An Investigation of Cyber Loss Data and Its Links to Operational Risk

26 Pages Posted: 26 Sep 2019

Date Written: September 25, 2019

Abstract

Cyber risk is one of the most challenging areas of risk, not only because it is relatively nascent but also because it remains an elusive moving target due to an ever-evolving threat landscape. A lack of structured data and the systemic implications of multifaceted impacts of overlapping risk frameworks are additional factors that make this risk difficult to quantify. As a starting point for overcoming this challenge, our paper considers a potential definition of this risk type, encompassing confidentiality, integrity and availability; the key components of a cyber-risk framework; a taxonomy to help establish a common framework for data collection to aid quantification; and the key quantification challenges. It then focuses on quantifying the direct financial and compensatory losses emanating from cyber risks. To help us carry this out, dimensional analysis is incorporated in the same manner as it has been applied to operational losses; this enables the identification of any similarities and/ or gross deviations between the profiles of cyber and non-cyber operational losses. In all, considering the limited amount of cyber data available, this analysis shows that:

(1) a taxonomy for cyber risk that maps directly to operational risk might be a worthwhile exercise;

(2) cyber loss data has a fundamental risk profile similar to that of non-cyber operational risk losses, with both following the same trend; and

(3) the underlying risk profile related to cyber losses has not changed materially over time.

These findings come with the added implications that:

(1) mapping the taxonomies of cyber and operational risk against each other could be conducted more objectively;

(2) operational risk modeling techniques that have been developed over the past decade or so could be used in the same way to assess the direct financial impact of cyber risk as a starting point; and

(3) although there has been an increase in both the frequency and the severity of cyber losses over the past few years, there has not been a major paradigm shift in their fundamental risk profile over the same period of time.

Keywords: operational resilience, nonfinancial risk, dimensional analysis, risk taxonomy, loss data, scenario analysis

Suggested Citation

Cohen, Ruben D. and Humphries, Jonathan and Veau, Sabrina and Francis, Roger, An Investigation of Cyber Loss Data and Its Links to Operational Risk (September 25, 2019). Journal of Operational Risk, Vol. 14, No. 3, 2019. Available at SSRN: https://ssrn.com/abstract=3459457

Ruben D. Cohen (Contact Author)

AON PLC ( email )

London
United Kingdom

Jonathan Humphries

AON PLC ( email )

London
United Kingdom

Sabrina Veau

AON PLC ( email )

London
United Kingdom

Roger Francis

AON PLC ( email )

London
United Kingdom

Here is the Coronavirus
related research on SSRN

Paper statistics

Downloads
2
Abstract Views
186
PlumX Metrics