Hackers and Other Hazards.

New risks demand new risk-management techniques.

Risk management has always concerned itself with critical enterprise infrastructures -- processes and assets essential to basic business operations. In the past, such critical enterprise infrastructure represented physical plant, equipmer and inventory. But in a technology-based environment, an enterprise's core operations depend on electronic information and computer networks. Everything a business knows and has besides its creative people resides on its databases and systems.

Although an intangible asset, electronic information, notably knowledge databases and intellectual property, is a key driver of revenue and worth. Key processes and connections to customers and partners will be web-based -- whether they involve value chain integration, procurement, bill presentment, fulfillment, benefits management or legal services. What particularly troubles those entrusted with risk management is the lack of definition and quantification of these risks -- in particular because there's little historic data available for calibrating them.

Thus, information technology risk management now should involve the identification, assessment, control, mitigation and financing of probable risks commensurate with the enterprise's brand, reputation, assets and operations.

Consider the risk of electronic data destruction, corruption or disclosure by internal or external computer attackers. This cyber peril is critical -- especially to the financial services and health care industries. Remember the youth of the technologies and uncertain direction of Internet-related litigation and regulations. And businesses are reluctant to reveal information about cyber crime or cyber attacks, as the public relations and investor fallout could damage brand and reputation.

Then, too, businesses are less likely to notify law enforcement about known cyber crime and its perpetrators. And it's difficult to catch and convict such attackers, as it's relatively easy to hide under false addresses, electronically mask the route of the attack and escape from limited federal resources. However, conviction under the Computer Fraud and Abuse Act can entail prison sentences of up to five years per incident (10 years for second-time offenders) and a $250,000 fine.

Still, prosecutions and convictions won't approach the soaring number of computer attacks, which more than doubled to 8,268 incidents last year, according to reports filed with the Computer Emergency Response Team at Carnegie Mellon University. And these incidents -- reported voluntarily -- are the tip of the iceberg.

An important first risk-management step is to identify and understand cyber perils (see pages 32 and 48). Although they're labeled as direct risks and liability risks, one security breach may result in both a direct loss and a liability loss.

Some of these perils existed pre-Internet, but their likelihood and magnitude have changed. If we focus on the three critical concerns of risk management -- the frequency of claims, severity of loss and cost of resolution -- we can identify at least five ways Internet technologies affect the management of liability risks and exposures:

Rise in the number of claims. New portals and falling PC prices have increased Internet access globally. Studies say the number of Internet users doubles every 100 days.

Upsurge in the severity of claims. The growing dependence of global business on Internet applications multiplies the risk of severe claims in relation to the potential revenue stream of critical business systems.

Increases in the number of defendants. Internet technologies support the economies of outsourcing critical business functions and product components. Plaintiffs can pursue more defendants with significant or peripheral involvement in the alleged torts.

Increases in the complexity of "traditional claims" and procedural issues. Claims become more complex because the parties may assert aspects of Internet technology that make the case more difficult factually or legally. Venue also is hard to resolve, Should the case be tried where the server is located, where the customer is located, etc.? Internet technology cases are expensive to litigate and create uncertainty regarding potential resolution by judges and juries.

New claims and remedies. Internet technologies create new categories of potential defendants (such as online access providers) and beg new questions of duty and proximate cause. New remedies issues also will arise pertaining to the recovery of consequential damages and punitive damages.

Audit Vulnerability

A vulnerability analysis involves finding and documenting the exposure to identified perils or threats. Some perils require experts in network business continuity or security to evaluate policies, procedures, monitoring and enforcement. Security itself involves policies, people and technology working together. Security audits also involve electronic scanning and full-blown systems penetration testing (also called ethical hacking). The latter finds "open windows" and vulnerabilities and recommends ways to address them.

One tendency is to hire outside consultants to advise on this or that issue -- firewalls, use of public key infrastructure and others. These studies should be part of an enterprise-wide assessment of the use of and dependence on Internet technologies, Organizations should be able to lower overall vulnerabilities, institutionalize replicable best practices and audit their approaches. New applications, business models and acquisitions are part of the territory; external testing provides only a snapshot of a moment in Internet time.

Risk Management Analysis

One consulting service many businesses want is risk identification and mapping by frequency and severity. Threats with the most potential impact on profitability and reputation need to be tracked. These initiatives must weigh Internet or network activities and associated critical information assets, such as a trade secret, source code for a software product or strategic marketing or customer information. The results will yield a more efficient use of resources for adopting risk control and risk mitigation strategies.

We need best practices in legal approaches to prevent or allay the risks of intellectual property infringement or to enforce the company's intellectual property rights. Dealing with complex Internet technology risks often calls for a cross-enterprise risk committee with representatives from legal, IT/IS, marketing, the e-commerce director's office and risk management. The barriers are the silos between treasury/finance and technology in many organizations and the misperception that technology alone will fix problems.

These risks need to be managed as business risks, as they'll appear as risk factors on financial statements and will be the center of legal or regulatory action, Attacks, crimes and loss-of-web disruptions increasingly cause fallout with customers and investors.

Other challenges relate to outsourcing. In analyzing the perils of web disruptions, the critical point of failure may be communications or hosts. Outsourcing doesn't transfer liabilities, as companies have learned on reading customer service agreements and vendor contracts. Users of Internet technology also may have deeper financial pockets than the creators and enablers.

Decision-making

Decision-making is an ongoing process that involves best risk-management practices. Analysis will change with new technologies, new forms of attacks to a company or industry, new applications, regulatory and legal modifications and changes in corporate structure and direction. The key is to continue the process given these changes -- and, of course, continual testing and assessment.

Certainly, one decision is whether to retain or transfer none, some or most of the risks associated with Internet technologies. New insurance products address some of these areas. For large enterprises, manuscripted catastrophic coverage for operational risk may be an attractive alternative.

Also consider whether to staff the infrastructure to manage security internally or to outsource all or part of this function. Development of a robust audit program may require a decision on whether and how to use internal staff or external consultants. New customer-directed web sites may require a more extensive risk review process, the specifics of which need to be developed and approved. Decision-making may also result in changes in legal strategies related to intellectual property or privacy.

Most of these decisions will involve senior management or board signoff, as these issues may require significant expenditures or strategic business judgments.

Emily Q. Freeman is practice leader for e-business risk solutions at Marsh & McLennan. She can be reached at [e-mail].

                       Identification of Cyber Risks
Direct Risks               Threat to enterprise's own operations or assets.
Computer fraud             Wrongful taking of tangible assets and
                           intangible assets by employees or non-employees.
                           Includes trade fraud, credit-card fraud,
                           financial fraud.
Theft of electronic        Wrongful taking of software code, supplier
information or             information, confidential or proprietary
information assets         information, including intellectual property,
                           source code, customer data, electronic data as a
                           result of unauthorized access or unauthorized
                           use of computer networks.
Theft of computer          Using computing or telecommunications resources
system resources           for other than official, approved business
                           purposes.
Threats/extortion          Threat to commit a computer crime or to use
                           information gained from a computer crime for
                           money, personal gain or to embarrass the
                           company.
Malicious acts (attacks)   Modification or damage for nuisance, sabotage,
                           revenge, political or social motivation, pranks
                           or entertainment.
Disclosure of electronic   Disclosure of proprietary or confidential
information and electronic information stored in an electronic form as a
information assets         result of a computer crime, malicious act or
                           mistake by authorized IT/IS personnel in the
                           normal performance of their jobs.
Electronic information     Damage to computer programs and electronic data
and programs (human error) by a mistake by authorized IT/IS personnel in
                           the normal performance of their jobs.
Mechanical breakdown       Electrical or mechanical breakdown that damages
                           equipment, programs or data; possible network
                           disruption.
Physical loss              Damage to equipment, media and data due to
                           physical peril (fire, water damage, vandalism,
                           etc.). Catastrophies (earthquake, windstorm,
                           flood).
Harmful Code               Implantation, introduction and spread of
                           viruses, logic bombs, Trojan horses, other
                           malicious code.
Denial of service          Attack causes a degradation of performance or
                           loss of service to a web site or network
                           application.
Loss of service            Outage, crash, degradation of performance from
                           an error by authorized personnel in the normal
                           performance of their jobs.
Loss of connectivity       Physical perils (such as hurricane, fire),
(service interruption)     attacks, accidents and malfunctioning of network
                           communications infrastructure, including
                           satellites, telephone lines, cable, electrical
                           lines and fiber-optic cable.
Dependent businesses       All of the perils above can occur to a critical
                           supplier, vendor (e.g., web-hosting service) or
                           customer, resulting in loss of connectivity,
                           loss of revenue and extra expense.
Liability Risks            Third-party claims, lawsuits and regulatory
                           action.
Errors and omissions       Financial harm to third parties without bodily
                           injury or tangible property damage. Exposure
                           depends on role and level of involvement and
                           scope and nature of the contractual
                           relationship. Likely plaintiffs: consumers,
                           business partners, customers, vendors,
                           e-merchants, financial institutions. Likely
                           exposures: service outages and interruptions;
                           faulty technical support; insufficient security
                           measures to protect third-party data or code.
Liability Risks           Third-party claims, lawsuits and regulatory
                          action.
Intelleclual property     Patent infringement (especially software and
infringement              business process patents); copyright
(direct and contributory) infringement (e.g., plagiarism and framing);
                          trademark infringement, including trade dress
                          (e.g., use of domain names, cyber squatting,
                          meta tags); missappropriation of trade secrets
                          (i.e., research and marketing studies,
                          processes, customer lists, undisclosed new
                          product or service offerings, etc.).
Content and               Defamation, especially online commentary
advertising-related       and discussion, including employee statements
offenses                  made over the Internet about third parties.
                          Trade libel and product disparagement.
                          Pornography, obscenity, hate sites. Testimonials
                          or endorsements. Invasion of privacy; cyber
                          stalking. Misappropriation of publicity rights
                          or ideas under implied contract. Unfair
                          competition (comparative claims, talse or
                          deceptive advertising, trademark dilution,
                          etc.). Editorial errors and omissions (i.e.,
                          hermful imitation, reckless inducement).
Privacy                   Using information that identifies a person or
                          entity for a purpose that wasn't intended and
                          for which permission wasn't received. There are
                          major differences in privacy regulations
                          throughout the world (the most serious of which
                          is the European Data Directive vs. U.S. privacy
                          regulations) and specific state privacy
                          protection laws (e.g., Virginia Privacy
                          Protection Act). Also refer to the Child Online
                          Privacy Protection Act of 1998. Inadequate
                          privacy policy on web site. Failure to disclose
                          what information is being collected or what use
                          will be made of it, failure to allow the
                          consumer a way to view and modify that
                          information. Unauthorized release of
                          confidential data (i.e., financial, medical,
                          etc.) and failure to let the consumer opt out of
                          the use of private information. Violation of a
                          stated privacy policy may result in regulatory
                          action or litigation.
Other e-commerce-         Authentication (validity of a transmission,
specific risks            message, or originator Non-repudiation (a
                          cryptographic service that legally prevents the
                          originator of a message or purchase from denying
                          authoriship or denying the transaction at a
                          later date). A legitimate customer denies
                          responsibility for a transaction. Merchndise
                          misrepresentation and fulfillment. Regulatory
                          violations (e.g., of the Uniform Commercial
                          Code). Breach of/enforceability of clip-wrap
                          agreements. Enforceability of disclaimers.
                          Product liability. Warranties and
                          contractual guarantees.
Corporate e-mail          Type of information and content contained in
                          e-mails; will be discoverable in litigation from
                          third parties and employees, Failure of security
                          (e.g., passwords and encryption) may result in
                          disclosure of proprietary information (possible
                          industrial espionage) or public embarrassment.
                          Unauthorized access to stored e-mail E-mail
                          harassment, pornography, threats to innocent
                          Internet users.

Let's Play Jeopardy!

CATEGORY: Representative questions pursued in risk management analyses.

ANSWERS:

* How much would it cost to minimize the risk posed by the vulnerability? Are the costs commensurate with the activity's or assets importance?

* What's the critical recovery window to restore connectivity after an outage or disruption? How does it vary by application, time of day or season? Can this window be correlated in financial terms to a time interval? You'll need an in-depth evaluation to define the most critical business processes, functions, applications, tech nologies and resources. That includes calculating the actual cost of an outage by the hour, day and week to determine the acceptable application recovery window for critical distributed applications. It also defines the maximum outage a business process can sustain before a company's well-being is affected; the financial and non-financial impacts of an extended IT outage; and recovery strategies and alternatives, balancing recovery cost with acceptable risks.

* How secure and how redundant are the services critical vendors provide?

* How effective is the incident planning and security response capability? How can contingency or emergency response be improved?

* What risk mitigation or risk recovery solutions should you use, given the recovery window and its financial consequences? How can business continuity costs be justified to senior management?

* How do current risk transfer strategies (principally insurance) address these risks? What gaps or limitations exist in the current insurance program? What's the best/worst/anticipated financial loss?