Last May, the WannaCry virus infected some 230,000 computers in more than 150 countries, paralyzing the activities of companies, institutions and public services. Experts tell us it is just a foretaste of what is to come. Are we ready to confront this global threat? Six colleagues who safeguard cybersecurity in MAPFRE tell us all about it.
TEXT María Jesús Pérez Fuentes y Andrea Burgui | ILLUSTRATIONS Thinkstock
Cyber risks, spyware, ransomware… these terms have surely become very familiar to you lately. Well, cybersecurity is not a question that has appeared recently; it has been with us since the late 1990s. However, it is now that it has slipped onto the agenda of the management committees of companies worldwide.
In MAPFRE we take the protection and confidentiality of our clients’ data very seriously, as well as all those other threats that may endanger the normal operation of our business activity. For this reason, we rely on an extensive team of specialists in this field distributed all around the world, a small sample of whom we are presenting to you here.
“Every year we hear news about cybersecurity incidents that have a major negative impact. On occasions, companies are unable to recover from the attack and, finally, cease trading. It is clear that security breaches are no longer a threat, but rather a fact of life,” says Tuncay, of MAPFRE SIGORTA, who outlines for us the situation of vulnerability that has become so evident in the last couple of months.
In a hyper-connected world, organizations are facing an ever-increasing number of cyber threats. Given this global scenario, much work has been done to enhance the methodology and procedures for analyzing various cyber risks which could lead to a financial or data loss, disrupt the business, or cause irreparable reputational damage. “Organizations are more exposed to outside threats every day; the attack surface thus increases and, therefore, the likelihood of an incident does too,” explains Ignacio, from DISMA (the Security and Environment Division) in Madrid. In addition, he adds another disturbing element to this equation: “Apart from the perennial bad guys, we now have mafias, businesses and even governments, all attempting to damage their competitors’ reputation, steal information or make some easy money. There are even companies that offer this kind of packaged services. We are talking about the industrialization of cybercrime, where everything can be bought and sold.”
In fact, that is how the already famous WannaCry appeared. This malware, ransomware in this case, had companies and institutions around the world with their backs against the wall last May. “The main challenge is to be able to provide a uniform, global, comprehensive level of protection throughout the Group, suited to the business needs of the company (…) Being able to offer prompt, coordinated responses is key to minimizing the impact of these attacks,” explains Juan Manuel, of MAPFRE USA.
THE HIGHEST-PROFILE CASES
Yahoo: suffered the theft of over one billion user account passwords and data in 2013 and 2014, thus becoming the greatest data breach in history suffered by any company.
WannaCry: last May it affected NHS (National Health Service) hospitals in the United Kingdom, Telefónica in Spain, as well as major corporations in Russia, Turkey, Germany and Vietnam. It is estimated that it infected over 230,000 computers in more than 150 countries.
HBO: the corporation suffered a cyberattack last August which resulted in the theft of 1.5 terabytes of data, as well as unreleased material from its flagship series Game of Thrones.
“I would say that the focus is currently on the Internet of Things (IoT), because we have ever more devices connected to the Internet, and many of them are released to the market with limited or non-existent possibilities of applying updates and/or security patches. This means that, whenever a security breach is discovered, they can be accessed and controlled remotely by malicious people,” declares Gustavo, of MAPFRE ARGENTINA.
Yuli, of MAPFRE PERU, tells us how, unlike in Europe, the brunt of the attacks in her country generally target individuals and SMEs. “But in the case of major enterprises, the prime targets are those in the finance sector or ATMs.” Like Tuncay and Ignacio, she affirms that WannaCry was the biggest challenge she has faced throughout her career.
“Traditional companies suffer from tremendous technological obsolescence – they are like great elephants difficult to move,” says Omar from Madrid. “All of these attacks call for the security teams to work in a coordinated manner, sharing information in order to tackle them and protect their clients and business processes.”
“The problem,” Ignacio points out, “is that, historically, this is an area in which people tend to be more reactive than proactive. Many companies do not invest until they suffer a major blow due to some security incident.”
“To be honest, much remains to be done in many companies. Security matters most when you have an issue and, as long as you have no problems, greater importance is afforded to enhancing the digital experience or some other business goal. A balance must be sought between security and functionality,” Omar adds.
“Fortunately, MAPFRE possesses a great team of professionals which, with all actions coordinated from DISMA, ensures that the application of common, comprehensive, uniform criteria is a reality throughout all the companies within the Group. Moreover, we can guarantee the necessary flexibility to adapt to the particular needs of each company through the local teams,” stresses Juan Manuel, especially proud of the work that his team undertakes in Webster, Miami and in Puerto Rico.
Although with certain differences, this issue’s leading actors perform the following functions in their daily work: Monitoring the whole perimeter of the MAPFRE network around the world, blocking potential threats, implementing security measures, ongoing maintenance of the security protocols, user and access management and control, analysis of IT operational risks and security incidents, control of alerts, or business impact analyses, among many others.
Any cybersecurity threat should be treated with caution, as it can spread quickly throughout the digital ecosystem and thus cause a systemic failure. “The challenge is precisely to safeguard the confidentiality, integrity and availability of information, as well as be prepared to keep operating in the event of a major incident,” Gustavo stresses.
In this sense, the overriding goal is to see to it that the security of our products and services is perceived as a competitive advantage, as Juan Manuel explains to us. “The application of security criteria in the development of any business initiative is no longer just a necessity, but rather a differentiating factor perceived by our clients, stakeholders and the regulators, who increasingly demand and value security as a key element in the products we offer.”
In particular, the insurance industry handles customer details that are governed by various data protection laws. The result is that any incident which may entail a data breach is deemed a serious threat, as Ignacio explains. Cyber insurance policies, and the insurance industry in general, play a fundamental role in the economy of any country. The constant digital revolution in which we live, the existence of an increasingly computerized, digitized, interconnected business environment, and the increasing number of incidents around the world augurs steady growth in cyber risk insurance policies which are expected to amount to 20 billion euros in around ten years’ time.
“Due to the amount of losses incurred around the world and the inability of companies to respond swiftly to an incident such as WannaCry, cyber insurance must form part of the prevention culture in any company,” says Yuli.
“For MAPFRE, our clients are the prime objective; cybersecurity is built into our commitment to quality and we always strive to ensure that, come what may, they are protected and we can continue providing the service we offer them,” states Guillermo Llorente, assistant general manager of DISMA (MAPFRE Security and Environment Division) and the head of security within the company.
PROFILES
He tells us that he continues studying to avoid his skills becoming obsolete thanks to the ongoing training offered by DISMA. He was always interested in IT security topics; however, when he started working for MAPFRE in 1991, there was not yet a specific function entirely devoted to this field.
At first, he took charge of communications encryption in the sales offices, the implementation of navigation control systems and other tasks that later led him to the security area which he is in charge of nowadays.
Gustavo believes that the greatest challenge of his professional career was the creation and start-up of the Security Department of the DISMA in Argentina in 2007.
She declares that one of the reasons she likes her profession so much is because the technology is always changing, which obliges her to keep studying constantly. In recent months, following the events in May, her main challenge has been to delve deeper into the short-term processes needed to be able to offer adequate controls for these new risks.
She is currently assisting with the updating of the Business Continuity Plan in Peru and the performance of business impact analyses.
He joined MAPFRE two years ago, but tells us that he has been immersed in this scene for as long as he can remember, as technology has always attracted him. Ignacio classifies his daily routine as “hectic madness”, but his work, like that of the rest of his colleagues, is essential for detecting and removing threats, and preventing them impacting on the organization.
Omar tells us that his interest in these questions started as a hobby when he was 12. From then on, he spent much of his youth sitting in front of a computer, “when hacking was a truly minority interest.”
Paradoxically, he also explains how, when he was very young, he participated in chats dedicated to ethical hacking, an area he currently works in at MAPFRE, managing a group of hackers who take care of protecting the company.
Regarding his profession, he says he decided to dedicate himself to it as it is his true vocation. In respect of recent events, Tuncay argues that no matter how big or small a company is, it is essential to have a plan in place to guarantee the security of its assets.
He is currently in charge of Security and Environment matters for MAPFRE in North America, being responsible for, among other things, managing all security-related needs, equipment and actions.
Juan Manuel stresses that the people who make up MAPFRE are the main – and most important – defense mechanism in the face of threats, and that awareness campaigns are essential, apart from the protection measures already implemented on the company’s computers and servers.
CYBER RISK INSURANCE
Last March MAPFRE launched cyber risk insurance for SMEs and the self-employed in Spain to cover them against the theft of confidential data and information. In addition, it offers protection against the financial losses a business may suffer due to IT damage, helps deal with a threat of cyber-extortion, and offers legal advice and a software restoration service, among others.
