IMF cyber risk paper uses ORX News data
- 28 June 2018
Antoine Bouveret, an economist at the International Monetary Fund (IMF), has published a working paper “Cyber Risk for the Financial Sector: A Framework for Quantitative Assessment”, which used ORX News data as its main input.
Despite the fact that cyber risk is near the top of the risk register for most financial firms, ‘data on cyber risk is notoriously scarce,’ according to this paper. ORX News was therefore invaluable as the main information source for this research. ORX News has been collecting data on cyber events in the financial services industry from 2009 to 2018 and has recently started covering high-impact cyber events at non-financial sector firms from 2018.
Published on 22 June 2018, the IMF paper uses the publicly reported loss event information in ORX News to analyze the distribution of cyber-attacks by territory, by size of institution and by type of attack.
The paper presents the data relating to cyber-attacks on central banks, as well as collating losses resulting from hacks of the SWIFT interbank payments system. Cyber losses suffered by fintech firms are also presented as a case study.
Correspondence analysis provides a representation of the most frequent words in the description of the three main types of cyber-attack: fraud, business disruption and data breach. This analysis is supported by the ORX News dataset in which all events are coded with one of three scenario categories relating to these cyber-attack types. The author used text mining techniques to find the words most commonly associated with each risk type.
Value at Risk
The author also suggests a mathematical framework to provide a quantitative assessment of cyber risk for financial firms. This uses a value at risk (VaR) methodology to assess the severity of losses for a given probability. By using Monte Carlo simulations and contagion effects, the study produced an estimate for the total loss experienced by the financial sector due to cyber-attacks. The results were broadly consistent with those from several previous studies, which underlines the reliability of the ORX News dataset.
Finally, the paper suggests possible policy responses from the public and private sectors to mitigate cyber risks, including the development of contingency plans.
The paper highlights the way that cyber risk has ‘emerged as a key threat to financial stability.’ ORX News is evolving to meet the consequent need for comprehensive information about cyber events. The service has expanded the scope of its cyber events coverage by tracking data breaches, fraud and business disruption at non-financial firms during 2018.
About ORX News
ORX News provides a database of almost 7,000 publicly reports operational risk events in the financial services sector, including cyber events. We welcome enquiries from academic researchers wanting to use this information as a research input. If you are interested in using ORX News data in your research, please contact us.