P&C Technosavvy the Jan/Feb 2017 issue

Zombie Webcams

Q&A with Donald Light, Director, North American Property/Casualty Practice , Celent
By Michael Fitzpatrick
There was a new kind of attack on the Internet last fall. Tell us about it.
Some bad actors seized control of a large number of devices, like video cameras, that connect to the Internet and used them to orchestrate a very, very large denial of service attack that left a lot of websites inaccessible for hours. It was a demonstration of the power that these bad actors or organizations could exert over what is basically a large part of the Internet itself. It affected such sites as Twitter, Netflix and PayPal. It also affected cloud service providers, including Amazon Web Services, which is even more worrisome.
What made this different from past attacks?
It was actually an attack on a part of the Internet infrastructure itself. The object of the attack was one of the domain name service providers (the organizations that help direct traffic across the Internet). To my knowledge this was the first time an attack has been mounted against that part of the Internet infrastructure. They got a lot more bang for their buck by going after a foundational element of the Internet instead of attacking an individual website.
Why is the use of Internet-connected devices in the attack worrying?
The number of connected devices (household appliances, electronics, locks, motor vehicles, etc.) has exploded. Most connected devices come out of the factory with very simple user names and passwords. Unless the new owner changes that, the bad guys can send out bots to see if they can find devices that have these simple unmodified user names and passwords and make them into slaves or additional bots within the overall network.
Why is this significant for insurers?
This is an issue for insurers when you think of connected homes, connected cars and all kinds of commercial property, factories, etc. These are potential vulnerabilities that no one thought about as vulnerabilities three or four years ago.

First, there is a direct implication for any insurer that is using the Internet of Things as part of any insurance product: for example, connected homes, connected cars, connected commercial property, even wearable devices for injured workers that are in rehabilitation programs. The reliability of the data going to insurers could be compromised. The whole point of the Internet of Things for insurers is to get new kinds of data that let them be smarter in terms of how they’re pricing, underwriting and adjusting claims. This vulnerability potentially undermines the basic value proposition of the Internet of Things for insurers.

There is something even more ominous. Bad actors could wreak havoc by taking over basic functionality within a car’s steering system or braking system. That could cause individual accidents or a lot of accidents. It could cause a lot of losses that were not anticipated. The nightmare scenario is the cyber warfare dimension. It’s not an insurance issue, but you could have a state actor or terrorist organization that wants to wage cyber warfare on societal infrastructure, power grids, water supply systems.

Michael Fitzpatrick

Technology Editor

Read More

More in P&C

Cyber Market Remains Competitive, According to Council Survey
P&C Cyber Market Remains Competitive, According to Council Survey
What you need to know from The Council's Cyber Market Watch Survey.
P&C When Leadership Fails
The D&O liability insurance market is seeing tougher times as executives and the...
D&O Market Hardens
P&C D&O Market Hardens
Increased claims and litigation are driving up rates for directors and officers ...
Pivot Point
P&C Pivot Point
Can the insurance industry be a force for prevention in the pandemic of child se...
Don't Make Dangerous Decisions
P&C Don't Make Dangerous Decisions
Knowing what to look for when developing your internal cyber...
Swiss Re Identifies Large Nat Cat Insurance Gap
P&C Swiss Re Identifies Large Nat Cat Insurance Gap
While man-made disasters are largely covered, the gap betwee...