Search

With the rapid enhancements in technology and the adoption of web services, there has been a significant increase in cyber threats faced by organizations in cyberspace. It has become essential to get financial cover to mitigate the expenses due to a security incident. Organizations want to purchase adequate cyber insurance to safeguard against the third-party services they use. However, cyber insurance policies describe their coverages and exclusions using legal jargon that can be difficult to comprehend. Parsing these policy documents and extracting the rules embedded in them is currently a very manual time-consuming process. We have developed a novel framework that automatically extracts the coverage and exclusion key terms and rules embedded in a cyber policy. We have built our framework using Information Retrieval and Artificial Intelligence techniques, specifically Semantic Web and Modal Logic. We have also developed a web interface where users can find the best matching cyber insurance policy based on particular coverage criteria. To validate our approach, we used industry standards proposed by the Federal Trade Commission document (FTC) and have applied them against publicly available policies of seven insurance providers. Our system will allow cyber insurance seekers to explore various policy documents and compare the paradigms mentioned in those documents while selecting the best relevant policy documents.

With the recent growing number of cyberattacks and the constant lack of effective defense methods, cyber risks become ubiquitous in enterprise networks, manufacturing plants, and government computer systems. Cyber-insurance provides a valuable approach to transfer the cyber risks to insurance companies and further improve the security status of the insured. The designation of effective cyber-insurance contracts requires the considerations from both the insurance market and the dynamic properties of the cyber risks. To capture the interactions between the users and the insurers, we present a dynamic moral-hazard type of principal-agent model incorporated with Markov decision processes, which are used to capture the dynamics and correlations of the cyber risks as well as the user's decisions on the protections. We study and fully analyze a case with a two-state two-action user under linear coverage insurance, and we further show the risk compensation, Peltzman effect, linear insurance contract principle, and zero-operating profit principle in this case. Numerical experiments are provided to verify our conclusions and further extend to cases of a four-state three-action user under linear coverage insurance and threshold coverage insurance., Comment: We have made several corrections

Due to the development of cyber-physical systems for modernizing power grids, vulnerability assessment has become an emerging focus in power system security studies. With the increasing deployment of cyber-enabled technologies in power systems, modern power system is prevalently exposed to a wide gamut of cybersecurity threats. Thus, there is an urgent need to develop effective cyber risk management mechanisms to mitigate the growing cyberthreats. Recently cyber insurance is emerging as a promising financial instrument for cyber risk management of critical infrastructures such as power grids. In this paper, a new cyber-insurance design framework is proposed to hedge against the risk of massive monetary losses due to potential cyberthreats. Traditionally, insurance companies serve as third-party risk-bearers offering aggregate design of the insurance policy which may stipulate high premiums. However, unusual loss patterns may still lead to excess financial risk for insurance companies. In this paper, coalitional insurance is introduced as a promising alternative or supplement to the traditional insurance plans provided by insurance companies. Under the proposed cyber-insurance model, several transmission operators form an insurance coalition, where the coalitional premiums are derived considering system vulnerabilities and loss distributions. The indemnity which covers the loss of TOs complies with the budget sufficiency. Overall, this study proposes a novel coalitional platform based cyber-insurance design that estimates the insurance premiums via cybersecurity modeling and reliability implication analysis.

Sharding is a promising solution to achieving scalability within the blockchain network. A sharded blockchain network consists of a beacon chain and several committees powered by the participants (i.e., validators) through the Proof-of-Stake (PoS) consensus protocol. Efficient and scalable as it can be, the sharded blockchain based on PoS is vulnerable to discouragement attack. A discouragement attack occurs when malicious validators censor messages to discourage validators from participating in the network. Furthermore, no rate-limiting validator rotation (enter/exit quickly) makes it more challenging to detect such an attack. In this paper, considering the undetermined rotation and the discouragement attack, we render the beacon chain an intermediary, allowing the beacon chain to interact with validators and the cyber-insurer, aiming to encourage the validators’ stable rotation through insurance compensation. Specifically, we utilize a two-stage hierarchical game-based model to formulate the complicated interactions under the cyber insurance framework. In the first stage, the beacon chain develops compensatory strategies according to the insurer’s profile. In the second stage, the beacon chain designs a series of contracts for validators, including insurance items, compensatory strategies, and rotation requirements. Consequently, the proposed scheme incentivizes validators to remain online by transferring risk to the cyber insurer and enables the sharded blockchain network to weaken the attack’s impact through validators’ stable rotation. This paper presents closed-form solutions for the proposed model, in which the beacon chain and the cyber insurer can gain maximized profits. The simulations demonstrate the feasibility and superiority of the proposed model.

PurposeThis article aims to gain insights on the current state of small- and medium-sized enterprises’ (SMEs’) cyber risk management process and to derive future research directions.Design/methodology/approachThis is done by collecting market insights from 37 recent industry surveys and structuring them based on the steps of the risk management process. From this analysis, major challenges are derived and future fields of research identified.FindingsThe results indicate that deficiencies in risk culture as well as the strained market for IT experts are the major obstacles with respect to the implementation of cyber risk management in SMEs, and that these challenges are similar across countries. The findings suggest that especially the relationship between cyber security culture and cyber risk management should be investigated further, and that a stronger link between the research streams on enterprise risk management and cyber risk management would be desirable.Originality/valueThis paper contributes to the literature by providing a systematic overview on the current state of SMEs' cyber risk management from a market perspective. The findings provide support for the existing academic literature by emphasizing the central role of cyber security culture (perception, knowledge, attitude) for a successful cyber risk management, which however should be addressed in more depth in future (empirical) research.

In an era where all the transactions, businesses and services are becoming digital and online, the data assets and the services protection are of utmost importance. Cyber-insurance companies are offering a wide range of coverages, but they also have exclusions. Customers of these companies need to be able to understand the terms and conditions of the related contracts and furthermore they need to be able to compare various offerings in order to determine the most appropriate solutions for their needs. The research in the area is very limited while at the same time the related market is growing, giving every potential solution a high value. In this paper, we propose a methodology and a prototype system that will help customers to compare contracts based on a pre-defined ontology that is describing cyber-insurance terms. After a first preliminary analysis and validation, our approach accuracy is averaging at almost 50%, giving a promising initial evaluation. Fine tuning, larger data set assessment and ontology refinement will be our next steps to improve the accuracy of our tool. Real user evaluation will follow, in order to evaluate the tool in real world cases.

Potential for huge loss from malicious exploitation of software calls for development of principles of cyber-insurance. Estimating what to insure and for how much and what might be the premiums poses challenges because of the uncertainties, such as the timings of emergence and lethality of malicious apps, human propensity to favor ease by giving more privilege to downloaded apps over inconvenience of delay or functionality, the chance of infection determined by the lifestyle of the mobile device user, and the monetary value of the compromise of software, and so on. We provide a theoretical framework for cyber-insurance backed by game-theoretic formulation to calculate monetary value of risk and the insurance premiums associated with software compromise. By establishing the conditions for Nash equilibrium between strategies of an adversary and software we derive probabilities for risk, potential loss, gain to adversary from app categories, such as lifestyles, entertainment, education, and so on, and their prevalence ratios. Using simulations over a range of possibilities, and using publicly available malware statistics, we provide insights about the strategies that can be taken by the software and the adversary. We show the application of our framework on the most recent mobile malware data (2018 ISTR report—data for the year 2017) that consists of the top five Android malware apps: Malapp, Fakeinst, Premiumtext, Maldownloader , and Simplelocker and the resulting leaked phone number, location information, and installed app information. Uniqueness of our work stems from developing mathematical framework and providing insights of estimating cyber-insurance parameters through game-theoretic choice of strategies and by showing its efficacy on a recent real malicious app data . These insights will be of tremendous help to researchers and practitioners in the security community.

Cybersecurity has become an emerging issue for the secure operation of power systems. Besides hardening the power system to improve its cybersecurity, cyber insurance is emerging as a promising tool in cyber risk management. In this paper, an actuarial framework is established to capture and reduce the riskiness raised by interdependence among cyber risks, with the aim to enhance cyber insurance market for power systems. Absorbing semi-Markov process (SMP) is proposed to model the cyberattacks on the power grid. Also a stochastic model is developed to reflect the correlation of cyber risks across the power system. A sequential Monte Carlo simulations (MCS) framework is developed to evaluate the interruptions of the power system considering both the physical failures of the components and malicious cyberattacks. Then, the detailed insurance schemes are designed to manage the risks of the power system considering the financial consequences of cybersecurity threats. Case studies are conducted on a test system based on the IEEE Reliability Test System (RTS-79) to illustrate the application of the proposed insurance pricing schemes.

With some of the largest cyber attacks occurring in recent years-from 2010 to 2019-we are only beginning to understand the full extent of cyber risk. As businesses grapple with the risks of cyber-incidents and their imperfect ability to prevent them, attention has shifted toward risk management and insurance. While there have been efforts to understand the costs of cyber attacks, the systemic risk-a result of risks spreading across interdependent systems-associated with cyber attacks remains a critical and problem in need of further study. We contribute a theoretical framework that describes systemic cyber risk as the result of cascading, common cause, or independent failures following a cyber incident. We construct a quantitative model of cascading failures to estimate the potential economic damage associated with a given cyber incident. We present an interdisciplinary approach for extending standard sector-level input-output analyses to the cyber domain, which has not been done. We estimate the aggregate losses associated with firm-level incidents, a contribution to risk analysis and computational economic modeling. We use this model to estimate the impact of potential cyber incidents and compare model results to a case with known damages. Finally, we use the model of systemic cyber failure to consider the implications on the growing cyber insurance market and the need for broader cyber policy. While we discuss the topic of systemic cyber risk, our contribution of using I/O analysis to estimate the aggregate losses from firm-level incidents is applicable across a variety of risk analysis applications from environment to health.

Cyberspace poses many challenges threats and risks which, with the development of technology, are increasingly affecting all of us in terms of the scope, frequency, damage, immediate effects and long-term consequences. All these impact many sectors. Cyber insurance is one of the tools for managing these risks. Indeed, the cyber insurance market is developing around the world, but in many countries, as well as in Israel, it has not yet reached its full potential. This study examined the cyber insurance market in Israel by analyzing the existence of a cyber insurance service among insurance companies and agencies. In addition, it examined the reference to this market by various experts in this field. All the above has been done with the aim of establishing the degree of maturity of the market in Israel. The findings of the study indicate that the cyber insurance market in Israel is not mature enough. Cyber insurance is not a popular product among companies to manage their cyber risks, mainly due to lack of information, knowledge, awareness among customers, insurance agencies, insurance companies, and government bodies. However, steps are being taken, mainly by Israel National Cyber Directorate (INCD), to empower insurance agents and their customers with relevant professional knowledge.

As one of the national critical infrastructures, the water distribution system supports our daily life and economic growth, the failure of which may lead to catastrophic results. Besides the uncertainty from the system component failures, cyberattacks are vital to the secure system operation and have great impacts on the reliability of the water supply service. Malicious attackers may intrude into the supervisory control and data acquisition (SCADA) system of pump stations in the water distribution networks and interrupt the water supply to the customers. Cyber insurance is emerging as a promising financial tool in system risk management. In this paper, cyber insurance is proposed for the cyber risk management of the water distribution system. A semi-Markov process (SMP) model is devised to model the cyberattacks against pump stations in the water distribution system. Both the impacts of the independent cyber risks in the individual distribution network and the correlated cyber risks shared across different water distribution networks are evaluated and modeled. A sequential Monte Carlo Simulation (MCS) based algorithm is developed to evaluate the system loss. Cyber insurance premiums for the water distribution networks are designed based on the actuarial principles and potential system losses. Case studies are also performed on multiple representative water distribution networks, and the results demonstrate the validity of the proposed cyber insurance model.

The article deals with a topic that is relevant in modern society - cyber insurance, the essence and necessity of this type of insurance. The state of implementation of cyber insurance in Uzbekistan is described; the results of research in this direction are given. The factors and reasons preventing the development of cyber insurance are analyzed; proposals for the development of this type of insurance in the republic are formulated.

We review the academic literature on “cyber risk” and “cyber insurance” in the fields of business (management, economics, finance, risk management and insurance) and actuarial science. Our results show that cyber risk is an increasingly important research topic in many disciplines, but one that so far has received little attention in business and actuarial science. Business research has documented the manifold detrimental effects of cyber risks using event studies and scenario analyses, while economic research is especially concerned with trade-offs between different risk management activities. Quantitative research including papers published in actuarial journals mainly focuses on loss modelling, especially taking dependencies and network structure into account. We categorize the empirical literature on cyber risk to filter out what we know on the frequency, severity and dependence structure of cyber risk. Finally, we list open research questions which demonstrate that cyber risk research is still in its infancy and that there is ample room for future research.

This study examines the cybersecurity insurance market in the United States (U.S.) in order to reveal if an “invisible hole” of services and information exists in this market. This is performed by mapping the cybersecurity insurance services, offered by insurance companies, to cope with cybersecurity risks, and finding in which way these services are exposed, visible and comprehensive, in the insurance companies' websites. The research questions examined the extent cybersecurity insurance services offered by the main U.S. insurance companies; the visibility of such services on their websites; and the types of services offered. The sample included 44 insurance companies based upon nine lists of the top U.S. insurance companies. The findings present that most companies (68%) offer cybersecurity insurance services, while only a few (26.92%) expose such information in a visible way. Moreover, on the one hand, the insurance companies use general terms for services, which may be blur and ambiguous, while on the other hand, there is a widespread of specific services, most of them (81%) provided only by few companies. These findings may derive due to insufficient understanding of cybersecurity insurance clients' needs and may reflect the lack of maturity of the cybersecurity insurance market, as matured marketplaces are mostly more standardized. This study demonstrates that there is a long way to advance until the insurance market for cybersecurity risks will be mature, customers (businesses and organizations) will understand the needs for such insurance, and insurance companies will develop and offer relevant insurance services.

This study investigates various factors that can affect the monetary impact of data breaches on companies. This paper introduces a model for the total cost of a mega data breach based on a data set created from multiple sources that categorises stolen data for U.S. residents as personally identifiable information (PII) and sensitive personally identifiable information (SPII). We use a rigorous stepwise regression analysis that includes polynomial and factorial multilevel effects of the independent variables. There are three significant findings. First, our model finds a significant relation between total data breach cost and revenue, the total amount of PII and SPII, and class action lawsuits. Second, the categorisation of personal information as sensitive and non-sensitive explains the cost better than previous work. Finally, all of the independent variables demonstrate multilevel factorial interactions.

Malicious hacking data breaches cause millions of dollars in financial losses each year, and more companies are seeking cyber insurance coverage. The lack of suitable statistical approaches for sco...

As an important method of risk control in information systems and networks, cyber-insurance has attracted particular attention from both industry and academia. However, two prominent problems hamper the further growth of cyber-insurance. The correlated and interdependent properties of cyber-risks increase the economic risk of insurance companies considerably ; risk pooling can be impeded by these two properties. Further, this situation can be aggravated because cyber-insurance affects the investment for self-protection negatively. This phenomenon is regarded as the ex ante moral hazard. In this study, we establish a mathematical model based on a classic insurance theory to address the abovementioned problems, and propose an optimal cyber-insurance contract scheme that maximizes the expected utility of users. We also propose two personalized contract schemes to incentivize users to invest in self-protection under the no moral hazard and ex ante moral hazard conditions. Extensive experiments are conducted to evaluate the proposed approach, and the experimental results demonstrate the effectiveness and efficiency of the approach.

This article examines the determinants of cyber insurance participation, the amount of coverage offered and the performance of current cyber insurers. Our results support the competitive advantage hypothesis, but only partially support the business growth constraint hypothesis. We find that insurers offer cyber insurance to capitalise on their competitive advantage in understanding and pricing cyber risks. In particular, professional surplus insurers and insurers with surplus insurer affiliation demonstrate a competitive advantage in cyber insurance participation. We find limited evidence that insurers participate in cyber insurance to compensate for constraints on business growth. In addition, the type (standalone or packaged) and amount of coverage offered vary substantially across firm characteristics. Standalone coverage incurs higher loss ratios than packaged coverage, demonstrating its riskier nature. Changes in cyber insurance loss ratios are not driven by premium growth but by claim frequency and severity growth, emphasising the significance of cyber insurance policy design.

The mass adoption of cyber insurance will be predicated on the ability to conduct quantitative cyber risk assessment. This capability is crucial for not only providing insight into the cost of targeted threats but also providing incentives for insured enterprises to invest in protection aimed at preventing exploitation of targeted threats. Research indicates that asymmetric information, correlated loss and interdependent security issues make this difficult if insurers cannot monitor the cybersecurity efforts of the insured enterprises. In this paper, we present an analysis of cyber impacts based on cyber incidents reported in the Advisen cyber loss data feed. We show: (i) how exposure to cyber incidents varies between corporate sectors; (ii) how the type of incident relates to the number of entities and individuals affected by it; (iii) how the type of incident relates to the eventual financial cost; (iv) what type of information is most frequently compromised; (v) a breakdown of the main actors behind cyber incidents; and (vi) how tree-based classifiers can be used to gain insight into cyber risk indicators affecting the cost of incidents.

Purpose This paper aims to present the case of an Italian SME in the domain of insurance and how it approached its own digital transformation. Together with the founders of the SME, the author investigated the digital trends the company should adopt and identified where to intervene in the value chain of the company with new technologies available in the market. The research was focused on the following three sub-domains: a strategy for adoption of innovative digital solutions to improve the everyday operations of the company, platform connecting the company with the customers and analysis of cyber insurance policies to include in the portfolio of the company. Design/methodology/approach For the part on strategy for adoption of innovative digital solutions, the author performed literature review; for the part in which the study ideates new solution to better connect the company with the customers, the author relied on design thinking, creative facilitation and prototyping; and for the part on cyber insurance policies to include the portfolio, the author relied on data available from other insurance companies the SME collaborates with. Findings This paper presented the analysis on how an insurance SME can embrace digital innovation (via internal innovation, buying from startups, partnering with startups or investing in startups), how an SME can do internal innovation and come up with a simple tool to bring closer the insurers and their customers and types of new cyber risk policies to include in the portfolio to respond to the growing demand for cyber risk insurance. This paper provides useful insights and lessons learned from companies of similar size in the domain of insurance and discusses future extensions of inquiry. Originality/value Big insurance companies and incumbent for their digitization efforts rely on the freshly created InsurTechs wave of companies. In this paper, the author analyzes what small- and medium-sized insurance enterprises can do in this respect and showcases the approach an Italian SME took in this direction.

The aim of the article is to analyze current trends in the development of cyber insurance. The following methods of scientific research were used in the preparation of the article: generalization, correlation analysis, comparative analysis. The authors analyze in detail the main trends in the spread of cybercrime. The correlation analysis between the number of registered cybercrimes in a particular country and its GDP, the number of business entities, indicated the lack of correlation between the studied indicators. It states that the most common types of cybercrime are: hacking, unauthorized access, accidental exposure, insider and physical theft. The sectoral analysis of the distribution of cybercrime has revealed a decrease in the share of financial companies while increasing the share of health care companies. It is noted that cyber insurance is one of the effective preventive measures that minimize the negative effects of cybercrime intervention. The article presents segmentation of the cyber insurance market by geography and size of insurance companies. The results of the analysis showed the dominance of US companies in the cyber insurance market. It is stated that the sectoral distribution of cybersecurity policy purchasers in general follows the trends of the sectoral distribution of cybercrime. The volume of cyber insurance, expenses of insured legal entities is analyzed. The main trends in the development of cyber insurance have been identified. The factors that hold back the development of cyber risk insurance have been identified. The main ones include the following: high level of information entropy in the process of cyber risk assessment, lack of a single standard for filling insurance services in the field of cyber insurance. It is noted that in the medium term the cyber insurance market is prospective for insurance companies. This is caused by the increasing scale of cyber threats and the costs associated with cyberattacks.

The U.S. property-casualty insurance industry has witnessed substantial growth in the cyber insurance market over the past decade, largely attributable to the proliferation of technology in the bus...

The growing threat of cyber breach as become one of the most feared risks corporations around the world are currently dealing with. The dynamic nature of cyber risk, along with evolving global regulations, necessitates that corporate management strategically address cyber risk to minimize effects on corporate value. This paper uses event study methodology to analyze global shareholder value effects of cyber breaches occurring between the periods 1990 to 2019. Cumulative Average Returns (CARs) are calculated by country, and in aggregate, from first notice date to periods of up to 90 days post announcement to compare short term and long term effects of cyber breaches on stock price. Similar to other smaller studies, results for this much larger data set show significant negative returns for US corporations in all sample windows. However, the changes in shareholder value are much smaller than were previously seen in other studies. Unlike its US counterparts, short term results for the five major non-US countries in this sample show no significant changes to price as a result of cyber breach announcements, even though the non-US firms also trade on US exchanges. Long term results for the aggregate non-US sample show significance only at the 0 to 30 day window. Long term results for some of the individual countries do support some various positive and negative event windows, but no common patterns are seen among countries. These results point to differences in how news of a cyber breach, by country, is perceived in the market. These results are interesting in that they also follow some of the patterns that insurance companies have seen in the reticent buying habits of global companies with respect to cyber insurance worldwide.

Insurance is a promising risk transfer tool against switching cyberattacks on power grids that can disrupt operation and potentially lead to widespread outages. This paper emphasizes on a framework of premium calculation for cyber insurance businesses by modeling potential electronic intrusion with steady-state simulation results and its direct hypothesized impacts. The proposed actuarial framework models the operational monetary losses with the hypothesized power outages based on the cyber-reliability assessment and its expected mean time to restore power (MTTRP). The ruin probability is employed as the fundamental formula to determine the feasible insurance premium pool. Hypothesized spatial correlation studies on multiple substation contingencies associated with switching attacks have shown estimated operational losses and expected duration of power restoration, which is translated into the calculation of insurance premium. The proposed actuarial framework is validated using generalized IEEE test cases with modified parameters on substations. The potential implications of grid's hypothetical scenarios are discussed.