Christoph Kufner and Rupert Flatscher

Internet risks: The real threat from the cyberworld

Almost no company can get by these days without the internet.Repelling the dangers posed by hackers and viruses not only demands a high degree of creativity and imagination on the part of IT departments.Insurers are also faced with a new set of risks that need to be controlled.

Global networking of IT systems is a fundamental component of today's modern business world. The world wide web is not only a modern sales and distribution channel but in many cases also serves as a highly efficient tool in the supply chain. The demands placed on companies by the principle of just-in-time production in many sectors of industry and the resulting use of the internet mean that stocks in storage can be kept to a minimum these days.

Advances in electronic media have resulted in new challenges for the insurance industry. The complex world of local networks connected via a small number of hubs is highly vulnerable to disruption and outages which can result in serious damage to computer systems and data. The main perils are hacker attacks or the blocking of websites through so-called denial of service attacks. Such DOS attacks flood a company's servers with enquiries over the internet and thus cause the system to collapse.

Unintentional disruptions such as the breakdown of external networks or of internet providers can also have serious consequences for many branches of industry. Business can even come to a complete standstill in extreme cases, such as in the field of online trading or banking.

next page »

Concepts of cover and exclusions for internet and e-commerce risks

It is vital that reinsurers develop concepts of cover and exclusions for internet and e-commerce risks, as they generate a completely new hazard potential. IT risks must undergo particular risk assessment and place special demands on underwriters as such concepts of cover clearly go far beyond the traditional lines of property, liability and commercial guarantee insurance.

Munich Re has been investigating this subject area for a number of years and has set up its own Centre of Competence for IT Risks (CoC IT risks). The principal task of this centre of competence is to build up and document the know-how needed to evaluate the loss potentials involved.

A more long-term objective is to develop the necessary risk-assessment standards for underwriting. In addition, various working groups analyse current issues concerning IT risks in order to provide our clients with extensive and competent advice on this topic.

The accumulation risk in first-party insurance

The spread of computer viruses and the failure of external networks pose a particular accumulation problem in the area of first-party losses, as these not only affect a single insured but invariably concern an insurer's entire portfolio. As cyber viruses are not subject to the laws of nature, traditional accumulation scenarios for natural hazards such as windstorm or earthquake cannot be applied to IT risks.

A further problem for insurers is that the frequency of possible loss events is also not subject to the law of averages. They are "man-made" and as such not possible to calculate or predict. Unlike their biological counterparts, cyber viruses are not transmitted from person to person but they can infect many computers at once from a single hub (server).

They are not bound by geographical limits and within just a few hours can spread across IT systems throughout the world via attached e-mail files. The whole world thus becomes a loss accumulation zone.

« previous page