Designing Cyber Insurance Policies: The Role of Pre-Screening and Security Interdependence
Designing Cyber Insurance Policies: The Role of Pre-Screening and Security Interdependence
复制标题
DOI：
10.1109/tifs.2018.2812205
复制
发表时间：
2018-03
影响因子：
6.8
通讯作者：
Mohammad Mahdi Khalili;Parinaz Naghizadeh;M. Liu
中科院分区：
文献类型：
--
作者：
Mohammad Mahdi Khalili;Parinaz Naghizadeh;M. Liu
网络保险是一种可行的网络风险转移方式。然而，已经证明，根据底层环境的特征，它可能会或可能不会改善网络安全状态。在本文中，我们考虑一个单一的利润最大化的保险人（委托人）与自愿参与的被保险人/客户（代理人）。我们对网络安全的两个不同特征及其对合约设计问题的影响特别感兴趣。首先是网络安全的相互依赖性质，即一个实体的安全状态不仅取决于其自身的投资和努力，还取决于同一生态系统中其他实体的努力（即外部性）。其次，互联网测量的最新进展与机器学习技术相结合，现在使我们能够在公司层面上对安全状况进行准确的定量评估。这可以用作对潜在客户执行初始安全审计或预筛选的工具，以更好地实现保费区分和定制策略的设计。我们表明，安全的相互依赖为保险公司带来了一个“盈利机会”，这是由相互依赖的代理人施加的低效努力水平造成的，这些代理人在没有保险时不考虑风险外部性；这是除了风险转移之外，保险公司通常会从中获利。然后，安全预筛选允许保险公司通过设计适当的合同来利用这个额外的利润机会，这些合同激励代理人增加他们的努力水平，允许保险公司向相互依赖的代理人“出售承诺”，除了为他们的风险提供保险。我们确定了这种类型的合同不仅可以增加委托人的利润，还可以改善网络安全状态的条件。
Cyber insurance is a viable method for cyber risk transfer. However, it has been shown that depending on the features of the underlying environment, it may or may not improve the state of network security. In this paper, we consider a single profit-maximizing insurer (principal) with voluntarily participating insureds/clients (agents). We are particularly interested in two distinct features of cybersecurity and their impact on the contract design problem. The first is the interdependent nature of cybersecurity, whereby one entity’s state of security depends not only on its own investment and effort, but also the efforts of others’ in the same eco-system (i.e., externalities). The second is the fact that recent advances in Internet measurement combined with machine learning techniques now allow us to perform accurate quantitative assessments of security posture at a firm level. This can be used as a tool to perform an initial security audit, or pre-screening, of a prospective client to better enable premium discrimination and the design of customized policies. We show that security interdependency leads to a “profit opportunity” for the insurer, created by the inefficient effort levels exerted by interdependent agents who do not account for the risk externalities when insurance is not available; this is in addition to risk transfer that an insurer typically profits from. Security pre-screening then allows the insurer to take advantage of this additional profit opportunity by designing the appropriate contracts which incentivize agents to increase their effort levels, allowing the insurer to “sell commitment” to interdependent agents, in addition to insuring their risks. We identify conditions under which this type of contract leads to not only increased profit for the principal, but also an improved state of network security.