Businesses need to prepare for cyber attack: Zurich head

WINNIPEG – Defending against a cyber attack is very difficult and companies need to come up with a plan as to how to handle such an attack, suggests Zurich Insurance Group Ltd.’s chief executive officer of general insurance, Michael Kerner.

“Companies need to be doing a lot of work to make sure that they have the best security in place possible in order to prevent” attacks on their information technology assets, Kerner said Sunday in an interview with Canadian Underwriter.

The increased exposure, he added, comes with the growth of the Internet and the growth in connectivity.

“The reality is, you really can’t build the walls high enough,” Kerner added. “It’s very challenging to have a good strong foolproof defence on cyber, because essentially when you are on the defence side of the cyber issue, you have to defend every single weakness, every single portal 24 hours a day, seven days a week.”

On the other hand, Kerner added, “if you are trying to be on the offensive and trying to get in, you just need to find one weakness in one portal once and you are able to get in. So we think it is very important for our corporate customers to be prepared for a cyber event.”

Kerner made his remarks in downtown Winnipeg on the first day of the 40th annual RIMS Canada Conference.

Michael Kerner, CEO General Insurance discusses risk management & the My Zurich portal with @CdnUnderwriter pic.twitter.com/axabBGNCNy

— Zurich Canada (@zurichcanada) September 14, 2014

Kerner elaborated on how corporate risk managers should prepare for a cyber attack.

“They need to be very clear as to how they are going to handle communications, their public relations and how they are going to interact with their customers during the course of those kinds of events, so they need to have a plan and everybody needs to understand it,” he said.

He suggested that companies’ exposure to cyber risk stems partly from their dealings with outside organizations.

“It’s not just a matter of being secure within the four walls of the organization, because a lot of the cyber exposures that you look at come from outside of a company,” he said. “They come from supply chains, they come from other vendors and those create exposure for a company.”

In addition to cyber risk, Kerner shared his views on flood and alternative sources of capital.

“The ability of capital markets to step into the catastrophe space allows us to serve our customers better,” Kerner said of catastrophe bonds and alternative sources of capital for reinsurance programs.

“Especially in an environment where you see climate change, where you see the risk of bigger events, you see increased concentration of risk in urbanization and various trends like that,” Kerner said.“The ability of the insurance industry and the capital markets to provide society with a backstop on relatively large catastrophe events is pretty critical … if we were to think back decades ago, if you were to have a $100-billion cat event, you would have had a lot of insolvent insurance companies.

“These days, I think if you have a $100-billion cat event, the industry can respond reasonably well to that, claims will get paid, buildings will get rebuilt, customers will have their insurance respond and you will have very few issues around solvency and companies not being able to keep their promises.”

As for flood catastrophes, Kerner suggests more money needs to be put into projects that prevent overland flooding from causing property damage.

“You can provide the insurance coverage, but frankly the better thing to do is to provide insight and opportunities for communities to become more resilient to flood issues,” he said, suggesting that “about 85 cents of the dollar is spent on post-event cleanup and rebuilding and only about 15 cents on the dollar is spent on pre-event resiliency and flood protection.”

That figure is not a Canadian number, but a “more general number” based on a study Zurich had done, Kerner noted.

He added a larger proportion of spending should go on “pre-event resilience and mitigation,” such as levees and putting buildings on higher ground or on stilts.