Shen Attack: Cyber Risk in Asia Pacific Ports

CyRiM Report 2019

Shen attack Cyber risk in Asia Pacific ports

−

−

−

− −

− − − − −

−

−

−

−

−

−

−

−

−

Direct

Telecommunications

Indirect

IT - Services Finance - Investment Management Finance - Insurance Finance - Banking Healthcare IT - Software Mining & Primary Industries Education Energy Utilities Food & Agriculture Tourism & Hospitality Entertainment & Media IT - Hardware Defence / Military Contractor Pharmaceuticals Real Estate / Property / Construction Business & Professional Services Manufacturing Retail Transportation / Aviation / Aerospace $-

−

− −

$5

$10

$15

$20

$25

$30

$35

−

−

$26,871 $623

$266 $52

$19

$14

$12

$6

$5 $0.1

Asia

EU

North America

Oceania

Central America

Europe

Middle East

Africa

South America

The Caribbean

− • • − • •

− • • − • • − • • − • • − • •

CyRiM Report 2019

Introduction to the scenario

蜃

CyRiM Report 2019

Shen attack scenario narrative

Cumulative recovery distributions 100% 90% 80%

Percent recovered

70% 60% 50% 40% 30% 20% 10% 0% 0

1

2

Fastest Recovery

3 4 Days Shutdown Average Recovery

5

Slowest Recovery

6

7

CyRiM Report 2019

Scenario variants

CyRiM Report 2019

Sectorial impacts

IT - Services

$0.7

Telecommunications

$0.7

Finance - Investment Management

$0.8

Finance - Insurance

$0.8

Finance - Banking

$0.8

Healthcare

$1.1

Mining & Primary Industries

$1.1

Education

$1.1

Utilities

$1.5

Entertainment & Media

$1.7

Tourism & Hospitality

$1.8

IT - Software

$1.8

Energy

$2.0

Food & Agriculture

$2.0

Defence / Military Contractor IT - Hardware

$2.7 $4.0

Business & Professional Services

$4.7

Pharmaceuticals

$4.8

Real Estate / Property / Construction Retail Manufacturing Transportation / Aviation / Aerospace

$5.5 $18.5 $23.6 $28.2

94%

China

92%

Japan

89%

Korea

83%

Hong Kong Special Administrative Region of the People's Republic of China

81%

Philippines

76%

Singapore

67%

Malaysia

61%

India

S1

S2

X1

861

1,375

3,650

CyRiM Report 2019

Global and regional economic losses

Direct

Telecommunications

Indirect IT - Services Finance - Investment Management Finance - Insurance Finance - Banking Healthcare IT - Software Mining & Primary Industries Education Energy Utilities Food & Agriculture Tourism & Hospitality Entertainment & Media IT - Hardware Defence / Military Contractor Pharmaceuticals Real Estate / Property / Construction Business & Professional Services Manufacturing Retail Transportation / Aviation / Aerospace $-

$5

$10

$15

$20

$25

$30

$35

23%

24%

4%

6%

4%

6%

3%

4%

24%

27%

38%

4% 6%

11% 18%

3% 2%

17% 18%

15%

12%

21% 24%

14% 24%

45%

29%

28% 24%

Japan

20%

Malaysia

Singapore

Korea

Transportation / Aviation / Aerospace

Manufacturing

Retail

Real Estate / Property / Construction

Pharmaceuticals

Other

China

$26,871 $623

$266 $52

$19

$14

$12

$6

$5 $0.1

Asia

EU

North America

Oceania

Central America

Europe

Middle East

Africa

South America

The Caribbean

CyRiM Report 2019

Insurance loss estimations

− − −

−

−

−

CyRiM Report 2019

Conclusions

− − − − −

− −

− − − − − − − − − −

− −

− • − • − • − • • • •

𝐼𝑛𝑐𝑖𝑑𝑒𝑛𝑡 𝑅𝑒𝑠𝑝𝑜𝑛𝑠𝑒 𝐶𝑜𝑠𝑡𝑠 = (𝐴𝑛𝑛𝑢𝑎𝑙 𝑇𝐸𝑈 𝑡𝑢𝑟𝑛𝑜𝑣𝑒𝑟 ÷ 365 𝑑𝑎𝑦𝑠) × $500 𝑝𝑒𝑟 𝑑𝑎𝑦

𝑅𝑒𝑔𝑢𝑎𝑙𝑡𝑜𝑟𝑦 𝑎𝑛𝑑 𝐷𝑒𝑓𝑒𝑛𝑠𝑒 𝐶𝑜𝑣𝑒𝑟𝑎𝑔𝑒 = (𝐴𝑛𝑛𝑢𝑎𝑙 𝑇𝐸𝑈 𝑡𝑢𝑟𝑛𝑜𝑣𝑒𝑟 × $1 𝑝𝑒𝑟 𝑇𝐸𝑈) + $10,000,000

𝐶𝑦𝑏𝑒𝑟 𝐷𝑎𝑡𝑎 𝑎𝑛𝑑 𝑆𝑜𝑓𝑡𝑤𝑎𝑟𝑒 𝐿𝑜𝑠𝑠 = (𝐴𝑛𝑛𝑢𝑎𝑙 𝑇𝐸𝑈 𝑡𝑢𝑟𝑛𝑜𝑣𝑒𝑟 ÷ 365 𝑑𝑎𝑦𝑠) × 𝑜𝑓 𝐷𝑎𝑦𝑠 𝑃𝑜𝑟𝑡 𝑖𝑠 𝐶𝑙𝑜𝑠𝑒𝑑 × $50 𝑝𝑒𝑟 𝑇𝐸𝑈

− •

𝑃𝑒𝑟𝑖𝑠ℎ𝑎𝑏𝑙𝑒 𝐶𝑎𝑟𝑔𝑜 = ((𝐴𝑛𝑛𝑢𝑎𝑙 𝑖𝑛𝑠𝑢𝑟𝑒𝑑 𝑇𝐸𝑈 𝑡𝑢𝑟𝑛𝑜𝑣𝑒𝑟 ÷ 365 𝑑𝑎𝑦𝑠) × 𝑃𝑟𝑜𝑝𝑜𝑟𝑡𝑖𝑜𝑛 𝑜𝑓 𝑃𝑜𝑟𝑡𝑓𝑜𝑙𝑖𝑜 𝑤ℎ𝑖𝑐ℎ 𝑖𝑠 𝑃𝑒𝑟𝑖𝑠ℎ𝑎𝑏𝑙𝑒 (%)) × 75% × # 𝑜𝑓 𝐷𝑎𝑦𝑠 𝑃𝑜𝑟𝑡 𝑖𝑠 𝐶𝑙𝑜𝑠𝑒𝑑 × 𝐴𝑣𝑒𝑟𝑎𝑔𝑒 𝑐𝑜𝑠𝑡 𝑝𝑒𝑟 𝑇𝐸𝑈 ($)

− •

− • •

− • − • • − •

− • • − •

− • − •

CyRiM Report 2019