EAGER: Theory and Practice of Risk-Informed Cyber Insurance Policies: Risk Dependency, Risk Aggregation, and Active Threat Landscape

该项目旨在解决设计和采用风险知情的网络保险保单所面临的一些最重大的挑战；这些挑战包括网络风险相互依存、相互关联的风险和风险价值以及快速变化的威胁格局。这项研究有可能带来网络保险保单设计的范式转变，使其被用作符合网络风险现实的有效经济和激励机制；在这样做的同时，它还引入了在整体风险管理背景下思考网络安全的新方法。因此，这项研究对网络保险公司目前的做法产生了直接影响，从而有可能极大地改变现状。它对旨在鼓励采用更好的网络安全框架的公共政策和激励机制设计产生了更广泛的影响。研究议程侧重于挑战，包括风险相互依存、相互关联的风险和风险价值以及快速变化的威胁格局，并分为四个主要领域。首先是关于风险知情保单，重点是利用契约理论和相依风险的建模为新的网络保单家族建立坚实的理论基础。第二个是关于相关风险和风险聚合的建模，目的是通过使用金融工程领域发展起来的条件风险价值(CVaR)的概念来量化保单组合的聚合风险。第三个是关于制定一套压力测试基准，目的是标准化如何根据保单的风险敞口评估保单。第四个是关于技术过渡和采用的努力，其中包括对保险从业者进行教育，建立合作伙伴关系，并确定我们的方法的早期采用者作为试点。这项研究有可能带来网络保险保单设计的范式转变，使它们被用作与网络风险现实相匹配的有效经济和激励机制，并在整体、风险管理的背景下引入关于网络安全的新思维方式。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

This project aims to tackle some of the most significant challenges facing the design and adoption of risk-informed cyber insurance policies; these challenges include cyber risk interdependence, correlated risk and value-at-risk, and a fast-changing threat landscape. The research has the potential to bring about a paradigm shift in the design of cyber insurance policies so that they are used as effective economic and incentive mechanisms consistent with cyber risk realities; in doing so it also introduces new ways of thinking about cybersecurity in a holistic, risk management context. Consequently, the research has a direct impact on the current practice by cyber insurance carriers and thus the potential to dramatically change the status quo. It has broader impacts on public policy and incentive mechanism design aimed at encouraging the adoption of better cybersecurity frameworks.The research agenda focuses on challenges including risk interdependence, correlated risk and value-at-risk, and a fast-changing threat landscape, and is organized into four thrust areas. The first is on risk-informed insurance policies, which is focused on establishing a solid theoretical foundation for a new family of cyber insurance policies by using contract theory and the modeling of dependent risks. The second is on the modeling of correlated risk and risk aggregation, aimed at quantifying the aggregated risk of a portfolio of insurance policies, by using the notion of conditional value-at-risk (CVaR) developed in the financial engineering field. The third is on the development of a set of stress test benchmarks, with the goal of standardizing how insurance policies should be evaluated in terms of their risk exposure. The fourth is on technology transition and adoption efforts, which includes the education of insurance practitioners, building partnerships and identifying early adopters of our methods as pilots. The research has the potential to bring about a paradigm shift in the design of cyber insurance policies so that they are used as effective economic and incentive mechanisms matched with cyber risk realities, and in introducing new ways of thinking about cybersecurity in a holistic, risk management context.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.