Cambridge Centre for Risk Studies Cambridge Risk Framework Cyber Terrorism Insurance Futures 2017 CYBER TERRORISM: ASSESSMENT OF THE THREAT TO INSURANCE Cambridge Centre for Risk Studies University of Cambridge Judge Business School Trumpington Street Cambridge, CB2 1AG United Kingdom [email protected] https://www.jbs.cam.ac.uk/risk November 2017 The Cambridge Centre for Risk Studies acknowledges the generous support provided for this research by the following organisation: Sections of this public report have been redacted for reasons of security. The views contained in this report are entirely those of the research team of the Cambridge Centre for Risk Studies, and do not imply any endorsement of these views by the organisations supporting the research, or our consultants and collaborators. This report is available online at cambridgeriskframework.com/downloads Cambridge Centre for Risk Studies Website and Research Platform https://www.jbs.cam.ac.uk/risk Report citation: Evan, T.; Leverett, E.; Ruffle, S. J.; Coburn, A. W.; Bourdeau, J.; Gunaratna, R.; Ralph, D.; 2017. Cyber Terrorism: Assessment of the Threat to Insurance; Cambridge Risk Framework series; Centre for Risk Studies, University of Cambridge. Appendix 1: UK Cyber Blackout Scenario cites text and findings from the following report: Kelly, S.; Leverett, E.; Oughton, E. J.; Copic, J.; Thacker, S.; Pant, R.; Pryor, L.; Kassara, G.; Evan, T.; Ruffle, S. J.; Tuveson, M.; Coburn, A. W.; Ralph, D. & Hall, J. W.; 2016; Integrated Infrastructure: Cyber Resiliency in Society, Mapping the Consequences of an Interconnected Digital Economy; Cambridge Risk Framework series; Centre for Risk Studies, University of Cambridge. Research Project Team Cyber Terrorism Insurance Futures Project Lead Simon Ruffle, Director of Research and Innovation Tamara Evan, Research Assistant and Coordinating Editor Cyber Terrorism Insurance Futures Project Contributors Dr Andrew Coburn, Director of Advisory Board Professor Daniel Ralph, Academic Director Eireann Leverett, Senior Risk Researcher James Bourdeau, Research Assistant Cambridge Centre for Risk Studies Research Team Dr Michelle Tuveson, Executive Director Jennifer Copic, Research Associate Dr Jennifer Daffron, Research Associate Dr Edward Oughton, Research Associate Dr Andrew Skelton, Research Associate Dr Jay Chan Do Jung, Risk Researcher Dr Duncan Needham, Senior Risk Researcher Jennifer Copic, Research Assistant Arjun Mahalingam, Research Assistant Andrew Smith, Research Assistant Kayla Strong, Research Assistant Jessica Tsang, Research Assistant Consultants and Collaborators Professor Rohan Gunaratna, Head of the International Centre for Political Violence and Terrorism Research and Professor of Security Studies at the S. Rajaratnam School of International Studies, Nanyang Technological University, Singapore Nur Azlin Mohamed Yasin, Chief of Security Informatics at the International Centre for Political Violence and Terrorism, Research and Associate Research Fellow at the S. Rajaratnam School of International Studies, Nanyang Technological University, Singapore Dr Madan M. Oberoi, Director, Cyber Innovation & Outreach, INTERPOL Global Complex for Innovation Dr Gordon Woo, Catastrophist, RMS Inc. Our appreciation to Rathore Shahzeb Ali, Research Analyst, International Centre for Political Violence and Terrorism Research, Singapore, for editing the article which provided the basis of the chapter Cyber Capabilities of Terrorist Groups. Cambridge Centre for Risk Studies Cyber Terrorism: Assessment of the Threat to Insurance Report Contents Foreword 3 Introduction 4 Defining the Scenarios 7 Scenario Impact Assessments 11 Cyber Capabilities of Terrorist Groups 13 Cyber Capabilities of Daesh 23 Defence Against Cyber Terrorism 27 Insuring Cyber Terrorism 31 Key Findings 33 References 34 Appendix 1: UK Cyber Blackout Scenario 37 Appendix 2: Major ICS cyber events to 2017 39 1 Cambridge Centre for Risk Studies Foreword Dear Member, I am very pleased to write the foreword to Pool Re must be prepared for this contingency, this joint Pool Re/Cambridge Centre for and is therefore extending its coverage with Risk Studies report entitled Cyber Terrorism: effect from April 2018. We have partnered Assessment of the Threat to Insurance. This with the Cambridge Centre for Risk Studies to report marks the extension of Pool Re’s examine how the cyber terrorism threat could coverage to include cyber terrorism. develop and to generate attack scenarios which could affect vulnerable UK industry The proliferation of the Internet of Things, sectors. Big Data and Quantum Computing has created new and diverse security challenges; In the next year we will build on the work we increased networking of facilities management have done with the Centre as we develop a and industrial control systems has exposed modelling toolkit that will help us quantify the new attack vectors and made it possible loss scenarios as we develop them. to destroy both lives and property through The research has already enabled us to remote digital interference. Recent events educate and advise on the realities of cyber have demonstrated that the peril is no longer terrorism and better understand Pool Re’s hypothetical, and industries ranging from and our Members’ exposure to the threat. We aviation, retail and healthcare have all proved very much hope that this will help the market to be vulnerable. While terrorist groups have respond to the emerging risk and ultimately yet to successfully weaponize computer build greater resilience against all forms of systems, the broadening of attack surfaces cyber terrorism. and the growing technical capabilities of threat actors suggest that the arrival of a physical cyber terrorist attack is only a matter of time. Just as improvements have been made through protective security measures, such as Hostile Vehicle Measures (HVM), we now need to build resilience into our information systems and technology platforms. Julian Enoizi Chief Executive, Pool Re 3 Cambridge Centre for Risk Studies 1 Introduction Changing tactics of terrorism damage and destruction. However, concerns over the potential movement of terrorism into the cyber Terrorism – the application of politically-motivated sphere endure, and, with the broadening of attack violence to resist or influence the policies of surfaces and growing technical capabilities of threat governing regimes – has been a spectre of organised actors, the arrival of cyber terrorism seems ever more governments for millennia.1 Almost by definition, likely. terrorism is ‘asymmetrical’: the state is always more powerful than the antagonists seeking to undermine This report examines the possibility of this emergent it. In employing a technique of changing violent threat and the potential risks it poses for the UK tactics, a less well-resourced terror group can use property insurance market over the next three years, the element of surprise to achieve success against a using an analysis of the state of global terrorism and less agile state security apparatus. technological vulnerability at the close of 2017. Terror tactics have changed over time as the genus Cyber and insurance of groups perpetrating the violence and the security measures in place to prevent them has advanced The possibility of cyber crime developing the potential and evolved. As known targets are hardened and to cause physical damage is a major concern for the securitised, terrorist groups typically shift to softer, insurance industry. Property insurance and many more vulnerable targets. This praxis is shown in the other types of policies in use today were developed to changing terrorist practices of the last hundred years, protect insureds against traditional perils and causes from political assassination in the early 20th century, of loss that are understood, priced, and underwritten to plane hijacking and hostage taking by Middle on the basis of historical claims experience. If Eastern terrorist groups in 1970s, attacks on police new losses were to occur resulting from cyber and army units and mainland car bombs preceded attacks – whether perpetrated by terrorists or other by warnings by the IRA in 1990s, and a shift toward individuals – then this would add the new dimension maximising civilian casualties with suicide attacks of a nascent risk, which is difficult to measure and by jihadists in the past 15 years. Perhaps the most quantify, to pre-existing coverage. Some policy radical innovation in terror tactics in the 21st century terms and conditions now explicitly exclude cyber to date has been the weaponisation of passenger as a cause of loss, particularly as a cause of legal aircraft by al-Qaeda in 2001. liabilities and compensation for loss of privacy or data, in order to side-step this complication. There Could cyber terrorism be the next tactical shift? is a growing industry of ‘affirmative’ cyber insurance which provides corporate coverage for breaches of IT With this history of advancing tactical techniques, security but, at this time, there are only a handful of commentators have speculated on myriad futures insurance products that offer protection for physical for global terrorism, including terrorist acquisition damage or human injury resulting from cyber attacks.3 of weapons of mass destruction through to all-out economic and psychological warfare, or the repeated The potential scope of physical damage that may result use of insurgency tactics to undermine the political from a cyber attack is difficult to estimate, as most