2001 Archives — General / Risk / Financing
Computer Network Security and Risk Management
English
|
|
|
|
Computer Network Security — Definition and Scope
Simply put, computer network security is the ability of a computer network to prevent
malicious manipulation and, failing that, to allow for speedy detection of unauthorized
acts and, if necessary, prompt restoration of operability and data. Security compromises
may originate within or outside a network.
Ideally, network administrators:
- Identify and address Internet-related vulnerabilities.
- Track and defend against external threats, that is, malicious activity of persons or
organizations without legitimate network access who gain entry to the network through the
Internet.
- Track and defend against insider threats, that is, malicious activity of employees or
other trusted individuals with or without legitimate network access who gain entry to the
network through the Internet or internally.
- Keep network and critical applications running on a daily basis despite threats.
Exposure
The magnitude of exposure of networks to possible malicious manipulation by outsiders is
the subject of considerable attention in scholarly publications as well as in the media.
In the May/June 2001 issue of Foreign Affairs, for example, a callout in the
article “Virtual Defense” by James Adams — addressing the possibility of
foreign attacks — certainly grabs attention because of its absoluteness.
“Computer hackers can attack U.S. computer networks with impunity,” the
statement declares. A sobering thought, if true. The fact is that the statement is
simplistic at best. What is true is that some computer hackers can attack
some Internet-accessible U.S. networks — be they government, commercial,
educational — with widely varying degree of ease and, in some cases,
with impunity.
Although these caveats are substantial, the reality of external network exposure remains
significant.
Significant as external exposures are, internal cyber crime may be the most damaging. As
actor Slim Pickens remarked in a long-forgotten movie, “All big-time crime is an
inside job.” While some raw statistics on Internet hacking are counterintuitive on
this point — external hacks are reported as outnumbering internal network attacks,
according to a survey conducted by the FBI and the San Francisco-based Computer Security
Institute — one expert, quoted in the report in the Spring 2001 issue of the
Institute’s Computer Security Issues and Trends, cautions that “The
insider threat remains the greatest single source of risk to organizations.”
Hacker activity eventually may cause more than just first-party losses. Third-party
exposures may also be emerging. In the 2001 white paper “Distributed Denial of
Service Attacks: Who Pays?,” commissioned by Mazu Networks, Inc., the author,
Professor Margaret Jane Radin of Stanford Law School, writes in the executive summary:
“The legal situation right now is uncertain, as no reported court decisions have held
e-businesses liable for DDoS [distributed denial-of-service] attacks. But there is
significant risk that, in the near future, target Web sites will be held liable to their
customers for harm due to DDoS attacks. There is also significant risk that network
intermediaries and backbone service providers will be held liable to target Web sites, and
perhaps to ultimate users.”
In other words, victims may be exposed to claims of negligence — and hence
held liable for payment of damages — on the ground that they should have foreseen the
denial-of-service threat and taken adequate action to prevent it.
Origins of Vulnerabilities
Network insecurity is traceable to two factors underlying the design of our computer
environment:
- Predisposition to trust others, and
- Establishment of collaboration as a primary goal.
Consider the focal points in computing today: the desktop, largely the domain of
Microsoft, and the Internet, linking us to the world via the Unix operating system and the
transmission protocols TCP/IP.
Microsoft applications and operating systems are beset with security vulnerabilities
because they have been designed for people to reach out to one another within the
comforting boundaries of family and community, not to protect people from potentially
hostile strangers. Having that orientation and the desire to sell ever-evolving,
competitive products, Microsoft, not surprisingly, is enamored of mobile code, that is,
software transferable from one computer to another in a network. That capability enables
Microsoft to deliver interactive “bells and whistles,” running below the
surface, to business and government users as well as to consumers. Unfortunately, mobile
code requires open gates and pathways, which also can provide an avenue of entry to
malicious activity.
As for the distinguished founders of the Internet, they formed a small crowd, who knew and
trusted one another. To build their vision of the brave new virtual world, they designed
their Unix operating system and TCP/IP transmission protocols to maximize sharing and
collaboration, not protection and security.
In the past six or seven years, we’ve moved our business processes overwhelmingly
into that environment — a shaky edifice indeed.
Absence of Regulatory Framework
Unlike other common elements that cross public and private sector boundaries —
physical infrastructure and human resources, for example — networks are unregulated.
This situation is changing, however. The highly influential research and education SANS
(System Administration, Networking, and Security) Institute, for example, proposes the
following standard contractual wording be included in all federal research grant
documents:
“Any Internet-connected information technology acquired or otherwise supported
using funds from this grant must be configured in compliance with minimum security
benchmarks such as those published by the Center for Internet Security and must have
applicable operating system and application security patches and updates installed within
seven days of their availability on the vendor’s web site.” [emphasis added]
The Institute’s proposal may represent the beginning of a move toward establishment
of standards and government-approved certification.
Network Risk Management
The basics of minimizing and, when possible, eliminating Internet vulnerabilities are well
understood by professional network administrators. These procedures are:
- Harden servers connected to the Internet by configuring a firewall and limiting port
access to permit only certain types of data packets to enter the network perimeter and
— as a service to the Internet community at large — restricting outbound traffic
to data packets originating within the network.
One benefit of restricting traffic into and from a network is to increase its defense
against the possibility that a hacker may flood it with data requests, thereby causing a
network crash, known as distributed denial of service. These types of attacks, popular
with hackers, exploit the “tragedy of the commons,” a concept created by the
biologist Garret Hardin in 1968 to explain how the pursuit of self-interest causes
degradation in resource quality and availability in an environment of shared resources
— or commons, in his words. The Internet is a “digital commons”; unless all
network administrators take steps to control their own network’s inbound and outbound
traffic, the Internet as a whole is susceptible to the “tragedy of the commons”
through distributed denial-of-service attacks.
- Install operating system and application patches and upgrades on a timely
basis.
- Enforce rigorous user ID and password policies.
- Establish and test backup procedures.
These basic procedures, when followed consistently and effectively, are cornerstones of
network management and Internet usage. Yet none of this protects against the malice of a
trusted insider.
What do we do about this much greater threat? One effective approach has been taken by the
U.S. Internal Revenue Service: It has established an external watchdog group — drawn
from the Treasury Department — to archive all transactions (telephone as well as
online contacts), along with both taxpayer and IRS employee data. The immense pool of data
amassed by the group is then subjected to intensive data mining and analysis using a
custom-tailored artificial intelligence application to seek out and reveal anomalous
patterns that may point to employee fraud.
The IRS approach assumes that clues to deceptive behavior are always present and
acknowledges that it may be necessary to dig deep to find them. To be sure, theirs is an
expensive solution, but few taxpayers are likely to take issue with the cost incurred to
uncover dishonest IRS employees!
Organizations with less daunting exposure and more modest resources need not take such
elaborate measures to detect insider crime: The basic tools for detecting it are available
on a network’s system logs. However, the task is not simple. Effective monitoring of
those logs requires considerable time and sufficient knowledge about the company’s
business practices to differentiate the suspicious from the routine. Thus, anyone handling
this task needs to know as much about the organization’s activity as about computing.
Better a Pimp
In a reply to an e-mail from a visitor to his Web site, Apple PC inventor Steve Wozniak,
after describing his own experiences as a network administrator, wrote: “If my son
wants to be a pimp when he grows up, that’s fine with me. I hope he’s a good one
and enjoys it and doesn’t get caught. I’ll support him in this. But if he wants
to be a network administrator, he’s out of the house and not part of my family.”
What Steve Wozniak knows from his own experiences and what he wanted, in part, to relate
to his correspondent in a particularly memorable way is what every professional network
administrator knows: Effective network administration is labor-intensive to an astounding
degree.
Best Practices — Beyond the Obvious
A high level of professional staff competency in computing and use of sophisticated
procedures and protection software are not enough to assure computer network security.
To a large degree, the ability of a network administration staff to make information
technology secure is a function of the mix of competencies within the department and the
size of the department’s staff:
- As noted, detection of insider crime requires that some of the staff possess thorough
familiarity with the organization’s business practices in addition to technical
credentials in computer networking and information security.
- As illustrated by the pimp story, network administration is time-consuming work.
Consequently, leaner staffing may be counterproductive; in fact, leaner staffing may be
dangerous. Tasks left undone, or postponed, because of inadequate staffing may cost
hundreds of millions of dollars in losses.
Best practices in network risk management cannot ignore these two realities.
| Contributor: |
Ralph Hitchens, U.S.
Department of Energy, Washington, DC, USA
|
| Editor’s Notes: |
Additional information on network security can be found at:
Computer Security Institute
National Infrastructure Protection Center
SANS Institute
White Papers: Distributed Denial of Service Attacks: Who Pays?, Margaret Jane Radin, the William Benjamin Scott and Luna M. Scott Professor of Law at Stanford Law School and Co-Director of its Program on Law, Science, and Technology
For definitions of Internet, network, and computer security terminology, see the Biometrics, Computers, Internet category in our Glossary
Agent™.
|
You have just read an article in Language
Perils™, an e-journal published by MultiTech Communications, Inc. Go to the Language
Perils™ index page for more information on
Language Perils™ and for access to all Language
Perils™ articles.
|
To
bookmark
this article, use: |
http://www.insurancetranslation.com/
Language_Perils/01general.htm#12a |
|
| |
Finite Risk and Financial Reinsurance
English
(United States)
|
|
|
|
The terms “finite risk” and “financial reinsurance” are often used
interchangeably. As the reinsurance market has grown ever more sophisticated, however,
finite risk has become just one type — albeit an exceedingly important type — of
product in the increasingly broad spectrum of financial reinsurance.
The distinctions between finite risk and other types of financial reinsurance are
significant. In this article, we briefly survey those distinctions, as well as the most
common forms and uses of finite reinsurance and of a few other popular financial
reinsurance products.
Finite Risk Reinsurance — Description
Finite risk reinsurance takes several different forms intended to meet a variety of
objectives. However, all finite risk products share a common element: they are designed to
achieve more of a financial or accounting benefit than a pure economic risk transfer
benefit. Furthermore, in exchange for a limitation on the reinsurer’s economic risk,
finite risk typically incorporates a specific profit-sharing component with the ceding
company. That component often includes investment income.
A common misconception exists that reinsurers do not assume economic risk when they write
finite risk reinsurance. In fact, they usually do.
In the wake of several high-profile, abusive transactions that were nothing more than
financings, accounting professionals in the United States became concerned about
reinsurance agreements that did not contain any risk transfer. That concern gained
momentum in the late 1980s after the failures of a number of reinsurers, which were blamed
in part on those abusive transactions. Ultimately, in 1992, to distinguish reinsurance
from financing transactions, the Financial Accounting Standards Board issued Statement of
Financial Accounting Standards No. 113, “Accounting and Reporting for Reinsurance of
Short-Duration and Long-Duration Contracts” (FASB 113), for U.S. GAAP accounting;
soon thereafter, the National Association of Insurance Commissioners essentially adopted
the same guidance for U.S. statutory accounting.
FASB 113 provides that, to be treated as reinsurance for accounting purposes, a contract
must:
- Transfer underwriting and timing risks from the ceding company to the reinsurer;
and
- Expose the reinsurer to the “reasonable possibility” of a “significant
loss.”
Underwriting risk is defined as the possibility that premiums minus claims minus
acquisition costs may differ from expectations; timing risk refers to the occurrence of
cash flows at other-than-expected intervals.
Because finite risk reinsurance generally needs to receive reinsurance accounting
treatment to meet its objectives, FASB 113, in effect, means that finite risk products
must transfer some true economic risk. To be sure, accounting rules vary outside the
United States, but a worldwide trend to adopt U.S. GAAP accounting requirements in this
area appears to exist.
Finite Risk Reinsurance — Uses
As noted, finite risk buyers seek to achieve some type of financial or accounting benefit.
Those benefits may be classified as:
- Surplus relief: The need for surplus relief can arise from two main (often
overlapping) issues. The first issue relates to the fact that, under U.S. statutory
accounting, acquisition costs must be expensed at policy inception, while underlying
premium income is recognized into earnings over the policy term. That mismatch often
creates a drain on an insurer’s capital and surplus, particularly when the insurer is
growing. The other issue relates to premium/underwriting leverage, a financial yardstick
that is essentially the ratio of net written premiums to capital and surplus. That ratio
is watched closely by regulators and rating agencies alike; if the ratio becomes elevated,
it can attract unwanted attention by one or both of those constituencies. Finite risk
reinsurance is often used for surplus relief in both the property/casualty and life
insurance arenas.
- Smoothing of operating results: An insurer’s shareholders are keenly
interested in smooth, growing operating results and will pay a higher share price for that
stability. In addition, rating agencies tend to frown on highly volatile operating
results. However, the earnings of property/casualty insurers tend to be volatile due to
catastrophes and other shock losses. Therefore, finite risk reinsurance products are often
used to smooth results.
- Discounting of loss reserves: This need arises because, in the United States,
property/casualty loss reserves usually must be reported at nominal value, despite the
fact that a significant discount for the time value of money often exists. To enhance
current operating results, insurers will use finite risk reinsurance. In addition, surplus
relief or smoothing of operating results, or both, are sometimes accomplished through
discounting of reserves.
- Protection against adverse loss reserve development: Finite risk products
designed for this purpose respond if loss reserves run off higher than anticipated; these
products are purchased frequently in connection with merger and acquisition
activity.
- Other: Among the many other reasons why an insurer may purchase a finite risk
product are enhancement of investment performance, exiting from a line or class of
business, and closure of a captive insurer or similar entity.
Finite Risk Reinsurance — General Categories
The most common general categories of finite risk reinsurance are:
- Aggregate stop losses: As the name suggests, an aggregate stop loss is designed
to protect a ceding company’s results in aggregate. The product can be designed to
protect the entire company (whole account), a profit center or division, or a product or
class. A ceding company obtains a reinsurance recovery when underlying aggregate losses
exceed a certain level, known as the attachment point, which usually is expressed as a
percentage of the underlying subject premium (loss ratio) or as a monetary amount. If the
attachment point is within the expected or planned loss level, the stop loss is referred
to as “in the money”; if it is not within that level, it is referred to as
“out of the money.” Stop losses, in general, are mainly used for smoothing of
results; that is indeed the principal objective of out-of-the-money products. However,
in-the-money stop losses tend to have more of a loss reserve discounting component.
- Finite/financial quota shares: Financial or finite quota shares are
proportional reinsurance transactions, much like a traditional contract. Unlike
traditional proportional arrangements, however, a finite quota share contains features
— such as a loss ratio cap — that limit the reinsurer’s exposure. The main
objective of a finite quota share is surplus relief; this is generally accomplished
through use of a ceding commission to offset direct acquisition costs, which an insurer in
the United States must expense at policy inception. In addition, the cession of the
applicable percentage of premium income reduces an insurer’s premium leverage. In
life/health insurance, these transactions tend to be referred to as coinsurance or
modified coinsurance.
- “Funded” catastrophe products: These are products that are designed
to smooth an insurer’s operating results from the impact of catastrophic or other
shock losses. Typically, the products are designed as multi-year contracts that enable an
insurer to obtain a loss recovery in the year of a catastrophic event and effectively
repay the reinsurer in subsequent years. The reinsurer’s risk is exposure to the
possibility of more than one loss over the contract term.
- Loss portfolio transfers (LPTs): The main purpose of LPTs is protection against
adverse loss reserve development. Because LPTs protect a ceding company from the
development of losses that have already been incurred but not yet paid, they are
retroactive reinsurance transactions. In actuality, LPTs, as the term is often used,
encompass two separate types of related products: the actual LPT and the adverse
development cover. The distinction between those two products lies in the ceding
company’s retention: an actual LPT involves little or no retention; an adverse
development cover involves significant retention. Adverse development covers are
frequently used as part of merger and acquisition activity to protect the buyer against
unfavorable changes in loss reserves.
Non-Finite Financial Reinsurance Products
In addition to finite risk reinsurance, financial reinsurance includes products that cover
financial exposures and involve more of a true transfer of economic risk than does finite
risk. Many of the non-finite products have enjoyed increased popularity as convergence of
insurance and other financial disciplines has deepened.
Among the more common categories of non-finite products are:
- Credit enhancements: These products indemnify a lender against a
counterparty’s default risk. While that type of protection is certainly not a new
concept (bond insurers have existed for a long time), the scope of the transactions has
broadened and the number of reinsurers offering the products has increased. The targeted
coverage of credit enhancement products can range from mundane exposures such as a
municipal bond offering to the more exotic exposures of project or film
finance.
- Residual value: As leasing has gained in popularity, so have residual value
reinsurance and insurance. Under a residual value product, a lessor receives an indemnity
if the actual residual value of property coming off lease is lower than a stipulated
level. These transactions are usually carried out at the portfolio level.
- Warranty: These products transfer the risk that expenditures under warranties
(such as for an automobile or a home) will exceed certain, stipulated levels. Often, the
seller of the warranties seeks to transfer all or a portion of the risk; these products
facilitate such risk shifting.
- Derivatives: Reinsurers have also become involved in products that are, in
substance, derivative transactions; this coverage category, which may include weather
derivatives, credit derivatives, and other types of exposures, may or may not take the
form of reinsurance.
Summing Up
As discussed, finite risk reinsurance covers traditional exposures (underlying
underwriting risks) through mechanisms and for objectives that tend toward non-traditional
types (by emphasizing financial or accounting objectives over transfer of economic risk).
Non-finite financial reinsurance covers non-traditional exposures (financial risks)
through mechanisms that tend toward traditional types (by relying on more of a true
transfer of economic risk than does finite risk).
Despite their significant differences, both are financial — finite risk reinsurance
because of its mechanisms and objectives, non-finite financial reinsurance because of its
subject matter — and it’s that fact that underscores the broadness of the
concept of “financial reinsurance” in today’s market.
Thus, despite the practice of some in the reinsurance industry to continue to use the
terms “finite reinsurance” and “financial reinsurance”
interchangeably, financial reinsurance has become a broad term. All finite reinsurance is
financial, but not all financial reinsurance is finite.
| Contributor: |
Edward S. Hochberg, CPA,
CPCU, Senior Vice President, Financial Products, PMA Re, Philadelphia, Pennsylvania,
USA
|
| Editor’s Note: |
For definitions of reinsurance terminology, see the Reinsurance
category in our Glossary Agent™.
|
You have just read an article in Language
Perils™, an e-journal published by MultiTech Communications, Inc. Go to the Language
Perils™ index page for more information on
Language Perils™ and for access to all Language
Perils™ articles.
|
To
bookmark
this article, use: |
http://www.insurancetranslation.com/
Language_Perils/01general.htm#09a |
|
Go to Language Perils™ index.
|
