1. Financial Technology in Cyber Risks
AAMAI 4th International Conference
Yogyakarta, July 2017

2. Indonesia Profile Total Population 251 Million Internet Users
Mobile Users
262.6 Million (109%)
Social Media
3rd largest Facebook Users and 5th largest Tweeter in the World
TV Coverage
Million

3. the highest number of internet users
Top 20 countries with
the highest number of internet users
Indonesia is 5th largest internet user in the world per March 2017
Source:

4. Malware Threats Indonesia is 2nd in position
Source: Microsoft Malware Infection Index 2016 (MII2016)

5. The Cyber Threat In Indonesia
Indonesia overtook China as the number one source of cyber-attacks in 2013
Bank Indonesia recorded an increase in cybercrimes, in the form of network misuse, with a rise of 66.7 percent in 2015.
The government of Indonesia has created a policy concerning the implementation of cyber security in its legislation based on:
The Law No. 11 of 2008 on Electronic Information and Transaction (ITE)
The Law No. 36 of 1999 on Telecommunication
The Law No. 14 of 2008 on the Openness of Public Information.

6. CYBER RISK

7. What is a Cyber Risk?
Cyber risk" means any risk emanating from the use of electronic data and its transmission. This encompasses physical damage caused by cyber- attacks, loss or corruption of data and its financial consequences, fraud committed by misuse of data, as well as any liability arising from a failure to maintain the availability, integrity, and confidentiality of electronically stored information - be it related to individuals, companies, or governments.
"Cyber Risk Insurance" addresses the first and third party risks associated with e-business, the Internet, networks and informational assets.

8. What are the Cyber risks we face?
Exposure, misuse, deletion or alteration of business information may lead to a negative financial impact or reputational damage
Cyber Risk is a combination of four components (see diagram)
Vulnerability
Information
Threat
Cyber risk
Control
Risk appetite
Vulnerability and control is not just about technology but also determined by the people, data handling and business processes involved

9. What Information is Exposed?
All of it. Anything that is stored
Anything that can be destroyed, leveraged, sold, etc
Information about customers, employees, competitors
Personal Identification Information
Personal Health Information
Payment Card Data
Trade Secrets
Contracts

10. Impact Level of Cyber Attack
Motivation
Actor(s)
Impact Level
APT/Nation State
may result in the highly costly loss of major tangible assets or resources;
may significantly violate, harm, or impede an organization’s mission, reputation, or interest;
may result in human death or serious injury.
High
Insider
Money, Espionage, Skills for Employment, Fame, Entertainment, Hacktivism,
Terrorism and War
Terrorism
may result in the costly loss of tangible assets or resources;
may violate, harm, or impede an organization’s mission, reputation, or interest;
may result in human injury.
Criminals
Medium
Hacker Groups
Hacker
may result in the loss of some tangible assets or resources
may noticeably affect an organization’s mission, reputation, or interest.
Low
Noob/Script Kiddy
Sources: Indonesia National ICT Council, DETIKNAS 2013

11. Cyber Fraud Cases

12. What are the Risk Management options?
Cyber Risk
Risk Avoidance
Reduce the cyber security exposure
 Know your risks
Implement technical and organisational cyber security controls
 Mitigate your risks
Buy Cyber Insurance
 Transfer your risks
Keep residual cyber risk
 Accept your risks
Risk Reduction
Risk Transfer
Risk Retention

13. CYBER INSURANCE

14. The Cyber Insurance Market
The European Market has been slower to respond with current estimated premiums of $ 224m, strong growth is predicted. "EUR m in 2018" (Guy
(Carpenter - Ahead of the curve: understanding emerging risks, September 2014)
The Cyber Insurance Market
Currently US Cyber Market is estimated to be at USD 2-3bn and is targeted to grow to volumes of circa USD 10bn
In Asia the focus is on building awareness even though some insurers are already establishing footprint: AIG expects USD 2.5m premiums in the Asia- Pacific region)

15. Cyber Insurance – First Party Loss
Network Business Interruption
Loss of income and extra expense resulting from a total or partial failure of by DOS, malicious code, unauthorized access/use to computer system
Intangible Property
Costs to restore or recreate data or software resulting from network security failure
Loss of Digital Assets
Expenses & costs incurred resulting from damage, alteration, theft, digital assets caused by DOS, malicious code, unauthorized access/use to
Crisis Management Costs
Legal costs to comply with privacy regulations, credit monitoring, PR, costs, resulting from a security data breach, privacy breach or breach of
Cyber Extortion
Extortion expenses and monies paid resulting from a threat to destroy or assets which are acquired by unauthorized access

16. Cyber Insurance -3rd Party Loss
Litigation and Regulatory
Covers the costs associated with civil lawsuits, judgments, settlements or penalties resulting from a cyber event
Regulatory Respons
Covers the legal, technical or forensic services necessary to assist the policyholder in responding to governmental inquiries relating to a cyber attack, and provides coverage for fines, penalties, investigations or other regulatory actions
Notification Costs
Covers the costs to notify customers, employees or other victims affected by a cyber event, including notice required by Law
Crisis Management
Covers crisis management and public relations expenses incurred to educate customers concerning a cyber event and the policyholder’s response, including the cost of advertising for this purpose.

17. Cyber Insurance – 3rd Party Loss
Credit Monitoring
Covers the costs of credit monitoring, fraud monitoring or other related services to customers or employees affected by a cyber event.
Media Liability
Provides coverage for media liability, including coverage for copyright, trademark or service mark infringement resulting from online publication by the insured.
Privacy Liability
Provides coverage for liability to employees or customers for a breach of privacy

18. Industry Sector demand growth
Source: CYBER LIABILITY INSURANCE MARKET TRENDS: SURVEY 2014

19. Most vulnerable industries in Asia as having cyber attacks
Financial Services
Government (Federal)
High-Tech
Chemicals / Manufacturing / Mining
Services / Consulting
Higher Education
Telecom (Internet, Phone and Cable)
Energy / Utilities / Petroleum
Entertainment / Media
State and Local Government

20. Scenario: Attack to Cloud Provider
Risk Scenario Summary
Hacking/Intrusion into a Cloud provider
Intention to impair and interrupt services and to get access to and to misuse financial and personal data
Attack disabled the cloud network/storage systems and lead to a prolonged outage.
Various clients suffered business interruption and potential loss of sensitive third party information (e.g. personal information, credit card information)
Potential damage/losses:
Business interruption of cloud users like hospitals, financial institutions, trade/retail
Misuse of personal data and financial information
Restoration of data
Loss of profits/bankruptcy leading to shareholder claims
Line of business/Insurance products potentially affected:
Cyber Liability Insurance
General Third Party Liability Insurance
Directors and Officers Insurance
Property Insurance

21. Conclusion
Inevitable move towards e-industry with opportunities and threats that followed
Well prepared for threats of cyber risks
Educate customers and adaptors of technology towards threats of cyber security
Understand that cyber security is borderless, thus requires attention from and collaboration with the Government
Establishing Insurance as one of the front runners of cyber protection
Promptly explore opportunities in cyber insurance business

22. THANK YOU