According to Moody's Investors Service, nearly $22 trillion of global rated debt has a "high" or "very high" level of cyber-risk exposure. This includes electrical, gas, and water utilities, as well as hospitals, which are among the sectors with the greatest risk of cyberattacks.
In total, Moody's has rated nearly 80 trillion dollars in debt across 71 different sectors across the globe. This represents a quarter of Moody's $180 trillion in debt that Moody's has rated across 71 different sectors worldwide. This represents an increase of nearly a billion dollars from the firm's 2019 numbers.
According to Moody, the Cyber Heatmap takes into account two factors, namely exposure and mitigation. It weighs both equally across all the sectors that it rates for this report.
A major component of exposure is the industry's "systemic role" - the fact that it is appealing from an attacker's perspective in terms of disrupting a wide array of industries, along with its interconnectedness with other sectors. It has also been emphasized that "digitalization" has increased the attack surface by extending its digital footprint.
The mitigation plan will include measures to reduce perimeter vulnerability as well as basic cybersecurity practices based on financial loss estimates. While determining perimeter vulnerability, Moody's takes into account at-risk open ports and patching cadence, which it gathers from data and metrics provided by cyber-ratings company BitSight, in which Moody's owns a minority stake, which provides data and metrics about open ports and patching schedules.
"It has been mentioned before that poor patches can have a significant impact on a company's risk of ransomware, as well as reports of a high rate of ransomware instances," BitSight chief risk officer Derek Vadala said in a press release.
According to Moody's, this year's Heatmap provides insight into cyber risk within the 71 sectors. The information is based on exposures and mitigations, which Moody's has categorised as "low," "moderate," "high" and "very high" risk. Utility companies were found to have high levels of cyber risk.
In this sector, which has a total amount of $2.5 billion in collective debt rated by Moody's, there are both regulated and self-regulated electric utilities operating in the generation, transmission, and distribution of electricity and gas. There are also unregulated electric and power companies, as well as water and wastewater companies. Moody's noted, "this does not mean the issuers within these sectors have weak cybersecurity practices."
Most economists believe that it has more to do with the "multiplier effect across an economy," as per the report. Cyberattacks that knock out a regional power grid, for example, will have far more consequences than simply for the utility itself. Hospitals may be unable to provide life-saving surgery or critical medicine to patients if a cyberattack knocks them out of service. For assisted living facilities, it would be extremely challenging for them to keep their elderly residents comfortable during heat waves or cold snaps. This is because they cannot provide heat or air conditioning.
There is no doubt that this is why critical infrastructure has become such an attractive target for cybercriminals seeking to cause the most damage, as evidenced by the seemingly constant barrage of government warnings regarding nation-state threat groups targeting power systems and infrastructure.
As far as cyber risk is concerned, non-profit hospitals also ranked extremely high when it comes to the threats they face. In Moody's view, non-profit hospitals are particularly attractive targets for attackers because of the huge amount of data that these institutions possess, as well as the average mitigation measures, they have in place to reduce the impact of potential cyber threats.
Banks, the technology sector, telecommunications, and midstream energy are some of the sectors with the highest levels of risk. Meanwhile, in the Heatmap, some sectors have moderate levels of risk, such as advanced economies and emerging regions, regional and local governments, manufacturing, retail, and apparel, and integrated oil.
In conclusion, low-risk sectors include structured finance, real estate, independent exploration and production, mining, and public housing, which are all low-risk sectors. The analysis evinces how there has been a significant increase in the number of ransomware attacks against hospitals and healthcare organizations over the last few years which in turn calls for strict cyber security measures.
