some groups might get to that level in a few years or turn to outsourcing or sponsorship to extend their capability.

The authors determined that only religious groups are likely to seek the most damaging capability level, consistent with their indiscriminate application of violence. On the other hand, they concluded that single-issue terrorists pose the most immediate threat because they're likely to accept disruption as a substitute for destruction.

A subsequent Dartmouth College report, published Sept. 22, 2001, provided evidence that cyber-terrorists pose a significant threat now. It found that cyberattacks could escalate in response to U.S. and allied retaliatory measures against the terrorists responsible for the 9/11 attacks. The report found that politically motivated cyberattacks had escalated around the world, with an increase in number, scope and level of sophistication. Where earlier cyber-attacks were relatively benign, the more recent attacks targeted vital communications and critical infrastructure systems. Notably, the report showed that terrorists are increasingly involved in targeting information technology infrastructure.

Evidence of cyber-terror activities was found in several areas:

* The Pakistan-India conflict. Indian Internet sites defaced by Pakistani hacker groups have been political, highly visible or involved in information dissemination. Examples include an Indian government site, television network, newspaper, science agency and an atomic research facility. In the latter incident, five megabytes of possibly sensitive nuclear research or other information was reportedly down-loaded. Pro-Pakistan defacements of Indian Web sites has risen dramatically, and one pro-Pakistan hacker group has targeted U.S. sites in the past, defacing those belonging to the Department of Energy and the U.S. Air Force.

* The Israel-Palestinian Conflict. In Israel, Palestinian cyber attackers have carried out significant Web site defacements, engineered coordinated distributed denial-of-service attacks and system penetrations, and utilized worms and Trojan horses. Efforts to track attacks show a breadth of cybertargets and attack methodologies, and demonstrate the vulnerability of electronic infrastructures. One attack was spurred in part by the kidnapping of three Israeli soldiers in October 2000. Pro-Palestinian hackers retaliated against pro-Israeli hackers by taking down sites belonging to several Israeli government agencies and financial organizations.

* U.S.-China spy plane incident. The mid-air collision between a U.S. surveillance plane and a Chinese fighter aircraft in April 2001 triggered an online campaign of mutual cyber-attacks and Web site defacements surrounding the political dispute between the two countries.

The report concluded that Iraq and Libya are among several countries thought to be developing information warfare capabilities. In addition, perpetrators from countries not directly involved in the U.S.-led war on terrorism could launch cyber-attacks against U.S. systems under the guise of a country that is the focus of the war. Experts are particularly wary of these risks because it is relatively easy to disguise the origins of information attacks.

Hackers frequently launch distributed denial-of-service attacks against an array of targets, but the danger lies in a coordinated attack on significant national resources, such as communications, banking and other financial capabilities. Cyber-attacks against critical communication nodes could be particularly harmful during a crisis. Experts believe that router vulnerabilities could be used to gain control of a number of Internet backbone routers.

A number of reports on national security have raised the specter of an unanticipated, massive cyber-related attack on critical infrastructures -- such as telecommunications, electrical power systems, gas and oil, banking and finance, transportation, water supply systems, government services and emergency services -- that could disrupt core functions. The degree to which the infrastructures are dependent on information systems, and may be interrelated, is still not well understood.

The government's concern over the possibility of debilitating attacks led to the creation of the President's Critical Infrastructure Protection Board (CIPB) in October 2001. It released a draft National Strategy to Secure Cyberspace on Sept. 18, 2002 with the aim of setting an agenda to "secure the information technology networks and systems that are necessary for the nation's economy and critical services to operate."

The CIPB team is evidently convinced that the threat to the nation's critical information infrastructure is immediate and real. The case for action is based upon several conclusions: past levels of cyber damage are not accurate indicators of the future; cyber incidents are increasing in number, sophistication, severity and cost; fixing vulnerabilities before threats emerge will reduce risk; and that everyone must act to secure their parts of cyberspace.

Surveys have shown that the costs associated with a severe computer attack are likely to be greater than the preemptive investment in a cyber-security program would have been. Designing strong security into the information systems architecture of an enterprise can reduce overall operational costs by enabling cost-saving processes such as remote access and customer or supply chain interactions that could not occur in networks lacking appropriate security.

The CIPB report contains a veiled threat that the government may move to regulate if the voluntary participation it is seeking from the private sector does not materialize and the health, safety or well-being of the American people is at risk.

Insurance Considerations

Once relevant security protections are in place, the CIPB recommends that organizations explore options for covering cyber-terror risk and the risk of systems and data vandalism through e-business insurance programs. Under e-business policies, breaches or failure of systems security trigger coverage for losses sustained directly by the insured or resulting in liability to third parties. Sometimes, the policies define "cyber-attack," "unauthorized access" or "unauthorized use" of systems.

Many e-business insurance policies specifically cover such events as denial-of-service attacks and malicious code attacks. Almost all focus on intentional acts of third parties that harm computer systems. Acts of cyber-terrorists will, in almost all cases, come within these "insuring agreement" definitions.

The CIPB report recommends that the responsibility for cyber-security be raised to the board level to oversee the sufficiency of cyber-security structure and controls. Standards for corporate directors and officers were being raised prior to the collapse of Enron Corp. and the revelations arising from WorldCom Inc. and other troubled companies. These recent events are likely to accelerate the process. Recent court cases in some states have implemented a higher standard of responsibility for boards for compliance with standards similar to those being recommended by the government for computer security.

Oversight duties can go beyond being reasonably informed, and may require a good-faith effort to assure that a corporation has adequate information and reporting systems. Failure to comply with the standards can potentially result in liability. The Business Judgment Rule defense -- which can exonerate directors when they rely on advice provided by company officials or other appropriate sources -- may be unavailable if a board fails to appropriately inform itself regarding the need for, and scope of, an information technology audit or implementation of best practices. The Business Judgement Rule defense is a rebuttable presumption that the board acted properly in making a decision.

The 9/11 attacks raised awareness about vulnerability to terrorism and brought into focus new risks to companies, reliance upon telecommunications and other grids, and new potential threats to the economy. Since each company has a different technology risk profile, board members need to understand these types of risks, help assess levels of protection and fulfill their compliance duties.

Best Practices for IT Security

Large businesses that could be at risk for terrorism should implement an education and compliance process overseen by a committee that includes the CFO, risk manager, CIO, the chief information security officer, auditing and key operations executives. The CIPB provides guidelines to facilitate the integrity, reliability, availability and confidentiality of the enterprise.

Best practices can now include an annual systems risk analysis and review of disaster recovery and business continuity plans, and an annual compliance assessment, including a review of the implementation of systems security policies and employee policies, as well as other security and operational activities.

Technical protections can include penetration testing, firewall rule base review, perimeter scanning, vulnerability analysis and threat assessments. Given the reliance on vendors that run systems for companies, businesses should review third parties that operate or have access to critical IT systems. Companies following best practices in this area typically require contracts with parties that have access to organizational information or processing facilities and include security requirements to ensure compliance with the organization's security policies and standards.

Effective risk management in the technology arena calls for implementing a process to deal with day-to-day changes in risk and frequent attempts by perpetrators to outmaneuver security. To win this battle, a company must identify and secure all of the key potential vulnerabilities. Keep in mind, a terrorist attacker may need to find and penetrate just one area of vulnerability to cause a potentially serious problem.

RELATED ARTICLE: Terms to Consider Including in Vender Contracts

1. A general policy on information security

2. Asset protection requirements, including controls to ensure the return or destruction of information

3. Integrity and availability requirements

4.. Complete description of services to be provided and verifiable performance criteria

5. Respective liabilities and responsibility for legal compliance

6. Technology insurance requirements

7. Intellectual property rights

8. The right to monitor, and revoke, user activity

9. The right to audit

10. Specification of physical and technical security standards

11. Communication procedures in time of emergency

12. A clear division of responsibility for system events and changes

Source. Marsh Inc.

Christopher Keegan is a vice president at Marsh inc. in New York. He can be reached at 212.345.6072 or christo [e-mail].