BIS工作论文：网络风险的驱动因素

1、 BIS Working PapersNo 865The drivers of cyber riskby Iaki Aldasoro, Leonardo Gambacorta, Paolo Giudici and Thomas LeachMonetary and Economic DepartmentMay 2020JEL classification: D5, D62, D82, G2, H41.Keywords: cyber risk, cloud services, financial institutions, bitcoin, cryptocurrencies, cyber cost

2、, cyber regulation.BIS Working Papers are written by members of the Monetary and Economic Department of the Bank for International Settlements, and from time to time by other economists, and are published by the Bank. The papers are on subjects of topical interest and are technical in character. The

3、 views expressed in them are those of their authors and not necessarily the views of the BIS.This publication is available on the BIS website ().Bank for International Settlements 2020. All rights reserved. Brief excerpts may be reproduced or translated provided the source is stated.ISSN 1020-0959 (

4、print)ISSN 1682-7678 (online)The drivers of cyber riskIN AKI ALDASORO, LEONARDO GAMBACORTA, PAOLO GIUDICI and THOMAS LEACHABSTRACTCyber incidents are becoming more sophisticated and their costs difficult to quantify. Using a unique database of more than 100,000 cyber events across sectors, we docume

5、nt the characteristics of cyber in- cidents. Cyber costs are higher for larger firms and for incidents that impact several organisations simul- taneously. The financial sector is exposed to a larger number of cyber attacks but suffers lower costs, on average, thanks to proportionately greater invest

6、ment in information technology (IT) security. The use of cloud services is associated with lower costs, especially when cyber incidents are relatively small. As cloud providers become systemically important, cloud dependence is likely to increase tail risks. Crypto-related activities, which are larg

7、ely unregulated, are particularly vulnerable to cyber attacks.JEL classification: D5, D62, D82, G2, H41.Keywords: Cyber risk, cloud services, financial institutions, bitcoin, cryptocurrencies, cyber cost, cyber regulation.We thank Raymond Kleijmeer, Karin Reichardt, Andreas Voegtli, an anonymous ref

8、eree and seminar participants at the Bankof Italy, Bank for International Settlements, Central Bank of Malta, IFABS 2019, IFI European Chapter Forum, IFI Insurance Management Forum and OECD Blockchain Policy Forum 2019 for helpful comments and suggestions. We are grateful to Duane Kennedy and Theoph

9、anis Stratopoulos for sharing their data on IT spending. The views expressed here are those of the authors and do not necessarily represent those of the Bank for International Settlements.Aldasoro and Gambacorta are with the Bank for International Settlements. Giudici and Leach are with theUniversit

10、y of Pavia. B: Inaki.Aldasoro; leonardo.gambacorta; paolo.giudiciunipv.it; HYPERLINK mailto:thomas.leach01universitadipavia.it thomas.leach01universitadipavia.itIntroductionInformation technology (IT) has become a critical component of well-functioning economies, underpin- ning economic growth over

11、the past decades. Organisations of all sizes in both the public and private sector are becoming ever more interconnected and reliant on IT products and services, such as cloud-based systems and artificial intelligence. Accordingly, there is a growing exposure to cyber risks. Cyber risk commonly refe

12、rs to the risk of financial loss, disruption or reputational damage to an organisation resulting from the failure of its IT systems. These episodes include malicious cyber incidents (cyber attacks) where the threat actor intends to do harm (e.g. ransomware attacks, hacking incidents or data theft by

13、 employees). In the wake of recent high-profile cyber attacks such as the WannaCry incident in May 2017, public awareness of these threats is on the rise (see Figure 1).Notes: Number of online searches for “cyber risk” and “operational risk” over the last decade. Worldwide search interest is relativ

14、e to the highest point (=100). Data accessed on 7 Feb 2020.Source: Google Trends.Figure 1Interest on cyber risk is on par with operational risk.Firms actively manage cyber risk and invest in cyber security. However, cyber costs are difficult to quantify. In the financial sector, cyber risks are a ke

15、y “known unknown” tail risk to the system and a potential major threat to financial stability.1 More broadly, cyber risk in sectors that play a critical role in the economic infrastructure could have systemic implications and should be viewed as a matter of national security (Brenner, 2017). Despite

16、 the acknowledgement of such consequences, information concerning the costs, drivers and potential mitigating factors of cyber incidents is relatively scarce.This paper seeks to help fill this gap. The analysis uses a detailed dataset of over 100,000 cyber events across all sectors of economic activ

17、ity. We first document some stylised facts. The frequency of cyber incidents rose strongly in the decade to 2016, but has since receded somewhat. This reduction could reflect1In March 2017, the G20 Finance Ministers and Central Bank Governors noted that “the malicious use of information and communic

18、ation technologies could disrupt financial services crucial to both national and international financial systems, undermine security and confidence, and endanger financial stability”.increased investment in cyber security, but also delays in discovery or reporting.2 The average cost of cyber events

19、has been increasing constantly over the last decade. We find that certain economic sectors display a greater resilience to cyber incidents: for example, the financial sector has experienced a higher frequency of cyber incidents but these have been on average relatively less costly. Regarding the typ

20、e of incident, privacy violations and phishing/skimming scams fraud in short are the most frequent but least costly. Data breaches, in turn, are both relatively frequent and costly, while business disruptions are quite infrequent but can have high costs.The richness of the database also allows us to

21、 examine the relationship between firm, sector and event- specific characteristics and the relative cost of cyber events. The main empirical results can be summarised as follows.First, we identify the key drivers contributing to the costs of cyber-related events. Firm size measured in terms of total

22、 revenues is positively correlated with the average cost of an event, implying that larger firms tend to incur larger costs. However, the elasticity is quite low: a 1% increase in total revenues is associated with a 0.2% increase in cyber costs. We also find that that cyber events which impact multi

23、ple firms at the same time (i.e. “connected” events) are also associated with higher costs. Cyber-related incidents can occur unintentionally by human error, e.g. a bug in some internally developed software; or can also be caused by an actor with malicious intent.3 Malicious cyber attacks have, on a

24、verage, lower costs, because most incidents simply reflect general discontent. However, some actors seek a profit or to inflict the largest possible losses and damage. Indeed, a quantile analysis reveals that at the tail of the sample distribution this relationship is reversed and in fact malicious

25、incidents are associated with higher costs. This finding indicates that, while most attackers are stopped before they can do considerable harm, a successful attacker can go on to cause extensive damage. Incidents related to crypto exchanges, which are largely unregulated, produce higher losses.We th

26、en look at the role of developing technological capabilities to reduce cyber costs. Many firms, especially if they are smaller, could lack the specific knowledge needed to make rational decisions about which software or cyber security provider to choose. Information asymmetries between firms can fur

27、ther exacerbate problems when investments in new technologies do not pan out as expected (Zhu and Weyant, 2003). How can firms mitigate these risks? We find that investment in technological skills pays off in terms2This phenomena is widely recognised in the operational risk literature (see Aldasoro

28、et al. (2020); Carrivick and Cope (2013). The dataset used in this analysis did not contain sufficient information concerning the dates of events, thus an “end-of-sample” bias could not be accurately estimated.3The best known types of cyber attack are: man-in-the-middle attacks, cross-site scripting

29、, denial-of-service attacks, password attacks, phishing, malware and zero-day exploits. Man-in-the-middle attacks occur when attackers insert themselves into a two- party transaction. Cross-site scripting is a web security vulnerability that allows attackers to compromise the interactions a victim h

30、as with a vulnerable application. Denial-of-service attacks flood servers with traffic to exhaust bandwidth or consume finite resources. Phishing is the practice of stealing sensitive data by sending fraudulent emails that appear to be from a trustworthy source. Malware (i.e. “malicious software”) i

31、s a software designed to cause damage to IT devices and/or steal data (examples include so-called Trojans, spyware and ransomware). A zero-day exploit is an attack against a software or hardware vulnerability that has been discovered but not publicly disclosed. The discovery of a zero-day exploit ca

32、n result in a situation where both the customers and vendors of the IT asset are now subject to cyber attacks for which no pre-defined detection signatures or remedial patches are available. Exacerbating this situation are commercial firms that conduct research to sell zero-day exploits on the open

33、market. Some of these firms, such as Zerodium, pay large cash rewards (up to $2.5 million) for high-risk vulnerabilities.of reducing the cost of cyber events. In particular, firms in sectors that employ more IT specialists, use more computers and provide more IT training to staff, are better equippe

34、d to mitigate the costs stemming from a cyber event. From a policy perspective, these findings can inform governments and cross-sector regulators regarding the mitigating steps that can be taken to reduce the cost of cyber incidents and which sectors are lacking in such areas.Cybersecurity activitie

35、s provided by third-party service providers are an alternative to risk transfer mech- anisms. Rowe (2007) argues that, if multiple organisations share the same service provider, economies of scale and information-sharing can create positive externalities. Cloud technology can reduce IT costs, im- pr

36、ove resilience and enable firms to scale better (Financial Stability Board, 2019). However, the technology strengthens interdependence across firms that have shared exposures to similar (or even the same) cloud service providers. For example, several cloud suppliers may use a common operating system

37、 so that, if the operating system has a vulnerability, it could create a correlated risk across all cloud suppliers. By analysing the cost-benefit trade-off, we find that the use of cloud services is associated with lower costs of cyber events. While this speaks to the resilience of cloud technology

38、, it should be interpreted with caution. As firms exposure to cloud services increases and cloud providers become systemically important, cloud dependence is likely to increase tail risks (Danielsson and Macrae, 2019).Of particular concern is the exposure to cyber risk of financial institutions and

39、infrastructures, given the critical services they provide (Kopp et al., 2017; Committee on Payments and Market Infrastructures, 2014). Following the financial crisis, banks in particular became a target for activists.4 We interact a finance sector dummy variable with our baseline regressors to asses

40、s average costs of losses relative to other sectors. While the frequency of attacks in the financial sector is high relative to others, the sector is better at mitigating the cost of attacks. This could be the outcome of more proactive policy, regulation and investment in risk management and governa

41、nce practices with respect to information technology.Cryptocurrencies have emerged as a challenge to established financial institutions and currencies. De- spite initial claims of superior security, the cryptocurrency space has suffered numerous cyber attacks. This notoriety stems both from attacks

42、on crypto-exchanges due to poor security standards and due diligence on internal controls,5 as well as from the use of cryptocurrencies as ransomware that is difficult to trace, e.g. WannaCry (Kshetri and Voas, 2017). We find that the average cost of crypto-related events is significantly higher. Th

43、ese costs are not independent of the soaring price of cryptocurrencies in recent years. We docu- ment the existence of a strong positive correlation between the price of bitcoin and the intensity of attacks on crypto-exchanges. To quantify this relationship, we use a Probit model to show that an inc

44、rease in the price of bitcoin increases the likelihood of future attacks on crypto-exchanges. However, the inverse rela- tionship is not found to be significant, i.e. there is no price decrease following cyber incidents related to cryptocurrencies.Finally, we use data on the level of IT spending acr

45、oss sectors to assess which sectors may be over- or4For a list of attacks on banks see: /specialprojects/protectingfinancialstability/timeline.5Analytics firm Chainalysis reported that approximately $1 billion worth of cryptocurrency was stolen from digital currency exchanges in 2018 (/report-two-ha

46、cker-groups-stole-1-billion-from-crypto-exchanges/).underspending on their IT security. This analysis can act as a helpful indicator to policymakers as to which sectors may be exposed due to underinvestment in IT systems. We find that, across all sectors, there is a deficit in IT-spending. This is c

47、oncerning, as the threat of cyber-related incidents is likely to increase in the future. Some sectors, however, exhibit an adequate level of spending. Such is the case of the finance and insurance sector. The dividend of such investments is evident through our other analyses, whereby the observed co

48、st of attacks for that sector is lower. This result does not provide a reason for firms in sectors that are in a spending surplus to cut back on their investments, as the threat landscape continues to evolve.The rest of the paper is organised as follows. Section II discusses related literature. Sect

49、ion III contains a description of the data. Section IV discusses our baseline results. Section V looks at the impact of technological skills on cyber losses. Section VI explores whether exposure to cloud services affects the cost of cyber events. Section VII examines the relationship between the pri

50、ce of bitcoin and the hacking of crypto exchanges. Section VIII zooms in on the financial sector. Section IX analyses the optimal amount of IT spending across sectors. Finally, Section X summarises the main conclusions.Related literatureCyber- and IT-related risks can be seen as a relevant component

51、 of operational risks. Costs are difficult to quantity, however, given the absence of high-quality data. Establishing policies to encourage long-term data collection about incidents and security breaches is crucial in informing effective policies for security actions and outcomes (Wolff, 2014).6 Rec

52、ent policy initiatives represent an encouraging step forward,7 but information on cyber incidents and cost is still limited.Most of the few empirical studies on cyber risk rely on collected publicly available data sources. Gold- stein et al. (2011) study how the exposure to IT operational risk, or t

53、he risk of failures of operational IT systems, could translate into significant losses in firms market value. Biener et al. (2015) emphasise the distinct characteristics of cyber risks compared to other operational risks. The presence of highly interre- lated cyber losses, lack of data, and severe i

54、nformation asymmetries, hinder the development of a sustainable cyber insurance market, an essential element to encourage improvements in cyber resilience. Romanosky (2016) and Chande and Yanchus (2019) use the Advisen dataset to study losses from cyber events across sectors and provide an initial e

55、stimate of firm risk by sector. Our paper builds on their work by looking at how characteristics of sectors management of IT resources can mitigate costs.The literature highlights that the observed heterogeneity in cyber costs across sectors heavily depends on the environment in which each firm oper

56、ates as well as IT security investments. Kamiya et al. (2018)6The high degree of uncertainty and variability surrounding cost estimates for cyber security incidents has consequences for policy-makers. For example, it is difficult to foster robust insurance markets, as well as to make decisions about

57、 the appropriate level of investment in security controls and defensive interventions (Biener et al., 2015; Wolff and Lehr, 2017).7The European Union recently passed the Network and Information Security Directive (NISD). Meanwhile, the U.S. Congress passed the Cybersecurity Information Sharing Act (

58、CISA). These new initiatives aim to encourage, or require, that more information about cyber security incidents be shared with, or reported to, entities other than the ones who detect those incidents. Due to the new class of threats and corresponding insurance needs, frequent updating of the reporti

59、ng requirements is needed to maintain an accurate picture of the cyber threat landscape (Wolff and Lehr, 2018; Rowe and Gallaher, 2006).find that cyber attacks are more likely in industries that face less intense product market competition and in industries with higher growth opportunities. Moreover

60、, controlling for firm characteristics, they find that, among the major industries, cyber attacks are more likely in service industries, wholesale/retail trade, and transportation and communications. Makridis and Dean (2018) also find heterogeneity in cyber attack episodes amongst sectors when it co