Soaring cybercrime calls for cyber insurance

The recent hacking of twitter accounts of high profile government institutions in Kenya brings to mind the significant changes in the level of sophistication of cyber-security threats since 1986 when the first known case of a computer virus was reported. A few years ago, the development and dissemination of malware (viruses, worms, and Trojans) was essentially to demonstrate the technical skills of information technology (IT) professionals. But today, we are dealing with a new form of organised cybercrime aimed at financial gains, with an expansion of the types of threats to various platforms and to various countries. Spam has evolved to become a vehicle for delivering more dangerous payloads, such as viruses, worms and Trojans that currently are a means for online financial fraud, identity or trade-secret theft as well as various other forms of cyber-crimes. When threats to critical infrastructures such as energy, health, transportation, finance, telecommunication, defence and other sectors are taken into account, it is obvious that the situation is likely to get worse. One of the emerging and rather dangerous trends is the shift in strategy by hackers from the central command-and-control model for controlling botnets to a peer-to-peer model. The latter has a distributed command structure capable of spreading to computers located in different countries. This makes it very difficult to pinpoint one geographical location as the origin of these attacks. Consequently, it makes it difficult to identify them and shut them down. This shift strategy can also be used to disseminate inappropriate content, such as child pornography without the knowledge of the hijacked computer owners that they are hosting and disseminating such content. The incredible benefits that information technology has brought modern organizations have not come without risks. These risks vary in size and scope, from revealing new vulnerabilities in our critical infrastructures to enabling new forms of fraud. Cybercrime revenues are estimated to be approximately 2 per cent of the global economy, larger than the entire global turn-over of the pharmaceutical industry. Estimates put credit card fraud at US$37 billion annually. This estimation places the credit fraud rate at 1.1 percent of the US$3.34 trillion in credit card transactions in 2009. Cyber crooks attack banks and bank-like services, as well as identity platforms, because “that’s where the money is.” Cybercrime is distributed broadly across the economy, since it targets those components on which much of the digital economy rests: payments and identity. Hence the insurance companies in the region have to commence working on cyber-security insurance. A robust market for cyber-insurance would offer several key benefits to society, foremost, a strong incentive to individuals and organizations to take appropriate precautions. Insurance companies could reward security investment by lowering premiums for less risky actors. Because insurance companies base their competitive advantage on risk-adjusted premium differentiation, they have an incentive to collect data on security incidents where claims are made. This makes it inevitable for countries to develop insurance systems which will provide benefits to their citizens, financial sector and opportunities to the insurance sector. The Common Market for East and Southern Africa (COMESA), the Association of Regulators for Information and Communications in Eastern and Southern Africa (ARICEA) and the International Telecommunication Union (ITU), have already conducted a study on Public Key Infrastructure Protection. The objective is to come up with frameworks for cyber-security and Critical Information Infrastructure Protection (CIIP). It is also intended to share best practices adopted internationally on similar CIIP efforts and promote a culture of cyber-security besides assessing measures taken in COMESA Member States on IT Security. In implementing the programme, COMESA and ARICEA, will involve the judiciary system as one of the main stakeholders in order to enforce legislations and regulation. This will require training of both the police and judiciary in collaboration with other regional economic communities. Strategies concerning implementation of cybercrime programme will be developed with involvement of the public sectors, private sector and financial institutions Development partners’ regional and international organizations to address cybercrime. In addition the COMESA, EAC and SADC Tripartite need to have a regional Computer Incident Response Team (CIRT) and Public Key Information (PKI) centres. These will enable the exchange of information, experience, evidence, registration, certifications as well as enhance awareness and foster the systems. A regional approach is recommended as a means of effectively the combating the scourge of cyber-crime. The author is the Secretary General of the Common Market for Eastern and Southern Africa (COMESA)