Transcription
Experience the Commitment The Cyber-Value ConnectionRevealing the link between cyber vulnerabilityand company value
THE CYBER-VALUE CONNECTIONContentsPageForeword3Setting the scene5Executive summary: The Cyber-Value ConnectionThe cost of The Cyber-Value Connection46The value impact varies across sectors11Mitigating risk through insurance13Factors for the futureA legal perspectiveSetting the leadership agendaGetting specialist support on cyber securityAppendices12151620The Cyber-Value methodology23References27A small selection of types of cyber attack262
THE CYBER-VALUE CONNECTIONForewordThe digital revolution creates unprecedented opportunities for UKcompanies, enabling them to transform and grow in ways that seemedimpossible just a few years ago. But alongside these opportunitiescome new and unfamiliar cyber security risks which could preventcompanies from fulfilling their digital potential, and may even threatenthe profitability and survival of the company.At CGI we have a mission to help businessleaders understand and manage these cyber risks,allowing their companies to thrive in the digitaleconomy. Towards this end we have developedThe Cyber-Value Connection to put cyber securityin a context that will resonate with business leaders.The Cyber-Value Connection looks at the reductionin company value that arises from a cyber breach,vividly demonstrating how a severe incident leadsto a decline in share price. To ensure rigour andindependence, CGI commissioned Oxford Economicsto develop a robust econometric model using a‘difference in differences’ technique to isolate thedamage caused to company value by a cyberbreach from other movements in the market.The evidence of the connection between cyberbreach and company value identified by this methodis powerful and, I hope, will contribute towardsbuilding more mature cyber security business cases.At CGI, cyber security is part of everything we do.We actively encourage other organisations to take thesame attitude, especially as our economy becomesincreasingly dependent on digital businesses.Although we deliver security services to many of ourclients, the story is not yet complete as companiesremain in denial about the necessity to get securityright. We hope this study helps your organisationfurther understand the risks, the impact and theimportance of taking action.Dr Andrew RogoyskiVice President CyberSecurity Services,CGI UK3
THE CYBER-VALUE CONNECTIONExecutive summary:The Cyber-Value ConnectionCyber risk has risen to the top of the corporateagenda but few company leaders are aware of thefull extent of damage caused by a cyber breach — orthe full costs. CGI has worked with Oxford Economicsto create a rigorous model that captures the damagedone by cyber breach to a company’s share price.The damage to shareholder value is significant today— but The Cyber-Value Connection analysis suggestssevere cyber breach will become even more costlyin the future as industry analysts include cyber as afactor affecting valuation and new regulation demandsthat companies disclose incidents.The Cyber-Value Connection reveals that share pricesfall by an average of 1.8 per cent on a permanentbasis following a severe breach. To put that in context,investors in a typical FTSE 100 firm would be worse offby an average of 120 million.Clearly, the CEO has responsibility for increasingcompany value. With the link between cyber breachand company value established in this report, it isclear the CEO’s responsibility must also includedirection and governance of cyber security. TheCyber-Value Connection concludes with advice onhow they can challenge their organisation and put inplace effective governance.However, in some extreme cases, breaches havewiped as much as 15 per cent off affected companies’valuations, substantially more than this sum.4
THE CYBER-VALUE CONNECTIONSetting the sceneCyber security is now a leading item on the global agenda:the World Economic Forumi recently identified ‘massive cyber breach’as one of the top technological risks to continued global growth.There can be no doubt that the world is now awaketo the risks posed by cyber security. The last fewyears have seen a gathering succession of storiesabout leaks, hacks and cyber attacks affectinggovernments, political parties, private individualsand companies across every sector. High profilecyber incidents such as those suffered by Yahoo!and SWIFT have made people uncomfortably awareof their cyber vulnerabilities.Cyber security was also identified in the top fivebusiness priorities in CGI’s Global 1000 Outlookreport, where over 1,000 senior IT and businessclients were interviewed on their business andindustry challengesii. Business leaders certainlyunderstand that cyber is something they need tobe on top of: in a February 2017 survey of FTSE100 companiesiii, 87 per cent stated that cyber is aprincipal risk to their organisation.However, in many cases, business leaders maystruggle to articulate the extent of these risks withintheir own organisation and, as revealed by CGI’s 2016study, Cyber security in the boardroom: UK plc atriskiv, company boards are often not equipped with aclear understanding of the many and diverse issuespresented by a cyber breach.Getting a handle on cyberIt is not surprising that board members, like manyemployees in non IT roles, struggle to get to gripswith the totality of cyber risk. Cyber risk is a bigissue: one that extends across the enterprise, fromcustomer facing functions to the back office andbeyond through the supply chain. It is a deeplytechnical problem, shrouded in arcane languageand difficult concepts. Cyber risk is multifaceted,representing the different kinds of value lost ordamaged by a breach. A cyber incident can mean acompany’s trusted reputation is lost when customerdata is hacked. Or commercially sensitive information,critical to the company’s future, is leaked tocompetitors. Sometimes the nature and extentof damage quickly becomes apparent. In othercases, it can take years for the full scale of thedamage to emerge.Given this inherent complexity, rooted in the useof technology, it has been difficult to highlight theproblem to company leaders in a way that guaranteesattention. In this report, CGI and Oxford Economicshave demonstrated a clear link between cyberincidents and company valuation, as expressed inthe share price. This may be the simplest and mostpowerful method yet to illustrate the damage inflictedby a cyber incident.5
THE CYBER-VALUE CONNECTIONThe cost ofThe Cyber-Value ConnectionCompanies that experience a severe cyber breach see theirshare value fall by, on average, 1.8 per cent on a permanent basis.What’s worse, the analysis undertaken for The Cyber-Value Connectionsuggests the negative impact on share value is getting more severe,year-on-year.A company’s share price tells you a lot about acompany and its prospects: it is the sum of themarket’s expectations for a company. Broadlyspeaking, the share price rises when the market hasa positive view on the company’s future profitabilityand falls when that assessment turns negative. Couldchanges in the share price in the wake of a publiclydisclosed cyber incident tell us something importantabout the costs of cyber attacks?According to Cyber-Value analysis, a severe cybersecurity breach represents a permanent cost of 1.8per cent of company value. Two thirds of companieshad their share price adversely impacted, incomparison with their peer group, after suffering acyber breach.In this study, the term ‘breach’ is used to describeany form of major cyber incident.1CGI set out to test the hypothesis that there is alink between cyber breach and company value. Toensure independence and rigour, CGI asked OxfordEconomics to develop an analytical methodologyto examine share price movements in companiesthat had experienced cyber breaches1. At the heartof this method was a comparison of each affectedcompany’s share price against a cohort of similarcompanies operating in the same markets, isolatingthe impact of the cyber breach from other marketmovements. Details of this approach are provided inthe appendix.6
THE CYBER-VALUE CONNECTIONWeeks relative to incident breach15%Peer performance after incident10%5%-10%-8%-6%-4%-2%0%0%2%4%6%8%10%Peer performance before incident-5%-10%Share price performance negatively impactedShare price performance positively impacted-15%Source: Oxford Economics / Gemalto / BloombergThere is some indication that companies that were already underperforming in comparison with their peer groupmay find that their share price is impacted harder — a reduction of 2.3 per cent in comparison with an average of1.1 per cent for companies performing ahead of their peer group, although the size of the sample means that isnot possible to establish a difference at the usual statistical confidence levels.7
THE CYBER-VALUE CONNECTIONCounting the costFor a typical FTSE 100 firm the impact of 1.8 per centequates to a permanent loss of market capitalisationof 120 million. Applying the analysis methodology tothe 65 companies whose severe breaches were usedto compile this study, the cost to shareholders of thesecompanies would be in excess of 42 billion.In the case of firms that experience a catastrophiccyber breach, where a very large amount of sensitiveinformation is lost or compromised, the impact oncompany value can be even more dramatic.Looking at those companies that suffered the tenlargest share price impacts reveals just how seriouscyber breaches can be in terms of company value.In many cases, these incidents continue to be a topicthat affects their on-going business performance,with markets, investors and customers seekingreassurance that business operations are fullyrestored and that the security vulnerabilities havebeen removed.Company sectorCountry of listingIncident yearShare price fall (%)*Media and communicationsUK2015-15.0%RetailUK2014-12.9%Media and chnologyJapan2016-8.3%Media and communicationsJapan2015-7.2%B2B industrialJapan2014-5.9%B2C industrialJapan2016-5.5%FinancialUSA2014-5.0%Media and communicationsUSA2015-4.8%*represents the % change in the firm’s share price on the Friday following the attackSource: Oxford Economics / Gemalto / Bloomberg8
THE CYBER-VALUE CONNECTIONLooking deeper at case study examples demonstrateshow the organisation’s value is impacted in the wakeof a breach. One of the firms involved in theCyber-Value analysis was a UK supermarket chainthat had suffered a major cyber attack. This involvedsignificant exposure to the business where sensitiveinformation was lost and the breach rapidly became amainstream news story.110Over the week following the attack the company’sshare price fell by seven percentage points,compared to the average share price movementin the sector. The situation then worsened when itwas announced that the breach had led to legalproceedings against the supermarket. This saw theshare value fall a further one per cent.Share price, T-4 100Case studyControlWeek of breach1009080-4-3-2-10Weeks relative to incident breachAnother case gave an even more dramaticdemonstration of the impact of cyber breach oncompany value. Here a UK communications firmsuffered two separate attacks during 2015. The firstattack (shown as occurring in week -2 in the graphbelow) had little discernible impact on the company’sshare price.1101Source: Oxford Economics, Gemalto, BloombergA second attack (shown in week 0) led to a sharpdivergence in the share price versus the controlgroup. While the company estimated that the hackresulted in between 30-35 million in one-off costs,its value fell by over 430 million in the week followingthe incident.Share price, T-4 100Case studyControlWeek of breach1009080-4-3-2-1Weeks relative to incident breach01Source: Oxford Economics, Gemalto, Bloomberg9
THE CYBER-VALUE CONNECTIONImpact worsens year-on-yearThere is evidence that the impact of cyber attackson share price has become more pronounced overrecent years. Analysis of the companies included inThe Cyber-Value Connection reveals that breachesthat occurred over the past 18 months led to amuch more severe negative impact – particularly incomparison to 2013.The sample size is small, but the trend is clear, alsoexplaining earlier work which found little impact onshare price by cyber breachesv.% point impact on firm’s share price on the Friday following the 2.0%-1.5%-1.0%-0.5%0.0%*Statistically significant at the 10% levelSource: Oxford Economics estimates10
THE CYBER-VALUE CONNECTIONThe value impactvaries across sectors% point impact on firm’s share price on the Friday following the incidentRetail, hospitality and 2.0%Severe or catastrophic cyber breaches appear toproduce markedly different impacts across differentmarket sectors. Understandably, financial servicesexperience the greatest burden in terms of impact,reflecting the high levels of regulation, the importanceof customer confidence in these organisations and thepotential for financial fraud to be a facet of the breach.Industrial and technology companies that dependon their intellectual property – product designs,processes and tools – are also seen to be severelyimpacted by a cyber incident.-1.5%-1.0%-0.5%0.0%When examining the type of incident suffered bycompanies in the sample, it was revealed that B2Cfirms (retail and media & communications) seem tosuffer proportionately more incidents due to identitytheft and account access, whereas B2B sectors, suchas technology and industrial, suffered proportionatelymore incidents of financial access. Understandingthe prevalence of certain types of attack allowsorganisations in these sectors to make betterjudgements about their risk and theirnecessary responses.The relatively low impact on retail, hospitality andtravel is perhaps unexpected as companies in thesesectors increasingly rely on online sales channels.11
THE CYBER-VALUE CONNECTIONFactors for the futureCompanies are facing a greater degree of cyber scrutiny frominvestors and regulators alike as the worlds of finance and governmentbecome ever more sensitive to the risks of cyber breach.Today, most cyber incidents occur behind the scenes:CGI estimates that less than ten per cent of majorcyber breaches in Europe come to be known about.However, undisclosed breaches will become rareas regulators force cyber incidents into the openwith legislation such as the General Data ProtectionRegulation and the Network and Information SecurityDirective, both coming into force in 2018 acrossEurope, including the UK.Investors demand the full pictureThe financial community is becoming more vigilantabout cyber security as an issue that can be shownto affect the value of their investments. One recentsurvey of buy side investors and sell side analystsacross the UK, US, Asia and Europevi found mostinvestors would lower post close valuations if eitherparty in the merger had suffered a breach. Verizon’srecent offer to acquire Yahoo! was reduced by nearlyeight per cent following Yahoo!’s very public cyberbreachvii. The survey also found that the number ofinvestors that took an investment decision based onthe level of security in place has more than doubledsince 2014, rising to over a quarter of all investors.Growing awareness of cyber risk is also influencingcredit ratings. In 2015 Moody’s confirmed that cyberrisk is of increasing importance to its credit analystswhen assigning credit ratings to corporations. In thereport Cross Sector - Global: Cyber Risk of GrowingImportance to Credit Analysisviii, Moody’s identifiesseveral key factors to examine when determining acredit impact associated with a cyber event. Theseinclude the nature and scope of the targeted assetsor businesses, the duration of potential servicedisruptions and the expected time torestore operations.12
THE CYBER-VALUE CONNECTIONMitigating riskthrough insuranceAs the level of cyber scrutiny increases, there are a growing number ofways companies can act to mitigate cyber impact. Raf Sanchez,International Breach Response Manager at insurer and CGI partnerBeazley looks at the role insurance can play:“Organisations are collecting more, and more detailed, data about their customers andseeking to monetise this data. The rapid evolution of the regulatory landscape for this data, especiallyin Europe, means that many organisations are subject to increasingly onerous compliance regimes at atime when the number and nature of cyber risks is growing exponentially.Beazley sees data security as more than just a compliance issue – it is an ethical, reputational andfinancial challenge that is the key to maintaining customer loyalty and trust. This challenge can bemet through a combination of tailored insurance cover, integrated risk management and third partyprotection. That is why Beazley provides, as an integral part of our coverage, access to a range ofexpert services designed to mitigate reputational risk to the insured and diminish the risk of legal actionbeing brought.“Additionally, these services will likely reduce the administrative burden that organisations commonlyencounter when handling a breach on their own.Raf Sanchez,International Breach Response Manager, Beazley13
THE CYBER-VALUE CONNECTIONRegulation and cyber disclosureMany governments are moving towards mandatorybreach notification to encourage greater action frombusinesses to address and mitigate cyber risk. Inthe US, mandatory breach notification has been areality in most states for several years. In Europe, itwill become compulsory from May 2018 as theGeneral Data Protection Regulation (GDPR) comesinto full force.Building on the long standing 1995 EU DataProtection Directive, GDPR establishes one set ofdata protection rules across all 28 European states.GDPR dramatically increases maximum penaltiesfor mishandling data: these now amount to four percent of global revenue or 20 million, whicheveris greater. For many organisations in the UK thisrepresents a huge increase in the ICO’s (InformationCommissioner’s Office) current maximum penaltyof 500,000.Even with the Brexit process gathering momentum,UK companies will, alongside every companyoperating in Europe, have to adhere to therequirements and suffer the penalties of GDPR.The UK government has made clear with its recentNational Cyber Security Strategyix and Cyber SecurityRegulation and Incentives Reviewsx that GDPR is hereto stay.14
THE CYBER-VALUE CONNECTIONA legal perspectiveWhat does GDPR mean for UK companies? Andrew Gilchrist of cyberlegal specialist and CGI partner K&L Gates LLP outlines some of thekey implications:“Many UK companies have still not come to grips with existing UK data protection legislation,let alone the new and even more prescriptive requirements of the GDPR. Their preparation will needto be both operational and legal. There is much emphasis in GDPR of ‘privacy by design’: the ideathat businesses should design their business models and data processes around data privacyconsiderations, rather than trying to retro-fit data protection compliance into their existing systems.GDPR emphasises the need for upfront impact assessments which should be undertaken bybusinesses prior to engaging in personal data processing likely to result in a high risk to the rights andfreedoms of natural persons. These impact assessments should be ongoing and well-documented,and are likely to be important in the event of a regulatory investigation or complaint. Compliance withGDPR is not simply a tick-box exercise for lawyers: it requires a detailed understanding of what eachparticular business does, what personal data it collects and for what purposes, who it is sent to, whereit resides geographically and how it is protected. Knowing this information will be a key starting pointfor any effective compliance programme.The next key step is to have in place systems and processes that can monitor the security of yourdata processing operations, and enable you to react quickly and decisively in the event a breachoccurs. This is not just an issue for your IT managers. In practice, businesses will need to consider andimplement insurance, PR, crisis management and business continuity and risk mitigation strategiesupfront, and not simply react to a breach when it occurs.In our view, the response to a cyber breach can only be as good as a company’s preparation for it.Once a breach has occurred, the clock is ticking and a business will only have a short period of timeto instruct cyber specialists, lawyers, PR managers and insurers, while at the same time react to fulfilits regulatory obligations and position itself in the best way possible to respond to, and mitigate, anypotential regulatory investigation and media scrutiny. Experience shows us that the real threat to UKbusinesses is not necessarily a fine from the ICO. This is a drop in the ocean compared to the badpress and loss of customer confidence that often follows a cyber-hack.“Andrew Gilchrist,Senior Associate, K&L Gates LLP15
THE CYBER-VALUE CONNECTIONSetting the leadership agendaThe Cyber-Value analysis reveals the connection between severecyber breach and permanent damage to company value. Adversepublicity surrounding recent public breaches means that cyber riskis increasingly on the radar for investors and regulators alike.Combined, this means cyber is a critical issue for the board and,specifically, the CEO.It is no longer possible to regard cyber risk as aperipheral issue: it is increasingly clear that cybersecurity is a key factor in a business’s performance,reputation and, as we see in this report, its valuation.This makes cyber security a critical issue forthe board.Yet, as revealed in CGI’s 2016 study, Cyber securityin the boardroom: UK plc at risk, few company boardsor CEOs possess the expertise or have access tothe necessary advice to implement plans to protecttheir organisations.This situation will change. Board members will findthemselves under increasing pressure to considercyber risk and it will become a growing influenceon how their personal performance is assessed.Expectations will fall most heavily on the CEO: inthe event of a cyber incident, the CEO will find himor herself facing questions from the media, customers,employees and irate investors. Indeed, it is verylikely that 2017 will see a marked increase in thenumber of CEOs forced to resign as a result of acyber security breach.16
THE CYBER-VALUE CONNECTIONChallenging your Organisation — Questionsthe CEO needs to askThe case for introducing robust cyber governanceis undeniable and urgent. The first step towardsdoing this is for board members to challenge theirorganisation on cyber issues. Only by asking the rightquestions can senior executives understand whatthey know and what they do not know, where there isconfidence and where there is not, where plans areprepared and where plans rest on hope. Upon thesefoundations, senior leaders can begin to build theexpertise, personnel and governance for anticipatingand managing breaches.Dr Andrew Rogoyski, CGI UK’s Vice President CyberSecurity Services, proposes some areas of challengeacross three key themes – questions that CEOs canask their organisation. These questions arenon technical – it is the confidence of the responsethat will reveal the real state of preparedness withintheir organisation.Governance and planning Who is responsible for cyber security?The real answer is that you, as the CEO, arepersonally responsible for driving securitygovernance, investment, planning and frontingup the organisation at the time of an incident.You may delegate the day-to-day activities toa head of security in whom you must have theutmost confidence but you cannot delegateaccountability for a major cyber incident. Anaccompanying response is that every employeeis responsible: everyone needs to play their partin keeping the company’s systems and sensitiveinformation secure. Can you show me our current cyber incidentresponse plan?All organisations that rely on IT systems shouldhave a cyber incident response plan. It describeswho is in charge of an incident, who else isinvolved in the response (the cyber incidentresponse team), external organisations involved(e.g. lawyers, forensic specialists, media handlersand crisis management experts), the processesand procedures to follow, the contact detailsof key individuals and other essential material.A good plan should be current. It should beexercised regularly to ensure that it is workable,effective and adaptable to change.17
THE CYBER-VALUE CONNECTIONSituational awarenessBusiness context Who can brief me on our cyber riskprofile today?The purpose of this question is to see who hasan accurate and current view of the risks thatcyber attacks present to your organisation. If yourorganisation cannot give you this answer today,it may be that no one has thought about cyberrisk recently. How many attacks did we see last week?There are many different types of cyber attack:the numbers often aren’t meaningful. The keyto a good response is that someone is aware ofthe status. This means being able to tell you howmany of the attacks were successful, their impact,the status on fixing any arising problems and eventhe source of the attack.Is cyber security one of our corporatebusiness risks?Cyber security issues need to receive regularattention by senior leadership. It should thereforebe raised out of the IT domain, where it is treatedas a purely technical set of challenges, into thecorporate risk register where it can be consideredalongside all the other business risks that boardsregularly review and act to mitigate. What did we learn from our last cyber incident?Just to admit that the organisation has sufferedan incident is a sign of maturity. All organisationshave incidents of one form or another: “we haven’thad any” either means that attacks haven’t beendetected or that someone is covering up. Either ofthese scenarios is a problem. Treat incidents asan opportunity to learn.How much would it cost us if we lost all our ITsystems for a week?This question focuses minds on the degree towhich the organisation depends on its IT systems.As companies and economies become digital, theimpact grows. The true cost of an IT outage canshock senior leaders who are perhaps unawareof their organisation’s dependency on itscomputer systems. What is the most valuable information that thiscompany has?How the organisation answers this question willgive you a good indication of whether informationsecurity has been thought about seriously. Manyorganisations struggle to understand what theirmost valuable information is. It’s not just aboutcustomer records and other personal data thecompany may hold. Data is often at the heart ofwhat gives a company its competitive advantage.It might be the designs for your latest product,your customer database or the details of your nextmajor deal. What independent tests have we done?Independent assessment of your securitymeasures, from policy and training, through topenetration tests of active systems, is essential ifyou want confidence that your teams are puttingthe right measures in place and that they work.Evidence of independent testing is essential ifyour company has to defend itself against legalor regulatory challenge following a major cyberbreach – it is important to show that allreasonable measures were taken to protectyour sensitive data.18
THE CYBER-VALUE CONNECTION How much do we spend on cyber securityevery year?This question is often hard to answer but a welldefined approach to cyber security is likely tohave well understood budgets. Historically, anorganisation might expect to spend five per centof its IT budget on cyber security. Today, thisnumber is often seen as nearer ten per cent of theIT budget.This starts at the topAre we prepared for GDPR?The new data protection regulation coming intofull force in May 2018 makes new demands suchas having a Data Protection Officer in place,meeting a 72 hour breach notification period,delivering increased data accuracy, activeconsent and the right to be forgotten for user data.Organisations need to understand what sensitivepersonal information they hold, how it is used andhow it is protected. Any company operating in theEU will have to comply and will face major fines ifsensitive personal data is mishandled.The scale, suddenness and extent of cyber risk mayprove intimidating but the risks of cyber threat can bemitigated like any other, through strong leadershipand sound governance, with adequate preparationand planning. It all starts at the top – and the CEOsets it in motion. Over to you.The cyber risk issue has expanded in theconsciousness of business, the investmentcommunity, regulators and indeed the wider public ata bewildering rate. In less than a decade somethingthat once seemed confined to the IT department hasbeen recognised as an enterprise wide risk and athreat to whole economies.These questions are not exclusive or definitive but theygive leaders a starting point in their journey towardseffective cyber leadership in their organisation.19
THE CYBER-VALUE CONNECTIONGetting specialist supporton cyber securityIt can be confusing to deal with the myriad of companiespositioning themselves as specialists in cyber security. In broadterms, cyber security specialists will provide one or more of thefollowing seven capabilities:1. Governance, risk and compliance. Cyberspecialists will act as advisors on the creation ofyour security strategies, policies and processes thatyour organisation should have in place. They willtake a risk management approach: risk, combinedwith risk appetite, drives the measures to be putin place. Understanding the level of threat yourorganisation is exposed to, what the impa
Getting specialist support on cyber security 20 Appendices The Cyber-Value methodology 23 A small selection of types of cyber attack 26 References 27. THE CYBER-VALUE CONNECTION 3 . Media and communications UK 2015 -15.0% Retail UK 2014 -12.9% Media and communications USA 2015 -9.3% Technology USA 2013 -8.5% Technology Japan 2016 -8.3%
