The recent future risks report from AXA revealed that concerns regarding cybersecurity have creeped up the list on a yearly basis, finally reaching a peak with second this year. While climate change has earned the top spot as fears over underinsurance and insurer retreats continue to unravel, there is a legitimate argument any cyber expert can make that the threats of cyberattacks deserve to be very closely monitored, especially as industries continue to adopt more digitally complex systems.
This sentiment rings especially true in Asia, a region that has grown to become “low-hanging fruit” for threat actors as other regions ramp up their cybersecurity. In conversation with Insurance Business Asia, Akamai director of security technology and strategy Reuben Koh (pictured above) says that the current landscape has forced upon a harsh truth for businesses: breaches are no longer a matter of “if” but “when,” leading to cyber insurance becoming more common now than it was five years ago.
“In Singapore, after banking customers were found to have lost millions to scammers, the Monetary Authority of Singapore (MAS) and the Infocomm Media Development Authority recently proposed a new framework,” Koh said. “This could make financial institutions bear the full losses incurred by victims of digitally enabled phishing scams if the institutions have breached anti-scam obligations.”
“As such, many organisations are including cyber insurance in their overall cybersecurity strategy to keep financial losses to a minimum, so the business can continue to operate with financial protection and risk mitigation in the event of a cyber incident,” he said.
With so many carriers and policies competing in the market, Koh said that industries need to be thoroughly informed of what their needs are in order to get the best coverage possible. While cyber pricing finally saw a decline globally, the first since 2018, Koh said that there is still a need for businesses to review and update their coverages to ensure that it remains effective in the face of evolving threats.
“While insurance is beneficial, it is not an excuse to become complacent and passive. Cyber insurance should instead become a key consideration as part of a robust cybersecurity strategy. This can in turn encourage organisations to adopt a stronger and more holistic approach in addressing cyber risks, where they now have more tools and levers that can include both technological and financial protection, to better protect the business from breaches,” he said.
With accelerating digital transformation across businesses in Asia comes rapid innovation and better results. However, Koh said that this speed and efficiency sometimes comes at the cost of security, leaving gaps where threat groups can sneak in.
“As such, today, we are seeing three major categories of threat groups that drive cyber attacks globally,” Koh said. The first are nation-state actors, who are typically well-funded and highly trained. They attack targets for geopolitical rivalry, and the outcome could range from cyber espionage to critical infrastructure disruption, among others.”
“Then there are the hacktivists, who are motivated by beliefs such as political and religious. Their tools of the trade range from website defacement to denial of service (DDoS) attacks to disrupt and cause chaos to targets. Finally, there are the cybercrime groups, who are primarily motivated by financial gain, and are normally behind ransomware and data theft,” he said.
Another important thing to note about these groups is how escalating cyberattacks have caused the line between all three to blur. Koh says that sometimes, hacktivists align themselves with nation-state actors, while other times nation-state actors employ tactics used by cybercrime groups for financial gains.
Besides threat actors, digital initiatives have also spurred on criminal activity, including services such as open banking, the embedded finance market, and baking as a service. They all share a commonality in that all of them are dependent on application programming interface (API), and this leads to being exploited by threat actors through increasingly sophisticated attacks.
“Akamai’s latest State of the Internet report found that APJ is the second-most targeted region in the world for malicious bot requests against financial services, accounting for 39.7% of all malicious bot requests worldwide. In APJ specifically, Australia, Singapore, and Japan are the top three target areas for web application and API attacks in the financial services vertical — together accounting for more than three-quarters of these types of attacks,” Koh said.
Less than two months from the end of the year, and based on the growth trajectory seen thus far, Koh agreed with the sentiment that cyberattacks will continue to worsen as we enter 2024.
“Having spoken to many organisations, they are now starting to adjust to the new normal, where specific threats like ransomware are going to be prevalent as the common malware and implement the appropriate measures to defend against them. Because these threats will continue to evolve, we might have to re-learn everything we already know about them,” he said.
Generative AI is also proving itself to be a double-edged sword. As its adoption continues to skyrocket, Koh believes that the rise of AI abuse will also surge in tandem, with threat actors creating bots and programs that will continually evolve to mimic human actions and make them more discreet.
“Organisations need to focus on quickly getting a handle on their risk exposure by establishing complete and real-time visibility across all technological assets, and the people who need to access those assets. Businesses move at an extremely rapid pace, so it is easy to lose visibility while the business is moving faster than security can catch up. We need to ensure that security is not left behind or becomes an afterthought as businesses charge forward on innovating or digitising,” he said.
What are your thoughts on this story? Please feel free to share your comments below.
