![15Resilience Insights
are ranked relatively unlikely. Awareness
of the systemic impact of the former two
risks on the latter two (despite the
perception of their interconnectedness)
seems to not yet fully be understood by
respondents. However, as the Fourth
Industrial Revolution unfolds, the
probability of a systemic risk triggered
either by cyberattacks or data theft/
fraud or both is likely to increase.
Collectively, these perceptions seem to
fly in the face of all the available public
evidence that cyber risk and its impact
is on a steep climb (see the Global Risks
Report 2016 for a detailed discussion).
The gap between the reality and
perception of cyber risk has been
explained in other studies54
, where it has
been suggested that entitles struggle to
fully understand the risks involved,
predominantly as this is an area where
there is typically no single corporate
owner. Other factors, such as the
quickly evolving nature of the threat and
the difficulty in quantifying cyber risk,55
compound the problem.
As a foundational step towards
resilience, the Global Agenda Council
on Risk & Resilience encourages entities
of all sizes and types to consider the
following activities to deepen their
understanding of the enterprise risk they
face:
– Cyber risks should be integrated
into the assessment of the overall
critical risks to the organization.
Enterprise risk assessments should
be flexible and allow for frequent
updates to reflect the evolving
nature of cyber risk and the pace of
development in the online
environment. Specifically, as part of
risk-management processes,
business-impact assessments
should identify critical cyber assets,
systems, networks and the virtual
location of critical information.
Questions such as “How bad? How
long?” referencing possible
business disruptions should be
included to determine holistic
impacts.
– Cybersecurity risk assessments
should examine the extent to which
vulnerabilities may be introduced
into networks and systems through
connections with third parties.
Supply chains, in particular those
for critical parts, components and
IT services, should be examined as
part of the comprehensive risk
assessment and, where possible,
suppliers’ suppliers should be
identified.
– Specific risks to the confidentiality,
availability and integrity of critical
information should be identified and
included in enterprise risk
assessments. Consideration should
be given to the consequences to
the organization’s reputation,
stakeholder trust, and business
continuity.
– Activities and programmes to
address cyber risks, including their
causes and effects and their
impacts on the resilience of the
organization, should be mapped to
organizational structures so related
roles and responsibilities are clear.
Given the risk complexity and
potential impacts, senior leaders
should have specific roles in cyber
risk management and managing
these risks should specifically be
incorporated into board of directors’
risk and audit committee
governance responsibilities.
Consideration should be given to
the dependencies and co-
dependencies that exist within the
organization as part of the mapping
process. Conducting cyberattack
exercises can be an efficient way of
verifying the effectiveness of
planned roles and responsibilities.
B. Harmonize Government Action:
Need for Agreement on Rules of
Behaviour and Promotion of Risk-
Based Regulations
Governments today are active players in
working to address cyber risks as
regulators and legislators. In fact, over
half of all United Nations members have
in place, or are in the process of
adopting, cybersecurity-related laws
and regulations. Unfortunately, often
such legislative activity is not aligned
with related activities in other countries.
As a result, a patchwork of rules and
regulations is emerging – creating
compliance uncertainty for international
entities and the potential for conflicting
or overlapping legal obligations.
Developments such as the European
Union’s recently reached consensus on
the Network and Information Security
Directive56
are to applauded as
important steps towards harmonizing
the approaches of its 28 member
states. However, member states will be
required to identify the implementation
scope leaving room for the potential for
overlapping or conflicting regulations
within the EU.
Also, given the nature of the risk and the
highly networked risk environment, it is
extremely difficult for bureaucratic
consensus-driven processes to
effectively match the pace of the threats.
“[T]here is growing awareness that
policies designed as a solution to one
particular problem can frequently have
unintended consequences elsewhere,
e.g., on privacy, innovation or even
existing and commonly accepted
business practices.”57
Regulations
should therefore encourage greater
resilience investments and foster
adaptive approaches to risk
management recognizing that
compliance requirements defined by
today’s risks alone will not mean that
security has been achieved. In the
specific European example, contrary to
its intent, it is possible that the resulting
implementation could result in an
assortment of member state
requirements that increase costs and
have marginal impacts on cybersecurity
by diverting resources to compliance
activities rather than resilience
investments. National regulations should
also be risk-based, recognizing that all
entities and the services they provide
are not created equally and, therefore,
are not faced with the same risks. The
security required for social media
platforms should not be equated to the
security required for electric grid
supervisory control systems.
Compliance-based regulations that
focus on reporting requirements cannot
alone address the nuances of the cyber
risk to different types of entities.
Finally, as nation states continue to
develop capabilities to protect their
national interests, international norms of
behaviour must be developed. A 2011
study by the United Nations Institute for
Disarmament Research (UNIDIR)
identified 33 nation states that include
cyber warfare in their military planning
and organization, including “the use of
cyber capabilities for reconnaissance,
information operations, the disruption of
critical networks and services, for
cyberattacks, and as a complement to
electronic warfare and information
operations.”58
The number has only](https://image.slidesharecdn.com/4a626207-cff9-4f23-bd84-845ca7dff9da-161103185124/85/2016-Resilience-Insights-15-320.jpg)
2016 Resilience Insights
- 1. Global Agenda Council on Risk & Resilience Resilience Insights January 2016
- 2. Global Agenda Council on Risk & Resilience Chair Kirstjen Nielsen, Senior Fellow, Center for Cyber and Homeland Security, George Washington University; President, Sunesis Consulting Vice-Chair Sara Pantuliano, Director, Humanitarian Programmes, Overseas Development Institute Council Manager Caroline Galvan, Practice Lead, Competitiveness and Risks, World Economic Forum Forum Lead Margareta Drzeniek Hanouz, Head of Global Competitiveness and Risks, World Economic Forum Members Lauren Alexander Augustine, Director, Office of Special Projects on Risk, Resilience and Extreme Events, The National Academy of Sciences Stanley M. Bergman, Chairman of the Board and Chief Executive Officer, Henry Schein Inc. Michael Berkowitz, President, 100 Resilient Cities, The Rockefeller Foundation Edwin Macharia, Partner, Dalberg Global Development Advisors Victor Meyer, Global Head, Corporate Security and Business Continuity, Deutsche Bank Paul Nicholas, Senior Director, Microsoft Corporation Satoru Nishikawa, Executive Director of Research, JCADR Yuichi Ono, Assistant Director and Professor, International Research Institute of Disaster Science (IRIDeS), Tohoku University Joe Ruiz, Director, UPS Humanitarian Relief Program, The UPS Foundation Dan Smith, Director, Stockholm International Peace Research Institute Elizabeth Hausler Strand, Founder and Chief Executive Officer, Build Change Jaan Tallinn, Founder, Centre for the Study of Existential Risk Michael Useem, Professor of Management; Director, Center for Leadership and Change, The Wharton School, University of Pennsylvania Nick Wildgoose, Global Corporate Leader, Supply Chain Product, Zurich Insurance Group Alexander Wolfson, Managing Director, Global Country Risk Management, Citi The Global Agenda Council on Risk & Resilience collaborated with the following councils on this Resilience Insight Global Agenda Council on Cyber Cheri McGuire, Vice-President, Global Government Affairs and Cyber Security Policy, Symantec Corporation, USA Global Agenda Council on Forests Juan Carlos Castilla-Rubio, Chairman, Planetary Skin Institute and Space Time Ventures Global Agenda Council on the Future of Insurance & Asset Management. Stephen Cross, Chief Innovation Officer, Aon Risk Solutions, Aon World Economic Forum 91-93 route de la Capite CH-1223 Cologny/Geneva Switzerland Tel.: +41 (0)22 869 1212 Fax: +41 (0)22 786 2744 Email: contact@weforum.org www.weforum.org World Economic Forum® © 2016 – All rights reserved. No part of this publication may be reproduced or Transmitted in any form or by any means, including Photocopying and recording, or by any information Storage and retrieval system. REF 050116
- 3. 3Resilience Insights Contents 4 Introduction 5 Resilience Insights 7 Building Resilience to Water Crises 7 Background 9 Recommendations 11 Building Resilience to Large- Scale Involuntary Migration 11 Background 13 Recommendations 14 Building Resilience to Large- Scale Cyberattacks 14 Background 14 Recommendations 18 Conclusion 19 Endnotes 22 Acknowledgements
- 4. Resilience Insights4 For over a decade, the Global Risks Report series has shed light on the increasing interconnectedness and rapidly evolving nature of global risks. As of its 2015 edition, the Report has put forward actionable solutions to address global risks, the scope of which is beyond the domain of just one actor. As global risks are increasingly felt in tangible ways by institutions, economies and people alike, the Global Risks Report 2016 calls for the “Resilience Imperative” – an urgent necessity to find new avenues and additional opportunities to withstand, mitigate, adapt to and build resilience against global risks and threats through collaboration among stakeholders. To inform the debate on how to strengthen resilience against a variety of global risks, the Global Agenda Council on Risk & Resilience has embarked on a series of resilience-use cases with a joint focus on identifying measures that entities of all types and sizes can take to increase resilience and distilling what each stakeholder can bring to the collaboration table. Starting with support for a Forum-led use case on addressing future epidemics1 , published in June 2015, the Council developed “Building Resilience in Nepal through Public-Private Partnerships” in October 2015 and will close the cycle by discussing the need and options for public-private collaboration to strengthen cyber resilience in May 2016. In the following “Resilience Insights”, the Global Agenda Council on Risk & Resilience takes on three of the key findings of the Global Risks Report 2016 by exploring the “how” to build resilience to the “what” discussed in the Report. “Building Resilience to Water Crises” follows up on the Global Risks Report 2016 on “Coping with the Changing Climate”. Today, the world is estimated to be about 1°C warmer, on average, than it was in the 1950s, and adverse effects are starting to be felt across countries, societies, businesses and citizens alike. An average increase of one degree across the planet means significant changes in climatic extremes: the heat is not only melting glaciers and sea ice, it is also shifting precipitation patterns and setting animals on the move. While much hope lies in the historic Paris Agreement adopted on 12 December 2015 at COP21 (the 21st session of the Conference of the Parties, also known as the 2015 Paris Climate Conference), mitigating climate change will have a braking distance of several decades. Climate resilience is, therefore, paramount and water resilience is key to addressing the negative effects of climate change. Against this backdrop, “Building Resilience to Water Crises” takes the discussion further by looking at the challenges posed by the interconnectedness of the risk of water crises with other societal risks and in the face of the water crises risk, how to develop effective water management. It then briefly proposes innovative solutions to build water resilience. Departing from the slow-burning environmental risks, “Building Resilience to Large-Scale Involuntary Migration” addresses the immediate challenges of large-scale involuntary migration explored in the Global Risks Report 2016. With close to 60 million people on the move – or 50% more than during the Second World War – an average displacement duration of 20 years compared with only nine years in the 1980s2 , and migration flows not only crossing borders but also continents, the Global Risks Report 2016 calls for policies that can build resilience to continuing involuntary migration in addition to responding to the immediate crisis. Rather than attempt to address the many components of related resilience given the complexity of the risk, the insights focus in depth on two components of building resilience to large-scale involuntary migration: fostering positive economic impact and refugee integration, outlining possible steps. Introduction “Building Resilience to Large-Scale Cyberattacks” explores the resilience imperative in the era of the Fourth Industrial Revolution. As in 2015, the risk of cyberattacks is considered a high- impact/high likelihood risk in the Global Risks Report 2016, yet somewhat surprisingly other related global risks, such as adverse consequences of technological advances, breakdown of critical information infrastructure and massive incidence of data theft/fraud rank low globally.3 The Global Risks Report 2016, therefore, warns of “the failure to understand the risks related to technology, primarily the systemic cascading effects of cyber risks or the breakdown of critical information infrastructure”, as more organizations digitize their unique business value within increasingly connected environments that rely more and more on machine-learning and automated decision-making. The insights present four areas for decision-makers and risk managers to consider. The recommendations include actions that both nation states and individual entities virtually connected in some way should consider towards building resilience to a persistent and growing risk. Given the complexities of quickly evolving risks within a transformative environment, the pace of change is exceeding the ability of many organizations to develop the risk management and resilience leadership, expertise and processes to confidently adapt to the “new normal”. This document is meant to serve as a companion to the Global Risks Report 2016. The intention of the Global Agenda Council on Risk & Resilience is to ensure that, jointly, these resilience insights can spark a more in-depth discussion about how to best build and strengthen resilience to today’s risks. Identifying and understanding global risks is only the first step; we must work collectively in partnership using all the capabilities and capacities at our mutual disposal to address them.
- 5. 5Resilience Insights Resilience Insights Figure 1: The Global Risks Landscape 2016 3.5 4.0 4.5 5.0 5.5 4.0 4.5 5.0 4.87 average 4.76 average Data fraud or theft Asset bubble Deflation Failure of financial mechanism or institution Failure of critical infrastructure Fiscal crises Unemployment or underemployment Illicit trade Energy price shock Unmanageable inflation Extreme weather events Biodiversity loss and ecosystem collapse Natural catastrophes Man-made environmental catastrophes Failure of national governance Interstate conflict Terrorist attacks State collapse or crisis Weapons of mass destruction Failure of urban planning Food crises Large-scale involuntary migration Profound social instability Spread of infectious diseases Water crises Adverse consequences of technological advances Critical information infrastructure breakdown Cyberattacks Failure of climate-change mitigation and adaptation Source: Global Risks Report 2016 Note: Survey respondents were asked to assess the likelihood and impact of the individual risks on a scale of 1 to 7; 1 representing a risk that is not likely to happen or have impact, and 7 a risk that is very likely to occur and have massive and devastating impacts. See the Global Risks Report 2016, Appendix B, for more details. To ensure legibility, the names of the global risks are abbreviated; see the Global Risks Report 2016, Appendix A, for the full name and description.
- 6. Resilience Insights6 Figure 2: The Global Risks Interconnections Map 2016 State collapse or crisis Unemployment or underemployment Asset bubble Deflation Failure of financial mechanism or institution Failure of critical infrastructure Fiscal crises Illicit trade Energy price shock Unmanageable inflation Extreme weather events Failure of climate-change Biodiversity loss and ecosystem collapse Natural catastrophes Man-made environmental catastrophes Failure of national governance Interstate conflict Terrorist attacks Weapons of mass destruction Failure of urban planning Food crises Large-scale involuntary migration Profound social instability Spread of infectious diseases Water crises Adverse consequences of technological advances Critical information infrastructure breakdown Cyberattacks mitigation and adaptation Data fraud or theft Source: Global Risks Report 2016 Note: Survey respondents were asked to identify between three and six pairs of global risks they believe to be most interconnected. See the Global Risks Report 2016, Appendix B for more details. To ensure legibility, the names of the global risks are abbreviated; see the Global Risks Report, Appendix A for the full name and description.
- 7. 7Resilience Insights Building Resilience to Water Crises Extreme weather events Failure of climate-change Food crises Profound social instability Water crises mitigation and adaptation Background The Global Risks Report 2016 ranks the failure of climate-change mitigation and adaptation as the most impactful global risk and the third most likely to occur, and ranks water crises as the third most impactful and ninth most likely to occur (Figure 1). Over the past decade, the Global Risks Report series has indicated that the perception of the climate change/water risk nexus has risen steadily in terms of likelihood and impact as the connections between economic, environmental and societal risks have become better understood and quantified. The 2016 Report states that the world is witnessing early effects of climate change through higher frequency and higher impact of water shortages and floods demonstrating the connectedness of the environmental and societal risk. Put another way, climate change risk will, in practice, flow through either excess or lack of water with the potential for severe impacts to societies globally. The risk of water crises is also interconnected with the risk of other societal risks such as food crises, profound social instability and large-scale involuntary migration (see Figure 2). This Resilient Insight focuses on building water resilience in the face of the failure of climate-change mitigation and adaptation both to directly address water crises and water insecurity and to help mitigate connected societal risks. It offers insights on water crises challenges illustrating the interconnectedness of water security with other societal risks as demonstrated in Syria, and the challenge of effective and equitable water management as demonstrated in Brazil. Recommendations are then offered on innovations needed to increase water resilience, including a discussion of scaling an effective local water management practice from Japan. Water crises can be understood on a global scale in terms of sea-level rise, climate-change induced flooding and instances of drought events becoming more frequent and impactful, as well as at the local basin level, where water management decisions and water policies are made.4 As such, the opportunities for building water security resilience reside both at the international level and at the national-regional-local basin level. The insights present options for decision-makers around the world to consider short- and long-term water interdependencies, resilience approaches and solutions. Syria: A Case Study in the Interconnections of Water Crises, Food Crises, Profound Social Instability and Large-Scale Involuntary Migration The risk of water crises cannot be viewed in a vacuum and this Syria case study is an example of the interconnectedness of global risks. In fact, the Global Risks Report 2016 shows the interconnection of water crises with other societal risks such as food crises, large-scale involuntary migration and profound social instability (see Figure 2). In 2015, the world watched the confluence of these risks in Syria. Between 2006 and 2011, Syria suffered a severe drought, which had a severe impact on the country’s primary agricultural region in the north-east. Herders in the region lost nearly 85% of their livestock, affecting 1.3 million people.5 Nearly 75% of families that depend on agriculture suffered total crop failure.6 A long legacy of water and agricultural policies, in combination with large government subsidies for water- intensive wheat and cotton farming, encouraged inefficient irrigation techniques and extensive use of groundwater resources.7 When the drought showed no signs of easing, the Syrian government cancelled a number of state subsidies, which increased the price of diesel fuel and fertilizers.8 The drought and the added expense made it no longer possible for farmers, herders and rural families to make a living through agriculture. Many migrated to the cities, putting extra stress on urban infrastructure and basic services, and increasing urban unemployment. Additionally, the reduction of agricultural products led to more than 1 million Syrians experiencing food scarcity or insecurity, and food insecurity along with stress on urban services and unemployment contributed to the tensions that led to public protests against the government, among other factors.9 Although water crises cannot be singled out as a primary determining factor, it is one of many interconnected and compounding risks resulting in additional cascading risks, all evolving into the current crisis. Brazil: A Case Study of the Water- Management Challenge of Multiple Water Realities in One Country The challenges of water-resource management, including aspects of supply, access, distribution and quality, are multidimensional. Rising populations coupled with increasing per capita water consumption will create substantially greater demand for water around the world. Already, there is competition for water from agriculture, industry, energy, human water supply systems and aquatic ecosystems. Climate change will continue to increase the variability of water availability and the timing and intensity of precipitation, and thus the vulnerability of water supplies. Water quality problems associated with pollution, agricultural run-off, eutrophication10 or contamination of fresh, marine and estuarine areas11 present risks to the potability of water and the suitability of instream flows for a wide range of ecosystem services. Moreover, water crosses political and jurisdictional boundaries, which complicates the ability to manage these challenges. The political ability to govern cross-jurisdictional water issues in equitable ways is often limited. As further discussed in the Global Risks Report 2016, more than 60% of the world’s transboundary water basins lack any type of cooperative management framework. Even where such frameworks exist, they often do not cover all states that use the basin.
- 8. Resilience Insights8 Brazil exemplifies the complex challenge of managing water within a country. At first sight, Brazil can be considered water-rich: it has 12% of the planet’s freshwater reserves, mostly in the water-rich Amazon region.12 However, water resources are not distributed evenly throughout the country. The basins next to the Atlantic are utilized by 45.5% of the population but only include 2.7% of Brazil’s water resources. Conversely, only 5% of the population lives in the northern region, but the region holds 81% of Brazil’s water resources.13 In addition, Brazil has conflicting rules about water governance at federal, state and basin levels.14 These policies, coupled with increasing demand and increasing variability of water supply, have left some areas of Brazil (such as the south-east) water-scarce and created “multiple Brazils” in terms of water security. A case in point is that the megacity of São Paulo, which contributes a third of Brazil’s GDP, has a lower water per capita availability than the historically drought-prone north- east.15 Water variability is a major factor in equitable access to water resources in Brazil (see Figures 3 and 4), where variability of precipitation (reduced precipitation, fluctuations in the timing or intensity of precipitation) and urban “heat island” effects create fluctuations in available water resources. Increasing demand and competing uses and priorities compound the challenge. Competition for water resources is not new. Historically, there have been competing uses and competing interests for the instream flows and the human ability to store water. Figure 3: Long-term historical precipitation record in São Paulo (mm) Figure 4: Long-term historical precipitation record in the city of Quixeranobim (NE of Brazil) (mm) 2500 2000 1500 1000 500 0 1940 1936 1945 1950 1955 1960 1965 1970 1975 1980 1985 1990 1995 2000 2005 2010 2014 Annual Precipitation (mm) Trend Line 2500 2000 1500 1000 500 0 1965 1970 1975 1980 1995 2000 2005 2014 2010 1961 Groundwater is another source of freshwater supply but, as seen in the central United States, Russia, India and other places, overuse of groundwater leads to aquifer depletion, and even collapse. In Brazil, for example, hydropower constitutes about 64%16 of the electricity power load, making water supply a national priority for this particular non-consumptive use, which must then be balanced with consumptive and other uses. To complicate this further, major forest land cover change due to an expansion of agriculture and urbanization has both changed the water producer capacity in some basins and reduced the bio-filtration capacity of forest ecosystems resulting in even more pressure on water treatment facilities. Source: Centre for Earth System Science, Brazil, and Planetary Skin Institute
- 9. 9Resilience Insights Recommendations Innovating towards water crises resilience In a world with a changing climate, increasing water demand, increasing competition for water use and increasing societal risk tied to water crises, water resilience policies will be more important than ever to provide equitable access to water for all uses. To mitigate and manage the risks associated with water insecurity now and in the future, decision-makers must build resilience through understanding and managing water intra- and extra-annual variability at the basin level versus traditional approaches that mostly focus on the mean of water scarcity. To help increase resilience to water crises, the Global Agenda Council on Risk & Resilience proposes the following: A. Make decisions based on scientific evidence: Decision- making processes should be evidence-based to strengthen the defensibility of water security decisions. Innovative and technological approaches help to enhance transparency in these decisions, which will elevate trust in the water decisions and policies being made. Transparency and trust, built on a science and evidence basis for water issues, will provide a neutral platform for collaboration among communities, governments and businesses to manage water sustainably. B. Invest in risk understanding: Understanding the effects of water crises in the future will require better ways to understand, model and visualize how and where such crises could occur. Identifying and assessing the interconnections of the water crises risk (as described in the Syria case study above) will directly increase the efficacy of water crises risk management. Many current technical approaches are static, cannot account for basin-level intra- and extra-annual variability, lack geospatial resolution and global coverage, or do not incorporate effective risk analyses. Investments in innovation and technology in improving these technical approaches will start to provide policy-makers, regulators, water managers and practitioners, farmers, resource managers, investors, energy managers, water utility managers and industrial asset operators what they need to make better water-use decisions. These investments will help clarify how and where the next water crisis could occur, and under what assumptions, scenarios and with what impacts. C. Innovate to create new decision- support systems: Managing water resources sustainably will require significant public and private research and development efforts, similar to the Breakthrough Energy Coalition17 announced at COP21 in Paris by governments and businesses. This envisioned Breakthrough Water Risk Coalition would focus on researching and developing the disruptive technologies (e.g., nanosats, autonomous drones, cloud and internet of things) which, coupled with machine learning and artificial intelligence, would create a significant improvement in the dynamic decision support needed by governments, businesses and communities to deal with the complexities and risks associated with the climate-water-energy-food- land nexus. This type of coalition is urgently needed in emerging economies and the broader developing world.18 Improved decision support systems, with appropriate spatial and temporal dimensions, could help to reconcile competitive uses for water at local and regional levels. Advances in decision-support tools could be used in: – Sustainable water-resource management that requires analysis of issues from a range of perspectives to optimize water (re)allocation strategies, reservoir and water transport management, water quality management and sanitation, urban water cascading systems, hydropower systems, energy-generation strategies, demand-side management, water utility leakage detection, informing crop-choice optimization decisions and precision irrigation in agriculture, among many others. – Water-risk management applications to include early warning systems for floods and droughts, for assessing utility of flood infrastructure and drought water storage policies and investments, to improve evacuation strategies, and strategies for minimizing impacts of floods and drought on life, property, and livelihoods. D. Identify effective practices and assess scalability: As discussed above, adaptation to greater fluctuation of precipitation will continue to be a water management challenge. Governments and communities must develop long-term strategies to account for greater fluctuations of precipitation. Decision-makers should consider implementing local effective practices such as Mizu- Bune in Japan (see case study below) that address specific challenges related to water crises. Japan: A Case Study in Local, Cascading Freshwater Using Circular Economy Principles Figure 5 shows the variance of annual precipitation data in Japan for the past 114 years. Japan, being located in the Asia monsoon zone, is not considered water-scarce in an average year. However, starting from the late 1900s, the fluctuation of annual precipitation has been increasing and 1994 marked a record-breaking dry year. One method to address such challenges – Mizu-Bune, a traditional cascading water-use system – is utilized by households in the Japanese city of Gujo. In Gujo, which has a spring water source, households can draw fresh spring water from their backyards. Mizu-Bune then designates sequenced uses for the water. The first uses are for drinking and cooking, then washing vegetables and then dishware. Secondly, the water drains into a lower small basin for the cultivation of carp, which are fed on tiny food debris. Finally, the water is channelled to the Gujo’s waterway network. Rules are applied to keep the Mizu-Bune sustainable (e.g., chlorine bleach is not allowed since it would kill the carp), and good governance for water use is required in each household.
- 10. Resilience Insights10 Figure 5: Variance of annual precipitation of Japan 1900 to 2013 Figure 5: Traditional Household Cascading Water Use System “Mizu-Bune” in Gujo City, Japan 1900 1910 1920 1930 1940 1950 1960 1970 1980 1990 2000 2010 2012 2500 2000 1500 1000 500 0 Source: Ministry of Land, Infrastructure, Transport and Tourism, Japan It is possible to scale up the household cascading to a city-wide, urban area. A cascading urban system would require careful planning to both ensure water quality and to match the demand stemming from the potential energy of water intake with the energy required for pumping. Pervasive real-time monitoring of water quality and quantity would be required to operate a large-scale system. It is possible to do at low cost using inexpensive, connected sensors (internet of things) and by crunching data in real time with the support of artificial intelligence capabilities. Strong governance and rule enforcement would be needed to operate an urban- scale cascading system. Another version of a cascading water system can be found in Tokyo where commuter trains and buses are washed with recycled wastewater. And in summer, pavements in the centre of Tokyo are sprayed with recycled water to ease the heat by evaporation and save energy for air-conditioning. Similar traditional cascading systems can be found in other countries. Instituting a household cascading concept in new urban areas could be one water resilience solution to the challenge of precipitation fluctuation and competition for water use. Drawing by Satoru Nishikawa
- 11. 11Resilience Insights Building Resilience to Large-Scale Involuntary Migration State collapse or crisis Failure of climate-change Failure of national governance Interstate conflict Failure of urban planning Large-scale involuntary migration Profound social instability Water crises Adverse consequences of technological advances mitigation and adaptation Background The Global Risks Report 2016 ranks large-scale, involuntary migration as the most likely risk to occur and the fourth most impactful (See Figure 1).19 The Report shows the risk as having strong connections to profound social instability, interstate conflict with regional consequences, state collapse or crisis as well as the global risks of failure of climate-change mitigation and adaptation and water crises. Given 2016 trends such as rising income and wealth disparity, which strongly interconnect with profound social instability, it is likely that the risk will continue to grow. At the end of 2014, the number of displaced people around the world stood at 59.9 million of which internally displaced people (IDPs) accounted for 60% of all displaced since 2001. What is more, estimates suggest that the average duration of displacement for refugees had lengthened from nine years in the 1980s to 20 years by the mid-2000s.20 Such protracted displacement calls for perceptions of the risk to change from an aid-centric view to a “pragmatic acceptance that displacement will be prolonged, which in turn has led to better appreciation of the factors that have allowed displaced people in some contexts to achieve positive livelihood outcomes”.21 Large-scale involuntary migration poses a range of interconnected political, social, economic and security risks to refugees and internally displaced persons, the countries in which refugees and migrants seek asylum, neighbouring countries and countries further afield. Risks associated with displacement and resettlement include marginalization, increased morbidity and mortality, and community disruption,22 while risks to host societies include costs, social and political polarization and resistance.23 The impacts, particularly in the medium to long term, are often not inherent in involuntary migration itself, but rather stem from the inadequate integration of refugees in the countries in which they seek asylum and the failure to cultivate potential economic benefits. Acknowledging the vastness and complexity of the problem, this insight focuses both on fostering positive economic impact from large-scale involuntary migration and on the importance of refugee integration as a method to build host country and refugee resilience. It aims to inform the search for actionable solutions to involuntary migration while remaining fully cognizant of the fact that not all examples may easily be transferred or adopted in other locations in view of proportionality and the resulting capacity to integrate. For example, a small number of countries host 52% of all IDPs (Syria, Colombia, Iraq and Sudan) and more than 50% of all refugees (Syria, Iran, Pakistan, Lebanon, Turkey, Palestine and Jordan).24 Integrating the large number of refugees into countries such as Lebanon and Turkey will call for policies on a much larger scale than integration into larger countries, such as the US or Germany. Fostering Positive Economic Impact Reframing the discourse surrounding refugees from one of risk to one that recognizes the substantial social and economic contribution they can make to their host societies is increasingly important in light of the current large- scale influx of migrants into Europe. The key policy issue confronting Europe is not whether to accept forced migrants but rather how to turn the associated challenges into opportunities.25 While potential costs to host states from refugee migration are documented, a diverse range of refugee contexts – both camp-based and urban, in low- and high-income countries – demonstrates the potential economic contributions refugees can make to their host societies that help counter and address associated costs. For example, research in Kenya estimates that the total economic benefits of the Dadaab refugee camp and related operations for the host community to be about $14 million annually.26 In Lebanon, where Syrian refugees now comprise over a quarter of the population, the World Bank has indicated that this large influx has positively contributed to both resilience and economic growth.27 Lastly, economic analysis from Cleveland in the United States indicates that in 2012 the economic impact of resettled refugees was approximately $48 million, about 10 times greater than what refugee services agencies spent on refugee services ($4.8 million).28 The literature highlights two particular areas where the current influx of migrants stands to make a positive contribution in advanced economies: population ageing and demographic decline.29 For example, new analysis pertaining to Germany illustrates that, without immigration, labour scarcity and an ageing population will more than halve the country’s economic growth over the next 10 years, potentially jeopardizing social security systems.30 Estimates indicate that Germany will have received over 800,000 asylum- seekers in 2015, although numbers are considered uncertain. If this continues, based on current trends (and assuming related factors do not change), it could potentially halt the decline in economic growth, raise employment levels and stabilize social security systems.31 Deutsche Bank, in a report, avers that the success of the latter scenario hinges on integration because without a large initial investment to support social and economic integration of refugees, a large influx could instead contribute to risks related to job shortages, unemployment and social tensions. To mitigate these risks, the German government has made significant financial investments and introduced policy reforms. These include: cutting the time refugees and asylum-seekers must wait before becoming employed; abolishing the labour market test in
- 12. Resilience Insights12 Table 1: Economic Impact Summary of Refugee and Refugee Services in Cleveland Area (2012) Source: Chmura Economics & Analyitcs Note: The total impact is smaller than the sum of the three components as overlapping impacts were rmoved in aggregation certain circumstances; increasing access to vocational training, internships and educational grants; and providing tailored support to ensure that children and adolescents receive sufficient educational and vocational training to facilitate their integration and ultimate entry into work.32 This is a long-term project. The Deutsche Bank report concludes: “The Herculean task of integrating the refugees must be seen as an investment in the future.”33 This will need to take into account prejudicial attitudes towards refugees, with refugees often being perceived as representing a threat to economic resources and culture in host societies. Refugee Integration State-based and humanitarian responses to large-scale involuntary migration vary widely, from restrictive and segregated camps premised on a “care and maintenance” model to responses in which refugees are afforded full rights and freedoms and extensive efforts are made to integrate them into the host society. In recent years, many states and NGOs have adapted their strategies as the majority of refugees now live in urban areas and response mechanisms based on camp models are increasingly outdated. Clear examples of good practice emerge from analysis of these different approaches, and the following examples highlight the benefits of effective integration and the mechanisms for managing the integration of involuntary migrants in ways that support the resilience34 of – and generate tangible benefits for – both refugees and host communities. As a specific example of the benefits of integration, research with refugees in Uganda demonstrates that they contribute to the national economy, are economically diverse and are consumers and creators of technology.35 These contributions are made possible, in part, by Uganda’s relatively open policies towards refugees (for instance, refugees have the right to work), which represent longstanding strategic efforts on the part of the Ugandan government to facilitate refugee self-reliance.36 Such policies are in stark contrast to those of many host states, which restrict refugee participation in the labour market. Failure to integrate refugees into the labour market can have negative economic consequences for the state, as refugees – unable to support themselves – rely heavily on public services. Recognizing the potential benefits of large-scale involuntary migration however does not mean ignoring the challenges. In a resettlement context, both refugees and host communities may struggle to manage the mental and physical health problems often associated with the trauma refugees experienced37 ; to effectively account for significant differences in skills, education and capabilities among individual refugees; and address a mismatch between refugees’ skills and education and the labour needs of the host country. While refugees have been said to present “perhaps the maximum example of the human capacity to survive despite the greatest of losses and assaults on human identity and dignity”38 , they face numerous obstacles to achieving resilience in their country of asylum, including language barriers, racism and discrimination.39 These factors are closely linked to integration, a subjective concept used, in the context of involuntary migration and resettlement, to denote the process through which refugees and host communities facilitate the inclusion and incorporation of refugees in various spheres of life in their country of asylum. Integration poses an array of challenges, risks and opportunities and a comprehensive approach is required. Research on the integration of refugees has identified four key aspects40 : foundations (rights and citizenship); facilitators (language and cultural knowledge, safety and stability); social connections (social bridges, bonds and links); and means and markers (employment, housing, education and health). The extent to which refugees have access to formal, structured programmes (such as vocational and language training) to facilitate their integration is affected by both the policies of the country of asylum and the process through which refugees enter and settle (e.g. as asylum-seekers, those seeking family reunification, Direct Indirect Induced Total Refugee Service Organization Spending (Millions) $4.4 $0.4 $1.7 $6.6 Employment 95 3 14 112 Refugee Household Spending Spending (Millions) $22.2 $5.2 $5.9 $33.3 Employment 291 40 55 386 Refugee-owned Businesses Spending (Millions) $7.6 $2.0 $2.4 $12.0 Employment 141 15 19 175 Total Spending (Millions) $33.4 $7.6 $7.0 $48.0 Employment 526 58 65 650
- 13. 13Resilience Insights unaccompanied or separated children, government-sponsored resettled refugees or self-settled or dispersed). Refugees in EU countries have identified issues that affected – and in many instances inhibited – their integration, including delays in their initial reception, racism (on both an individual and institutional level), social class, culture, employment, age and personality, lack of information and differing welfare systems and approaches.41 Yet examples of good practice exist. One study on state-assisted integration in Scandinavian states found that refugees and asylum-seekers given immediate access to employment, housing, education and language training achieved greater integration, with attendant positive outcomes.42 Beyond the provision of essential services and programmes to strengthen refugees’ human capital, moderate forms of affirmative action to support refugees (as those mainstreamed in the United States and Canada) can help them integrate into the labour market.43 Public-private partnerships are another example of initiatives that can support refugee resettlement and integration. Specific examples include the long- standing Canadian Private Sponsorship of Refugees Program, which enables organizations and groups of citizens to sponsor the resettlement of refugees and support their social and economic integration.44 Such programmes reduce government expenditure and enable a larger number of refugees to be resettled, and have been shown to facilitate positive outcomes (such as self-sufficiency) for refugees and host countries. In some instances, integration can have relatively quick and highly successful outcomes for refugees and their host country (a prominent example is refugee Ahmed Hussen, who recently made history by becoming Canada’s first Somali-born member of parliament).45 In other instances, successful integration is evident on a regional level. A recent study from Nhill, a small town in Australia, describes the positive socio- economic impact of Karen refugees from Myanmar who have resettled there over the past five years.46 Numerous factors contributed to the success of the Karens’ economic integration: Nhill had a declining population, low unemployment and gaps in the labour market to fill (in particular, to support the largest local commercial business). The economic impact of the increased labour supply provided by the Karen refugees, assessed as gross regional product (as modelled by Deloitte Access Economics), has been estimated at A$41.5 million (US$30 million). The chief executive of the municipality council described the social impact as “extraordinary”.47 In Nhill, the needs and support mechanisms of the host community are well aligned with the needs and capabilities of the refugees who have resettled there.48 While state policy sets the framework for refugee integration, the degree to which it is successful often depends on the socio-economic context of the host country, the receptivity of host communities and, of course, the refugees themselves. Refugees are not homogenous – they represent a diverse range of skills, abilities, personalities, demographics and vulnerabilities. Nor are the countries in which they seek asylum, which have different cultures and social, economic and political structures. The extent to which refugees can be successfully integrated into host countries depends, in large part, on the convergence of these factors. Recommendations While the discourse surrounding involuntary migration overwhelmingly focuses on risks, portraying refugees both as a burden and a threat, a growing body of evidence demonstrates how host countries can increase resilience to large-scale involuntary migration by taking steps to foster refugees’ economic contributions and integrate them into their host societies. With sufficient support and investment, refugees can make substantial social and economic contributions to their host societies. To help foster positive outcomes of involuntary migration, the Global Agenda Council on Risk & Resilience recommends the following: A. Change the narrative on refugees’ impact in host countries: Active steps should be taken to reframe the discourse on refugees from one of risk to one that also recognizes the substantial social and economic contribution they can make to their host societies. The importance of increasing resilience by conceptualizing support for refugees, particularly support for integration, as an investment for tomorrow, rather than as a cost for today (or, for that matter, a form of charity), cannot be overemphasized, as citizens, confronted by conflict and persecution, will continue to flee their homes, and the unprecedented rate at which they are doing so poses critical challenges and risks to even the most socially and economically stable host countries. B. Invest early in facilitating social and economic integration: Host countries should reform social policies and make financial investments to make it easier for refugees and asylum-seekers to seek employment and access training and education. Positive resilience outcomes for refugees are inevitably linked to conducive institutional frameworks and investment in the resources required to support the integration of refugees and address and minimize the initial barriers they face. Strategies need to focus on ensuring that sufficient financial, social and policy/political support are available to facilitate refugees’ safe and dignified arrival and integration, enabling them to harness their skills and potential and become contributing members of the countries in which they seek asylum. C. Foster public–private partnerships to support refugees’ integration into society: Public-private partnerships are critical to facilitate refugees’ entry into the labour market and help mitigate risks related to job shortages, unemployment and social tensions. This includes developing initiatives to cut the time refugees and asylum-seekers must wait before becoming employed; increasing access to vocational training, internships and educational grants; and providing tailored support to ensure that children and adolescents receive sufficient educational and vocational training to facilitate their integration and ultimate entry into work.
- 14. Resilience Insights14 Building Resilience to Large-Scale Cyberattacks State collapse or crisis Unemployment or underemployment Interstate conflict Terrorist attacks Weapons of mass destruction Adverse consequences of technological advances Critical information infrastructure breakdown Cyberattacks Data fraud or theft Background As the Fourth Industrial Revolution unfolds, the pace of technological innovation also brings with it new vulnerabilities (see the Global Risks Report 2016 for a detailed discussion). When these vulnerabilities are combined with increasing global digital connectivity, cyber systems and networks and the data they hold become more attractive targets for criminals, entities conducting industrial espionage, so-called hacktivists and even nation states. The Global Risks Report 2016 ranks large-scale cyberattacks as the eleventh most impactful and likely global risk. “Cyberattacks have been rated among the most likely and most potentially impactful risks for many years and cases have been rising in both frequency and scale.” In fact, the results of the Executive Opinion Survey49 , which is analyzed as part of the Report, indicate that a cyberattack is perceived as the highest concern for doing business in eight economies – Estonia, Germany, the Netherlands, Japan, Malaysia, the United States, Singapore and Switzerland—and among the top three risks for doing business in 18 economies. Incredible advances in technology are unleashing massive economic and societal disruption. A recent study suggests that “internet-related technologies such as the mobile internet, automation of knowledge work, the Internet of Things and cloud technology will be the most disruptive”.50 While this innovation will result in new efficiencies and capabilities, it will also introduce new vulnerabilities, allowing attackers to quickly evolve their tactics and exploit unaddressed system and network weaknesses. Further compounding the risk is today’s hyperconnected global environment, where people and things, critical infrastructures and economies are increasingly digitally connected – anytime and anywhere. According to this year’s Global Risks Report 2016, “As the Internet of Things leads to more connections between people and machines, cyber dependency due to increasing digital interconnection of people, things and organizations – considered by survey respondents as the third most important global trend – will increase.”51 This hyperconnectivity ties the risk of one entity to all entities with which it shares a connection, thereby multiplying the ways through which an attacker could gain access to systems and data. Similarly, it increases the potential for cascading consequences resulting from a cyberattack or cyber disruption. Although many entities are poised to reap the benefits of technological advances, they must also be prepared to address the accompanying new vulnerabilities and risk consequences of technology utilization and integration. As stated in the Report, “Organizations may recognize the benefit of cyber technologies on their bottom lines, without fully internalizing how to improve resilience and invest accordingly.” If enterprises are to thrive in the midst of rapid transformation, they will need to acknowledge that cyberattacks will occur and focus on building the core competencies to increase their resilience to withstand and to effectively respond to them. “Resilience, not just bigger locks, is the goal; accepting that failures will occur, the objective is to restore normal operations and ensure that assets and reputations are protected”.52 Cyber resilience is herein defined as the ability of complex cyber systems to continuously deliver the intended outcome despite ongoing shocks and acute stressors. Cyber resilience can be assessed by understanding capacities and capabilities for readiness, response, reconstitution and reinvention. Building resilience to large-scale cyberattacks requires a concerted effort towards advancing the understanding of and the disciplines that contribute to cyber resilience. This section posits a number of suggestions on how to improve the cyber resilience of organizations. Some require action by governments and some can be taken by all entities – public or private/big or small. Recommendations A. Increase Understanding of Risk of Large-Scale Cyberattacks and other Cyber Threats As described above, it is clear that the dramatic pace of technological innovation today, coupled with widespread global connectivity and vast amounts of data creation, have resulted in increasing risk to cyber assets and online networks. The risk of large-scale cyberattacks continues to feature as a high impact/high likelihood risk in the Global Risks Landscape 2016 (Figure 1) – although overshadowed by environmental and societal risks. However, it is worth noting that the overall perception of the significance of large-scale cyberattacks and a closely connected risk, the breakdown of critical infrastructure information and networks, have both declined in recent years. In fact, the latter risk, together with another technological risk, the adverse consequences of technological advances, are considered among the least likely global risks to occur after unmanageable inflation, weapons of mass destruction and the rapid and massive spread of infectious diseases. In addition, despite the reported costs of recent cyber incidents- cyber crimes, for example, cost the global economy an estimated US$445 billion, higher than many economies’ national incomes53 – the risk of data theft and fraud, although considered of similar likelihood to cyberattacks, continues to rank well below average in terms of impact. Given the close interconnections between large-scale cyberattacks and data theft/fraud (both ranked likely) and the breakdown of critical infrastructure information and adverse consequences of technological advances (Figure 2), it is also surprising that the latter two risks
- 15. 15Resilience Insights are ranked relatively unlikely. Awareness of the systemic impact of the former two risks on the latter two (despite the perception of their interconnectedness) seems to not yet fully be understood by respondents. However, as the Fourth Industrial Revolution unfolds, the probability of a systemic risk triggered either by cyberattacks or data theft/ fraud or both is likely to increase. Collectively, these perceptions seem to fly in the face of all the available public evidence that cyber risk and its impact is on a steep climb (see the Global Risks Report 2016 for a detailed discussion). The gap between the reality and perception of cyber risk has been explained in other studies54 , where it has been suggested that entitles struggle to fully understand the risks involved, predominantly as this is an area where there is typically no single corporate owner. Other factors, such as the quickly evolving nature of the threat and the difficulty in quantifying cyber risk,55 compound the problem. As a foundational step towards resilience, the Global Agenda Council on Risk & Resilience encourages entities of all sizes and types to consider the following activities to deepen their understanding of the enterprise risk they face: – Cyber risks should be integrated into the assessment of the overall critical risks to the organization. Enterprise risk assessments should be flexible and allow for frequent updates to reflect the evolving nature of cyber risk and the pace of development in the online environment. Specifically, as part of risk-management processes, business-impact assessments should identify critical cyber assets, systems, networks and the virtual location of critical information. Questions such as “How bad? How long?” referencing possible business disruptions should be included to determine holistic impacts. – Cybersecurity risk assessments should examine the extent to which vulnerabilities may be introduced into networks and systems through connections with third parties. Supply chains, in particular those for critical parts, components and IT services, should be examined as part of the comprehensive risk assessment and, where possible, suppliers’ suppliers should be identified. – Specific risks to the confidentiality, availability and integrity of critical information should be identified and included in enterprise risk assessments. Consideration should be given to the consequences to the organization’s reputation, stakeholder trust, and business continuity. – Activities and programmes to address cyber risks, including their causes and effects and their impacts on the resilience of the organization, should be mapped to organizational structures so related roles and responsibilities are clear. Given the risk complexity and potential impacts, senior leaders should have specific roles in cyber risk management and managing these risks should specifically be incorporated into board of directors’ risk and audit committee governance responsibilities. Consideration should be given to the dependencies and co- dependencies that exist within the organization as part of the mapping process. Conducting cyberattack exercises can be an efficient way of verifying the effectiveness of planned roles and responsibilities. B. Harmonize Government Action: Need for Agreement on Rules of Behaviour and Promotion of Risk- Based Regulations Governments today are active players in working to address cyber risks as regulators and legislators. In fact, over half of all United Nations members have in place, or are in the process of adopting, cybersecurity-related laws and regulations. Unfortunately, often such legislative activity is not aligned with related activities in other countries. As a result, a patchwork of rules and regulations is emerging – creating compliance uncertainty for international entities and the potential for conflicting or overlapping legal obligations. Developments such as the European Union’s recently reached consensus on the Network and Information Security Directive56 are to applauded as important steps towards harmonizing the approaches of its 28 member states. However, member states will be required to identify the implementation scope leaving room for the potential for overlapping or conflicting regulations within the EU. Also, given the nature of the risk and the highly networked risk environment, it is extremely difficult for bureaucratic consensus-driven processes to effectively match the pace of the threats. “[T]here is growing awareness that policies designed as a solution to one particular problem can frequently have unintended consequences elsewhere, e.g., on privacy, innovation or even existing and commonly accepted business practices.”57 Regulations should therefore encourage greater resilience investments and foster adaptive approaches to risk management recognizing that compliance requirements defined by today’s risks alone will not mean that security has been achieved. In the specific European example, contrary to its intent, it is possible that the resulting implementation could result in an assortment of member state requirements that increase costs and have marginal impacts on cybersecurity by diverting resources to compliance activities rather than resilience investments. National regulations should also be risk-based, recognizing that all entities and the services they provide are not created equally and, therefore, are not faced with the same risks. The security required for social media platforms should not be equated to the security required for electric grid supervisory control systems. Compliance-based regulations that focus on reporting requirements cannot alone address the nuances of the cyber risk to different types of entities. Finally, as nation states continue to develop capabilities to protect their national interests, international norms of behaviour must be developed. A 2011 study by the United Nations Institute for Disarmament Research (UNIDIR) identified 33 nation states that include cyber warfare in their military planning and organization, including “the use of cyber capabilities for reconnaissance, information operations, the disruption of critical networks and services, for cyberattacks, and as a complement to electronic warfare and information operations.”58 The number has only
- 16. Resilience Insights16 increased since. Without agreement on norms governing nation state offensive use of cyber capabilities, threat models used by the private sector will continue to be distorted, having to consider the current unpredictability of when and how a nation state might offensively use a cyber capability and against what targets. To help address these concerns, the Global Agenda Council on Risk & Resilience recommends the following: – Enterprises should leverage International standards, contracts and service level agreements to proactively reduce cyber risks. For example, originally developed for US entities, the US Cybersecurity Framework59 , a voluntary how-to guide gathering existing global standards and practices to help organizations understand, communicate and manage their cyber risks, could serve as a foundation for international harmonization of rapidly expanding cybersecurity requirements to focus efforts on improving cyber resilience. To this end, we recommend that the US Department of Commerce submit the Framework into the international standards development process. To harmonize security requirements and improve risk management and resilience, EU member states should look to the Framework as a basis for implementing the Network and Information Security Directive and/or seek to build a public-private partnership to build baseline cybersecurity requirements that are both risk-based and rooted in international standards. – The United Nations Secretary- General should consider expanding the UN Group of Governmental Experts (UNGGE) beyond the current 15 participating countries. As referenced above, the number of states active in cyberspace is much greater and it is vital that a consistent approach emerge to enable effective entity risk management. – National legislatures and the United Nations should include and consider input on their proposals on cybersecurity norms and rules from private sector owners and operators of critical infrastructure, as well as the information and communications technology vendors that make the products that are exploited. This outreach will help to ensure that proposed rules and regulations account for both private sector operational realities and product and service capabilities and limitations. – Comprehensive political and technical norms should be developed to effectively manage the risk of offensive government action in cyberspace, and to that end a venue for public-private collaboration needs to be established. The G20 agreement on a cyber norm denouncing the theft of intellectual property for commercial gain can serve as a model for the establishment of additional cybersecurity norms.60 Cybersecurity norms must be sufficiently detailed to ensure the security, stability and transparency needed to support the resilience of the global online environment. C. Implementing and Updating “Basic Cybersecurity Hygiene While the risk is complex, studies have shown that adopting low-cost mitigation strategies can disproportionately decrease the impact of cyberattacks. In fact, according to the Australian Department of Defense, at least 85% of the targeted cyber intrusions that the Australian Signals Directorate responds to could be prevented by following a few simple mitigation strategies.61 Similarly, a coalition of cybersecurity organizations has posited that pursuing a small number of relatively easy and inexpensive mitigation steps can prevent 80% of attacks by hackers who are attempting to infiltrate a computer system.62 Such basic cybersecurity hygiene actions can be implemented in organizations through a minimum security baseline – a minimally acceptable security standard, which has been designed to ensure that an organization has implemented basic security measures to reduce the risk of unauthorized access to information technology resources and data. These baseline measures are often quite simple to implement and, despite the increase in technology adoption and connectedness and the resulting multitude of attack surfaces, have not changed much in the past decades. The Global Agenda Council on Risk & Resilience recommends that organizations: – Establish minimum security baselines. Different groups of computer security experts have slightly different lists63 , but they generally overlap. These can include protocols for security patches, disabling unnecessary services, or desktop hygiene standards. These recommendations help organizations ride out cyber shocks, but as more organizations implement them, they will also act as systemic dampeners, potentially reducing the magnitude of shocks. – Clarify roles and responsibilities for supporting a security baseline. If there is no central group responsible for cyber security (assets, systems, networks and stored information), one should be established with adequate authority and resources. ALL employees should be trained on basic security procedures- anyone connected to an entity’s network could inadvertently serve as the weakest link. – Implement continuous security monitoring and to update baseline security measures as needed. As threats are changing constantly, the resilience strategy should recognize the need for continuously monitoring the security of systems, data and infrastructure. Such investments yield greater resilience dividends than audits and paper- based compliance checks based on static risks. D. Increasing Effective Information- Sharing It is often said that information is power. This is particularly true in a world that moves at internet speed. Receiving the right information at the right time can empower decision-makers to stop cyberattacks in progress, mitigate potential losses and enhance overall
- 17. 17Resilience Insights cyber resilience. Early warning and the sharing of relevant mitigation measures can mean the difference between business continuity and widespread business devastation. The benefits of information-sharing are even greater, when multiple-sharing partners operate on the same networks or operating systems and face similar vulnerabilities, or are part of the same critical infrastructure sector or geographical region. To increase cyber resilience, the focus of information-sharing should be on actionable threat, vulnerability and mitigation information, which can immediately improve cybersecurity and help create better outcomes for the ecosystem in general. To encourage effective information sharing, the Global Agenda Council on Risk & Resilience recommends the following: – Entities develop an overarching strategy for information-sharing and collaboration with stakeholders to increase support for sharing efforts within and outside the organization. – Trusted communities be established to share threat information and information on solutions to emerging vulnerabilities. Examples of successful information sharing partnership are the Information Sharing and Analysis Centers64 , established in the United States. – Full use be made of the information shared by conducting analyses on long-term trends. A greater understanding of the root causes of cybersecurity incidents can help to prevent future incidents. – Cyber threats occur at machine speed; so too should information- sharing. Information-sharing processes must move towards automated information-sharing for cybersecurity information awareness, real-time network defence and sophisticated threat analysis. Efforts to automate and structure operational cybersecurity information-sharing techniques, such as those by the US Department of Homeland Security and US-CERT65 , should be enhanced and expanded.
- 18. Resilience Insights18 In the three Resilience Insights explored above, the Global Agenda Council on Risk & Resilience has followed up on the call of this year’s Global Risks Report 2016 to move from risk identification to a discussion on how we as a global community can actively build resilience together to the most prominent global risks constellations. As global risks are becoming more imminent and being felt by people, economies and institutions alike, further discussion is urgently needed on how to build water resilience, societal resilience and cyber resilience. It is our hope that the Resilience Insights can serve as a starting point and inspiration for discussion on how this can best be done. In the course of early 2016, the Global Agenda Council on Risk & Resilience welcomes input as we further examine specific actions and steps that need to be taken to design and ensure cyber resilience. Finally, as discussed in the Global Risks Report 2016, the Council encourages all entities to create a culture of integrated risk Conclusion management and multistakeholder partnerships, recognizing that today’s global risks know no geographical, industry or governmental boundaries. Further information about the Global Agenda Council on Risk & Resilience can be found at http://www.weforum. org/content/global-agenda-council-risk- resilience-2014-2016-0
- 19. 19Resilience Insights Endnotes 1 ”Managing the Risk and Impact of Future Epidemics: Options for Public-Private Cooperation” was published in June 2015. 2 Loescher G. and J. Milner. 2011. 3 They are, however, considered high concern in business executives in advanced economies, such as in Germany, Japan, Switzerland and the US. For more information, see Global Risks Report 2016. 4 Other recent crises are the California drought, the 2008 Russian Heatwave or the 2012 US Midwest Drought. See the Global Risks Report 2016. 5 United Nations 2010. 6 Erian et al. 2010. 7 Femia and Werrell 2012. 8 Châtel 2014. 9 Kelley et al. 2014. 10 Eutrophication is the ecosystem’s response to the addition of artificial or natural nutrients, mainly phosphates, through detergents, fertilizers or sewage, to an aquatic system. One example is the “bloom” or great increase of phytoplankton in a water body as a response to increased levels of nutrients. Negative environmental effects include hypoxia, the depletion of oxygen in the water, which may kill aquatic animals. 11 An estuary is a partly enclosed coastal body of brackish water with one or more rivers or streams flowing into it, and with a free connection to the open sea. Estuaries form a transition zone between river environments and maritime environments. 12 OECD (2015), Governança dos Recursos Hídricos no Brasil, OECD Publishing, Paris. http://dx.doi.org/10.1787/9789264238169-pt 13 National Water Agency (ANA), 2015. Cojuntura dos Recursos Hídricos no Brasil 2014. ISBN: 978-85-8210-028-8 14 OECD 2015. 15 National Water Agency (ANA), 2015. Cojuntura dos Recursos Hídricos no Brasil 2014. ISBN: 978-85-8210-028-8 16 Energy Research Corporation (EPE), 2014. Ministry of Energy & Mines, Federative Republic of Brazil. Plano Decenal de Expansao de Energia 2023. 17 http://www.breakthroughenergycoalition.com/en/index.html 18 https://agenda.weforum.org/2015/09/how-can-we-better-manage-our-planets- water-supply/ 19 The Global Risks Report 2016 notes that in the context of the discussion on migration and refugees, it is crucial to differentiate between voluntary and involuntary migration and also the drivers of migration flows. In the context of this discussion, this Resilience Insight follows the Global Risks Report 2016 and discusses large- scale involuntary migration as defined by the Report. 20 Loescher G. and J. Milner. 2011. Note that the study does not include internally displaced people. 21 Crawford et al. 2015. 22 Cernea, 2002. 23 Public and political attention has also focused on the risks posed by refugees (i.e. the possibility that they may be terrorists looking for safe haven and/or desire to harm the host country). 24 Crawford et al. 2015. 25 Bodewig 2015. 26 Cohen and Barrett, 2010. 27 Cali et al., 2015. 28 Chmura Economics & Analytics, 2013:4. 29 Bodewig 2015. 30 Deutsche Bank, 2015. 31 Deutsche Bank, 2015. 32 Bundesministerium für Wirtschaft und Energie, 2015. 33 Deutsche Bank, 2015: 21. 34 In this analysis, resilience in the context of host countries entails their ability to mitigate social and economic risks associated with migration, while leveraging potential benefits. 35 Betts et al., 2014. 36 UNHCR Uganda 1999. 37 McKeary and Newbold, 2010. 38 Muecke, 1992: 521 39 Hutchenson, 2012. 40 Ager and Strang, 2008. 41 Mestheneos and Ioannidi, 2002 42 Valenta and Bunar, 2010. 43 Valenta and Bunar, 2010. 44 Similarly, the refugee resettlement programme in the US is “a longstanding public- private partnership, with government funding augmented by the private resources of both faith-based and non-sectarian agencies” (Refugee Council USA, 2015). 45 Al-Harbi, 2015. 46 Ames and Deloitte, 2015. 47 Ames and Deloitte, 2015. 48 According to Ames and Deloitte (2015), while employment was a necessary factor facilitating the resettlement of the Karen, numerous other factors were important in supporting its successful outcome, including: “strong leadership in the host community, a host community which is well-prepared for the new settlers, initial accommodation for the new arrivals, support for the new families, management of the degree and complexity of ‘cultural adjustment’ on both sides, strong leadership in the settling community, potential settlers prepared for the new environment”. (p.4) 49 Every year since 1979, the World Economic Forum has conducted its Executive Opinion Survey (EOS). Capturing executives’ perspectives on a broad range of socio-economic issues, the EOS primarily informs the World Economic Forum’s annual Global Competitiveness Report and its derivatives. The 2015 edition of the EOS, conducted between February and June 2015, surveyed over 13,000 executives in 140 economies. EOS respondents were asked to select the five global risks that they were most concerned about for doing business in their country within the next 10 years, choosing from the set of 28 global risks presented in the Global Risks 2015 report. 50 Manyika, J., M. Chui, J. Bughin, R., Dobbs, P. Bisson, and A. Marrs. 2013. Disruptive Technologies: Advances that Will Transform Life, Business and the Global Economy. McKinsey Global Institute, McKinsey & Company. 51 World Economic Forum, 2016. Global Risks Perception Survey 2015 52 World Economic Forum. Partnering for Cyber Resilience, 2012, http://www3. weforum.org/docs/WEF_IT_PartneringCyberResilience_Guidelines_2012.pdf 53 World Economic Forum Global Risks 2016; See McAfee, Inc. 2014. Net Losses: Estimating the Global Cost of Cybercrime. Center for Strategic and International Studies, June. Santa Clara, CA: McAfee, Inc. http://www.mcafee.com/us/resources/ reports/rp-economic-impact-cybercrime2.pdf 54 For example, Aon Underrated Threats Report, 2015 http://www.aon. com/2015GlobalRisk/2015-underrated-threats.jsp 55 World Economic Forum Partnering for Cyber Resilience: Towards the Quantification of Cyber Threats, 2015 56 http://europa.eu/rapid/press-release_STATEMENT-14-68_en.htm As of the writing of this document, the full approved text had not been released. 57 World Economic Forum, Risk and Responsibility in a Hyperconnected World 58 Cybersecurity and Cyber warfare – Preliminary Assessment of National Doctrine
- 20. Resilience Insights20 and Organization, Center for Strategic and International Studies for UNIDIR, 2011 aka.ms/CSIS-CyberConflict 59 For related information, http://www.nist.gov/cyberframework/ 60 G20 nations reach economic cyber-espionage pledge, Lexology, November 2015, http://www.lexology.com/library/detail.aspx?g=a0b44ec5-1ee3-40e5-bc99- 4a9db05e7f65 61 http://www.asd.gov.au/infosec/mitigationstrategies.htm The strategies are: use of application white-listing; patching applications and operating system vulnerabilities; and restriction of administrative privileges to operating systems and applications based on user duties. 62 The Center for Internet Security and the Council on Cybersecurity, working with the US Department of Homeland Security, the National Governors Association and the Governors Homeland Security Advisors Council launched the Cyber Hygiene Campaign in April 2014. The five steps are: inventory authorized and unauthorized devices; inventory authorized and unauthorized software; develop and manage secure configurations for all devices; conduct continuous (automated) vulnerability assessment and remediation; and actively manage and control the use of administrative privileges. 63 Example lists in addition to those cited above include those published by the Council on Cybersecurity Critical Security Controls or the UK Government Cyber Essentials Scheme. 64 For example, members of the Financial Services Information Sharing and Analysis Center (FS-ISAC) worldwide receive timely notification and authoritative information specifically designed to help protect critical systems and assets from physical and cyber security threats. 65 For a description of DHS efforts, see https://www.us-cert.gov/Information- Sharing-Specifications-Cybersecurity
- 21. 21Resilience Insights References Ager, A. and A. Strang. 2008. “Understanding Integration: A Conceptual Framework.” Journal of Refugee Studies, 21(2), pp.166-191 – http://jrs. oxfordjournals.org/cgi/doi/10.1093/jrs/fen016 Al-Harbi, F. 2015. “From Somali refugee to Canadian MP.” Al Jazeera 19 November 2015 – http://www.aljazeera.com/news/2015/11/somali-refugee-canadian- mp-151119033540335.html Ames and Deloitte, 2015. “Small towns big returns: Economic and social impact of the Karen resettlement in Nhill” http://www2.deloitte.com/content/dam/Deloitte/ au/Documents/Economics/deloitte-au-economics-small-towns-big-returns-nhill- resettlement-270415.pdf Betts, A., Bloom, L., Kaplan, J. and Omata, N., 2014. Refugee Economies: Rethinking Popular Assumptions – http://www.rsc.ox.ac.uk/files/publications/other/ refugee-economies-2014.pdf Bodewig, C. 2015. Is the Refugee Crisis an opportunity for an ageing Europe? Blog. Brookings Institution, 21 September – http://www.brookings.edu/blogs/future- development/posts/2015/09/21-refugee-demographics-europe-bodewig Cali, M., Harake, W., Hassan, F. & Struck, C. 2015. The impact of the Syrian conflict on Lebanese trade – http://www-wds.worldbank.org/external/default/ WDSContentServer/WDSP/IB/2015/04/28/090224b082e14021/1_0/Rendered/ PDF/The0impact0of00ct0on0Lebanese0trade.pdf Cernea, M. 2002. Impoverishment Risks and Reconstruction: A Model for Population Displacement and Resettlement. In M. Cernea & C. McDowell, eds. Risks and Reconstruction Experiences of Resettlers and Refugees. The World Bank – http://www.researchgate.net/profile/Michael_Cernea/publication/262688048_ Impoverishment_Risks_and_Reconstruction_A_Model_for_Population_ Displacement_and_Resettlement_(2002)/links/0f317538787f1b9c60000000.pdf Châtel, Francesca de. 2014. The role of drought and climate change in the Syrian uprising: untangling the triggers of the revolution. In: Middle Eastern Studies 50:4, pp. 521-535. Chmura Economics & Analytics, 2013. Economic Impact of Refugees in the Cleveland Area – http://www.hias.org/sites/default/files/clevelandrefugeeeconomic- impact.pdf Cohen, E. and J.L. Barrett, 2010. In search of protection and livelihoods: Socio-economic and environmental impacts of Dadaab refugee camps on host communities – http://reliefweb.int/sites/reliefweb.int/files/resources/ C477129C7D41DCFB852577B3006B2818-Full_Report.pdf Crawford, N., J. Cosgrave, S.Haysom and N. Walicki Protracted displacement: uncertain paths to self-reliance in exile. HPG Commissioned Report. London: Overseas Development Institute. September 2015. http://www.odi.org/sites/odi.org. uk/files/odi-assets/publications-opinion-files/9851.pdf Deutsche Bank, 2015. Influx of refugees: An opportunity for Germany – http://www. dbresearch.com/PROD/DBR_INTERNET_EN-PROD/PROD0000000000365616.pdf Erian, Wadid; Bassem Katlan and Ouldbdey Babah 2010: Global assessment report on Disaster Risk Reduction: drought vulnerability in the Arab region. Special case study: Syria. Geneva: UNISDR. EC (European Commission) 2014. The EP successfully votes through the Network & Information Security (NIS) directive. http://europa.eu/rapid/press-release_ STATEMENT-14-68_en.htm Femia, F. and C. Werrell. 2012: Syria: Climate change, drought and social unrest. Retrieved 18 February 2015 – http://climateandsecurity.org/2012/02/29/syria- climate-change-drought-and-social-unrest/ Hutchinson, M. and P. Dorsett, 2012. What does the literature say about resilience in refugee people? Implications for practice. Journal of Social Inclusion, 3(2), pp.55-78 – https://www104.griffith.edu.au/index.php/inclusion/article/view/206/180 Kelley, Colin P.; Shahrzad Mohtadi; Mark A. Cane; Richard Seager and Yochanan Kushnir 2014: Climate change in the Fertile Crescent and implications of the recent Syrian drought. In: Proceedings of the National Academy of Sciences of the United States of America 112:11, pp. 3241-3246 Loescher G. and J. Milner. 2011. «Responding to Protracted Refugee Situations: Lessons from a Decade of Discussion». Forced Migration Policy Briefing 6. Refugee Studies Centre. January. Manyika, J., M. Chui, J. Bughin, R., Dobbs, P. Bisson, and A. Marrs. 2013. Disruptive Technologies: Advances that Will Transform Life, Business, and the Global Economy. McKinsey Global Institute, McKinsey & Company McAfee, Inc. 2014. Net Losses: Estimating the Global Cost of Cybercrime. Center for Strategic and International Studies, June. Santa Clara, CA: McAfee, http://www. mcafee.com/us/resources/reports/rp-economic-impact-cybercrime2.pdf McKeary, M., and B. Newbold, 2010. Barriers to care: The challenges for Canadian refugees and their healthcare providers. Journal of Refugee Studies, 23(4), 523-545. doi:10.1093/jrs/feq038 Mestheneos, E. and E. Ioannidi, 2002. Obstacles to refugee integration in the European Union member states. Journal of Refugee Studies, 15(3), pp.304–320. doi: 10.1093/jrs/15.3.304 Muecke, M. 1992. New paradigms for refugee health problems. Social Science & Medicine, 35(4). Retrieved from http://www.sciencedirect.com/science/article/ pii/027795369290344P National Institute of Standards and Technology. 2015. Cyber security framework. http://www.nist.gov/cyberframework/ National Water Agency (ANA), 2015. Cojuntura dos Recursos Hídricos no Brasil 2014. ISBN: 978-85-8210-028-8 OECD (Organisation for Economic Co-operation and Development). 2015. Governança dos Recursos Hídricos no Brasil, OECD Publishing, Paris. http://dx.doi. org/10.1787/9789264238169-pt Refugee Council USA, 2015. Refugee Resettlement – http://www.rcusa.org/refugee- resettlement Rüttinger, L., G. Stang, D.Smith, D. Tänzler, J. Vivekananda et al. 2015: A New Climate for Peace – Taking Action on Climate and Fragility Risks. Berlin/London/ Washington/Paris: adelphi, International Alert, The Wilson Center, EUISS. UN (United Nations). 2010: UN Special Rapporteur on the right to food: Mission to Syria from 29 August to 7 September 2010. Retrieved 10 January 2015 from http://www2.ohchr.org/english/issues/food/docs/ SyriaMissionPreliminaryConclusions_07092010.pdf. Cybersecurity and Cyber warfare – Preliminary Assessment of National Doctrine and Organization, Center for Strategic and International Studies for UNIDIR, 2011 – aka. ms/CSIS-CyberConflict UNHCR (The UN Refugee Agency). Uganda. 1999. Strategy Paper: Self-reliance for refugee hosting areas, 1999-2003. Kampala: UNHCR Uganda, with Office of the Prime Minister – http://www.unhcr.org/41c6a4fc4.pdf Valenta, M. and N. Bunar, 2010. State-assisted integration: Refugee integration policies in Scandinavian welfare states: The Swedish and Norwegian experience. Journal of Refugee Studies, 23(4), pp. 463-483. doi: 10.1093/jrs/feq028 World Economic Forum. 2016. Global Risks 2016: 11th Edition. Geneva: World Economic Forum. 2015. Partnering for Cyber Resilience: Towards the Quantification of Cyber Threats. Geneva: World Economic Forum. 2015. Managing the Risk and Impact of Future Epidemics: Options for Public- Private Cooperation. Geneva: World Economic Forum. 2012. Risk and Responsibility in a Hyperconnected World, Pathways to Global Cyber Resilience. Geneva: World Economic Forum.
- 22. Resilience Insights22 Clémence Finaz, Programme Officer: Environment, Climate Change and Security (ECCS), International Alert Caitlin Wake, Research Officer, Humanitarian Policy Group, Overseas Development Institute Acknowledgements
- 24. World Economic Forum 91–93 route de la Capite CH-1223 Cologny/Geneva Switzerland Tel.: +41 (0) 22 869 1212 Fax: +41 (0) 22 786 2744 contact@weforum.org www.weforum.org The World Economic Forum, committed to improving the state of the world, is the International Organization for Public-Private Cooperation. The Forum engages the foremost political, business and other leaders of society to shape global, regional and industry agendas.