“We need preventive measures to prevent cyber crises”

After lead­ing the Foresight team for more than 5 years, Cécile Wend­ling is now Head of Secur­ity Strategy, Anti­cip­a­tion of Threats and Research, for the AXA group. With a back­ground in Human­it­ies and Social Sci­ences, she par­ti­cip­ates in many advis­ory bod­ies in vari­ous fields such as the pro­tec­tion of per­son­al data, arti­fi­cial intel­li­gence or cybersecurity. 

Do you think a cyber­pan­dem­ic is possible? 

Cécile Wend­ling. Yes, it is quite pos­sible. A major cyber-event could have a glob­al eco­nom­ic­al and phys­ic­al impact in the real world, as did the Cov­id-19 pan­dem­ic. That being said, we all need to get on the same page because at present when we speak of a cyber-event we mix dif­fer­ent types of events and attack­ers. We must dis­tin­guish between tar­geted and inten­tion­al attacks from unin­ten­tion­al ones, like a serv­er crash or a storm! In the same way, attacks can be due to isol­ated indi­vidu­als, organ­ised crime, ideo­lo­gic­al groups or for­eign states.

An insur­ance com­pany must under­stand the real risk to offer the appro­pri­ate insur­ance cov­er. Hence the import­ance of defin­ing a com­mon lan­guage, a ter­min­o­logy which can class events into dif­fer­ent cat­egor­ies, com­pare threats, and their evol­u­tion over time in order to have a his­tor­ic­al view.

Would this aid the devel­op­ment of cyber-insurance? 

Yes, but it depends upon clas­si­fic­a­tion and inform­a­tion of cyber risks, to determ­ine which part is covered by the insur­ance. The real issue here is risk edu­ca­tion and pre­ven­tion. If we con­tin­ue the ana­logy with the Cov­id-19 pan­dem­ic, we see that we taught people san­it­ary rules, basic ges­tures to pro­tect them from the coronavir­us and pre­vent its spread. Cyber­se­cur­ity is still a fairly secret field. Only a few people know inform­a­tion on attacks led against com­pan­ies, it is not very vis­ible to the gen­er­al pub­lic. Unin­formed people can­not take pre­vent­ive action on their con­nec­ted devices because they do not know “basic hygiene”, what actions they must use to pro­tect them­selves, like for example, mak­ing reg­u­lar backups. Thus, if they are unaware of the risks, they can­not insure them­selves against them.

Reg­u­lat­ory and leg­al decisions would be required to insure these cyber risks, as in the case of motor vehicles: to drive, it is man­dat­ory to insure the vehicle against dam­age poten­tially caused to third parties. In the case of a cyber­pan­dem­ic, we would also need to con­sider the mutu­al­isa­tion of risk and cre­ate a pub­lic-private pool, as is the case for major nat­ur­al dis­asters or for the Cov­id-19 pan­dem­ic. In con­crete terms, in the case of a crisis, we would need to cre­ate a pro­tec­tion con­tinuum cov­er­ing edu­ca­tion, pre­ven­tion and tech­nic­al assistance.

How can we anti­cip­ate the risk of a cyberpandemic? 

It is very dif­fi­cult, because, as in the case of the health crisis, a cyber­pan­dem­ic would res­ult in mul­tiple risks. In fact, it would inter­con­nect crises and there­fore risks. To anti­cip­ate such an event, it is neces­sary to under­stand mul­tiple-haz­ard scen­ari­os. In Leban­on for instance, an eco­nom­ic crisis, the Cov­id-19 pan­dem­ic and the explo­sion in the Beyrouth har­bour occurred simultaneously.

Anti­cip­at­ing a threat raises the ques­tion of its tem­por­al­ity and its pos­sible evol­u­tion over time. We can­not have a stable scen­ario in time, we need to update it reg­u­larly. To be resi­li­ent, we must con­tin­ue to anti­cip­ate by fore­cast­ing over the longer term. 

As a mat­ter of fact, anti­cip­a­tion is based on two dif­fer­ent types of exer­cises. On one hand, a con­trol tower per­forms pro­spect­ive sur­veil­lance on a daily basis on many sub­jects, for example, the role a quantum com­puter could play in the case of a cyber­at­tack. On the oth­er hand, on a prac­tic­al level, we anti­cip­ate stress scen­ari­os. For example, how can a cyber­at­tack be man­aged in lock down, did we anti­cip­ate the fact that we would need to work with pen and paper?

Anti­cip­a­tion rests on dif­fer­ent cells and tem­por­al­it­ies. To put it simply, we need “geeks” to per­form threat intel­li­gence at a two-month hori­zon and actu­ar­ies who will eval­u­ate the risk in the long run. The chal­lenge lies in con­nect­ing these two worlds with dif­fer­ent time scales and find­ing a middle ground.