A multi-level approach to understanding the impact of cyber crime on the financial sector

Abstract

This paper puts forward a multi-level model, based on system dynamics methodology, to understand the impact of cyber crime on the financial sector. Consistent with recent findings, our results show that strong dynamic relationships, amongst tangible and intangible factors, affect cyber crime cost and occur at different levels of society and value network. Specifically, shifts in financial companies' strategic priorities, having the protection of customer trust and loyalty as a key objective, together with considerations related to market positioning vis-à-vis competitors are important factors in determining the cost of cyber crime. Most of these costs are not driven by the number of cyber crime incidents experienced by financial companies but rather by the way financial companies choose to go about in protecting their business interests and market positioning in the presence of cyber crime. Financial companies' strategic behaviour as response to cyber crime, especially in regard to over-spending on defence measures and chronic under-reporting, has also an important consequence at overall sector and society levels, potentially driving the cost of cyber crime even further upwards. Unwanted consequences, such as weak policing, weak international frameworks for tackling cyber attacks and increases in the jurisdictional arbitrage opportunities for cyber criminals can all increase the cost of cyber crime, while inhibiting integrated and effective measures to address the problem.

Introduction

Human dependency on digital communication and other networked technologies for tasks ranging from simple web browsing for information to far more important and critical tasks, such as monetary transactions and power grid control and operation, has steadily increased since the initiation of the Internet. This dependency has translated into a growing emphasis on the strategic importance of cyberspace to enable achieving fundamental objectives in contemporary societies: innovation, collaboration, productivity, competitiveness and leadership (Sharma, 2010). The expansion of cyber functionalities has, however, also opened up new opportunities for people to carry out criminal activities online, and/or to use the Internet as a medium for their criminal objectives. The advantages of the Internet come with risks. While organisations and individuals are exploiting its business benefits they may not realise that cyberspace confers the same benefits on those who wish to attack them. Hacker groups, criminal organisations and espionage units worldwide have access to powerful, evolving capabilities, which they use to identify, target and attack their victims. They even have well-developed market places for buying and selling the tools and expertise used to target and execute cyber attacks. These attacks do not only represent technological threats. If we accept the argument that modern, economically developed societies are increasingly becoming ‘information societies’, then, it follows that threats to information can be seen as threats to the core of these societies (Eriksson and Giacomello, 2006).

Although nobody disputes the importance of protecting cyberspace from criminal activities, our understanding of cyber crime and its consequences, both economical and social, is still limited. The literature on cyber crime is vast, but still theoretically thin and underdeveloped. This is because there are still many different perspectives and a lack of consensus on many fundamental aspects of cyber crime. Thus lack of consensus extends to definitions, classifications, economic implications, security standards and solutions. Furthermore, among the factors undermining our appreciation of cyber crime and its impact are intangible pre-conditions, such as lack of awareness, general fears and feelings of insecurity as well as perceptions of trust, risks and ‘the virtual world’¹ These intangible pre-conditions can themselves have significant consequences.

Experience of cyber crime can also be fragmented. Experience might be spread across the different levels of the value network² and of society. The different actors involved each holding only part of the overall ‘puzzle’, might often be unable or unwilling to share their knowledge for fear of perceived consequences. Because of this fragmentation, and given the existence of the intangible pre-conditions referred to above, more flexible and multi-level approaches are needed in order to appreciate the complexity of cyber crime activities and their consequences.

As part of the emerging debate about the need to embrace more complex and interactive models for assessing the impact of cyber crime (Anderson et al., 2008) this article suggests a multi-level approach aimed at mapping and at shedding further light on the interaction of both interdependent and differentiated factors, which together can facilitate or deter cyber crime, while increasing and/or decreasing its economic and social costs. This approach makes use of system dynamics (Forrester, 1958) methodologies. Although system dynamics models are neither a panacea nor always appropriate, we demonstrate they provide a useful methodology that has not been sufficiently exploited in the context of cyber crime analyses. In this article we analyse cyber crime in the financial sector by adopting a multi-level approach, based on system dynamics theory. We have selected this sector because financial services and products, notably card payments, are a major target of cyber criminals (Trustwave, 2012).

The structure of this article is as follows:

• Section 2 briefly reviews the existing debate and research on the consequences of cyber crime, while identifying existing research challenges and gaps.

• Section 3 introduces the system dynamic approach and briefly discusses the definitions, the data for the model and model development.

• Section 4 presents some of the results and insights on the impact of cyber crime on the financial sector as emerging from the developed multi-level model.

Many of the issues covered in this article are still under development and are the subject of continuing dispute among specialists. Our aim is to contribute to the debate on, and examination of, these issues rather than provide conclusive answers.