Analysing cloud services vital when measuring cyber risk: CyberCube

Underwriters are set to increasingly name specific cloud and service providers on their policies by scheduling, or endorsing them into policy language, according to a  CyberCube report on cyber threats to supply chains.

The report, titled Building Blocks of a Catastrophe Scenario, noted the importance of understanding cloud services in assessing systemic cyber risk. Insureds will require more information about these offerings as more business is hosted in the cloud, it argued.

This may lead to insurance carriers scheduling specific cloud providers, such as Google, Amazon and Microsoft, on their policies more often, the report noted.

The report advised insurers to focus on the extent to which insureds are dependent on a single or small subset of suppliers when assessing their portfolios for catastrophic cyber risk.

Failure of one of these hyperconnected services – called Single Point of Failure entities (SPoFs) – would result in cascading impacts on many organisations, including re/insurance carriers using their services, the report explained. Amazon, Google and Microsoft Azure have all experienced significant service outages affecting businesses worldwide in recent months.

The report noted that supply chain cyber attacks are attractive to cyber criminals from a cost-benefit perspective. The growing integration of new internet of things devices and the blending of personal, public and workplace networks due to the global economic lockdown is driving even greater exposure to supply chain cyber risk for businesses, it said.

Charlotte Anderson, senior cyber risk analyst at CyberCube, and author of the report, said: “Cloud providers can act as SPoFs in the event of an incident that causes an outage impacting many related services with large user bases. Increasingly, underwriters will need to take these dependencies into account when underwriting cyber cover.”

Did you get value from this story?  Sign up to our free daily newsletters and get stories like this sent straight to your inbox.