Designing Cyber Insurance Policies: The Role of Pre-Screening and Security Interdependence

References

[1]  M. M. Khalili, P. Naghizadeh and M. Liu, "Designing cyber insurance policies: Mitigating moral hazard through security pre-screening", Proc. 7th Int. EAI Conf. Game Theory Netw. (Gamenets), pp. 63-73, 2017.

[2] M. M. Khalili, P. Naghizadeh and M. Liu, "Designing cyber insurance policies in the presence of security interdependence", Proc. 12th Workshop Econ. Netw. Syst. Comput. (NetEcon), pp. 7, 2017.

[3]  C. Hemenwa, ABI Research: Cyber Insurance Market to Reach 10B by 2020, 2015, [online] Available: http://www.advisenltd.com/2015/07/30/abi-research-cyber-insurance-market-to-reach-10b-by-2020/.

[4] U.S. Cyber Insurance Market Demonstrates Growth Innovation in Wake of High Profile Data Breaches, 2015, [online] Available: http://www.iii.org/pressrelease/us-cyber-insurance-market-demonstrates-growthinnovation-in-wake-of-high-profile-data-breaches-102015.

[5] 5. N. Shetty, G. Schwartz and J. Walrand, "Can competitive insurers improve network security?", Proc. 3rd Int. Conf. Trust Trustworthy Comput. (TRUST), pp. 308-322, 2010.

[6] 6. N. Shetty, G. Schwartz, M. Felegyhazi and J. Walrand, "Competitive cyber-insurance and Internet security", Proc. Econ. Inf. Secur. Privacy, pp. 229-247, 2010.

[7] 7. G. Schwartz, N. Shetty and J. C. Walrand, "Cyber-insurance: Missing market driven by user heterogeneity", 2010.

[8] 8. G. A. Schwartz and S. S. Sastry, "Cyber-insurance framework for large scale interdependent networks", Proc. 3rd Int. Conf. High Confidence Netw. Syst., pp. 145-154, 2014.

[9] 9. H. Ogut, N. Menon and S. Raghunathan, "Cyber insurance and IT security investment: Impact of interdependence Risk", Proc. Workshop Econ. Inf. Secur., pp. 1-30, 2005.

[10] 10. Z. Yang and J. C. S. Lui, "Security adoption and influence of cyber-insurance markets in heterogeneous networks", Perform. Eval., vol. 74, pp. 1-17, Apr. 2014.

[11] 11. J. Kesan, R. Majuca and W. Yurcik, "The economic case for cyberinsurance", Jan. 2004.

[12] 12. J. P. Kesan, R. P. Majuca and W. Yurcik, "Cyber-insurance as a market-based solution to the problem of cybersecurity", Proc. Workshop Econ. Inf. Secur., pp. 1-46, 2005.

[13] 13. A. Hofmann, "Internalizing externalities of loss prevention through insurance monopoly: An analysis of interdependent risks", Geneva Risk Insurance Rev., vol. 32, no. 1, pp. 91-111, 2007.

[14] 14. M. Lelarge and J. Bolot, "Economic incentives to increase security in the Internet: The case for insurance", Proc. IEEE Int. Conf. Comput. Commun. (INFOCOM), pp. 1494-1502, Apr. 2009.

[15] 15. S. Romanosky, L. Ablon, A. Kuehn and T. Jones, "Content analysis of cyber insurance policies: How do carriers write policies and price cyber risk?", 2017, [online] Available: https://www.rand.org/pubs/working_papers/WR1208.html.

[16] 16. Y. Liu et al., "Cloudy with a chance of breach: Forecasting cyber security incidents", Proc. USENIX Secur. Symp., pp. 1009-1024, 2015.

[17] 17. R. A. Miura-Ko, B. Yolken, N. Bambos and J. Mitchell, "Security investment games of interdependent organizations", Proc. 46th Annu. Allerton Conf. Commun. Control Comput., pp. 252-260, Sep. 2008.

[18] 18. B. Johnson, J. Grossklags, N. Christin and J. Chuang, "Are security experts useful? Bayesian nash equilibria for network security games with limited information", Proc. 15th Eur. Symp. Res. Comput. Secur. (ESORICS), pp. 588-606, 2010.

[19] 19. B. Johnson, J. Grossklags, N. Christin and J. Chuang, "Uncertainty in interdependent security games", Proc. 1st Conf. Decision Game Theory Secur. (GameSec), pp. 234-244, 2010.

[20] 20. M. Lelarge, "Coordination in network security games: A monotone comparative statics approach", IEEE J. Sel. Areas Commun., vol. 30, no. 11, pp. 2210-2219, Dec. 2012.

[21] 21. R. Böhme and G. Schwartz, "Modeling cyber-insurance: Towards a unifying framework", Proc. Workshop Econ. Inf. Secur., pp. 1-36, 2010.

[22] 22. A. Mas-Colell, M. D. Whinston and J. R. Green, Microeconomics Theory, New York, NY, USA:Oxford Univ. Press, 1995.

@article{1702374,
      author = {B Srinivasa Rao, A Kalavathi},
      title = {Designing Cyber Insurance Policies: The Role of Pre-Screening and Security Interdependence},
      journal = {Iconic Research And Engineering Journals},
      year = {2020},
      volume = {3},
      number = {12},
      pages = {136-143},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1702374.pdf},
      abstract = {Cyber insurance is a viable method for cyber risk transfer. However, it has been shown that depending on the features of the underlying environment, it may or may not improve the state of network security. In this paper, we consider a single profit-maximizing insurer (principal) with voluntarily participating insureds/clients (agents). We are particularly interested in two distinct features of cyber security and their impact on the contract design problem. The first is the interdependent nature of cyber security, whereby one entity?s state of security depends not only on its own investment and effort, but also the efforts of others? in the same eco-system (i.e. externalities). The second is the fact that recent advances in Internet measurement combined with machine learning techniques now allow us to perform accurate quantitative assessments of security posture at a firm level. This can be used as a tool to perform an initial security audit, or prescreening, of a prospective client to better enable premium discrimination and the design of customized policies. We show that security interdependency leads to a ?profit opportunity? for the insurer, created by the inefficient effort levels exerted by interdependent agents who do not account for the risk externalities when insurance is not available; this is in addition to risk transfer that an insurer typically profits from. Security pre-screening then allows the insurer to take advantage of this additional profit opportunity by designing the appropriate contracts which incentivize agents to increase their effort levels, allowing the insurer to ?sell commitment? to interdependent agents, in addition to insuring their risks. We identify conditions under which this type of contracts leads to not only increased profit for the principal, but also an improved state of network security.},
      keywords = {System , Python , Django , Mysql, Wamp Server},
      month = {June},
  }