Modern Insurance Magazine Issue 65

Q
Ken - what’s the appeal for hackers when it comes to planes,
trains, ships and cars? Surely banks and large corporations are
more lucrative?
They are and they aren’t! Banks and large corporations know
they’re more lucrative, so they’ve invested heavily in making sure
Athat they have the most suitable defences in place. Hackers will
always follow the money. We can’t think of them as kids in hoodies sat at a
PC in the basement anymore; many ransomware operators are organised
businesses, and operate as a serious threat. Some hacking groups have
even got HR departments.
Banks aren’t easy targets because they’ve spent so much money
on stringent cybersecurity measures to combat this. Therefore,
cybercriminals need to look at other resources further afield, and this
is where we see the maritime industry being affected. For example,
refuelling ships has been a really easy source of funds for cybercriminals
in the recent past. If you can redirect a refuelling payment through invoice
fraud and phishing emails, that’s potentially a huge lump sum being
intercepted.
The same goes for cars. Modern cars are increasingly connected, and
many have now got payment systems in place which can unlock access
to additional features. If money exchanges hands, it’s a potential source of
income for hackers and other cybercriminals. Ransomware has even been
developed for car systems, though fortunately it’s just proof of concept at
the moment, rather than an immediate and pressing threat.
Q
As a fan of electric vehicles (EVs), what cybersecurity
vulnerabilities do you feel are most in need of addressing as a
matter of urgency?
EVs themselves aren’t a concern so much as the charging
infrastructure that supports them. We’ve already seen hacks
A against EV chargers; there was a case in the Isle of Wight where
an EV charger was hacked to display pornography, and another case in
Russia where chargers were compromised and stopped from working
altogether.
Pen Test Partners completed a large project on domestic EV chargers
recently, finding major security flaws in most of them. Of course, if an EV
charger is compromised or out of use because it’s been hacked, that’s
a huge problem for drivers. In addition, this does nothing to reassure
prospective EV owners who are concerned about the range of an EV;
those who rightfully want to know that they could access an EV charger
without hassle whenever they need one. Broken charging infrastructure is
enough of a problem as it is, and a bunch of hackers further destabilising
EV uptake is the last thing we need when it comes to making that switch.
Q
A
Some insurance companies wish to fit trackers in vehicles in
order to lower premiums. Is this counterproductive given the
flaws that trackers can have, and the opportunity it provides
to hackers?
In a way, yes. Fortunately, since finding and reporting those flaws,
they have now been fixed. However, these vulnerabilities should
not have been there in the first place.
I really hope that affected manufacturers have taken some time to
reassess and up their game in this regard. Selling a security product
for a vehicle without first addressing a significant number of security
vulnerabilities is really unacceptable, and I’d like to see more evidence of
manufacturers taking their role as security providers more seriously.
I’d also like to see a more robust approach to security throughout the
industry in general. Insurers will often rely on certification bodies to be
certain that a product improves the security of a vehicle. Sadly, some
of these bodies have accredited products that made the security of the
vehicle worse! This cannot be allowed to continue.
Are we at a point where standard home and vehicle insurance
policies should be inclusive of cyber cover, given the rise of the
Q Internet of Things (IoT) and the hyperconnected world we now
live in?
A
As things stand right now, any underwriter would be crazy to do
this! There’s not enough data in place at the moment and not
enough research being done in this space for an underwriter to
accurately quantify the risk. Nothing could go wrong for years, and then
an entire brand or fleet of vehicles could fall victim to a cyber-attack. This
would leave one insurer on the hook for a very big cyber claim, so whilst
I’d love to see more cyber cover embedded into other lines of insurance, I
think that the risk would be way too high right now. Not enough research,
and not enough data!
“There are many competing interests, each
with different motivations, and then there
are a bunch of researchers in the middle
trying to shine a light on poor behaviour -
all in the hope that catastrophic hacks can
be evidenced fast enough before hackers catch
on and start exploiting it”
Do you think the number of successful catastrophic hacks will
increase in the coming months and years? Or is technology and
Q security managing to evolve at a fast enough rate to keep them
at bay?
A
Yes. It’s an arms race against the hackers. Organisations are trying
to improve their cybersecurity quickly, and manufacturers are
trying to improve their product security quickly in order to avoid
an eventuality where security vulnerabilities bring down an entire fleet of
vehicles, or an entire company’s data. There are many competing interests,
each with different motivations, and then there are a bunch of researchers
in the middle trying to shine a light on poor behaviour - all in the hope that
catastrophic hacks can be evidenced fast enough before hackers catch on
and start exploiting it.
As an ethical hacker, what is the biggest challenge for insurers
when it comes to providing cover for modern-day cyber risks?
Q
Many insurers and underwriters are really suffering from the
effects of ransomware right now. A lot of cyber insurance policies
A are priced based upon historic risk data, and the prevalence of
ransomware has accelerated so much that a lot of underwriters have been
left facing multiple sizeable claims.
As a result of these loss ratios, cyber insurance premiums are increasing
quickly, and insureds must do everything they can to demonstrate
stringent security measures when they’re looking to obtain this kind of
cover. Savvy underwriters really like to do business with companies that
are able to prove their cybersecurity strengths.
In terms of cars, the thing that worries me most is where a vulnerability
is found in a vehicle, escalating to a fleetwide hack because they’re
fundamentally all using the same systems. Hypothetically, the systemic
losses from a particular model or brand of connected vehicle all turning
left at the same time could be catastrophic. This was realised in the Jeep
hack of 2015, for instance; it can be done, and we’ve since demonstrated
similar outcomes with other brands throughout the course of
our commercial engagement work. Fortunately,
these brands continue to take security
seriously, ensuring that their vehicles are
well protected. From an underwriting
perspective in particular, however,
it’s a really difficult risk to price
against. These challenges are almost
certainly set to continue as the
cyber insurance market evolves.
Ken Munro,
Partner and Founder,
Pen Test Partners