The financials of cybercrime: a health insurance pricing approach
Tóm tắt
The expansion of information technology in everyday reality through the spread of social networks and mobile devices, emerging technologies -such as cloud services and the internet of things, has led to increased vulnerability for individuals and businesses. Individuals can suffer fraud, identity theft, embarrassment and distress when critical information (such as financial or sensitive personal data) is compromised or even publicly revealed, as a result of a cybercrime. The increase of cyber-risks impacts both individuals and entities, such as businesses and governments and renders cyber-insurance -on top of other cyber security means- more necessary with the passage of time. In this paper, it is assumed that multiple cyber-incidents are possible during the (digital) life of an individual. They resemble to illness that can affect the physical life of an individual. Illness as opposed to fatality—which has been used in research so far- can occur several times within the lifetime of an individual and the same can happen during his or her digital life, as he or she may suffer several cyber-attacks (digital illnesses) and yet digitally survive. This study mimics physical illness insurance-based actuarial pricing techniques to evaluate the cost for offering financial protection against multiple cyber-attacks, in a way similar to that of pricing health insurance. Consequently, this approach further advances the research on cyber insurance valuation and development. It can be a valuable pricing tool for the interested parties and targeted audience, as is helps estimate the residual risk left after technological cyber-security safety-nets have been used.
Tài liệu tham khảo
ISACA (2015) State of Cybersecurity: Implications for 2015. https://www.isaca.org/cyber/Documents/State-of-Cybersecurity_Res_Eng_0415.pdf
Lloyds of London (2017) Counting the cost. https://www.lloyds.com/news-and-insight/risk-insight/library/technology/countingthecost. Last Accessed 16 Dec 2019
Shetty S, McShane M, Zhang L, Kesan JP, Kamhoua CA, Kwiat K, Njilla LL (2018) Reducing informational disadvantages to improve cyber risk management. Geneva Papers Risk Insur Issues Pract 43:224–238. https://doi.org/10.1057/s41288-018-0078-3
Eling M (2018) Cyber risk and cyber risk insurance: status quo and future research. Geneva Papers Risk Insur Issues Pract 43(2):175–179. https://doi.org/10.1057/s41288-018-0083-6
Felici M, Wainwright N, Bisconi F, Cavallini S (2015) What’s new in the economics of cybersecurity? Observational and empirical studies. IEEE Secur Priv 13(5):12–15
Anderson R, Moore T (2006) The economics of information security. Science 314(5799):610–613
Moore T (2010) The economics of cybersecurity: principles and policy options. Int J Crit Infrastruct Prot 3(3–4):103–117
Agrafiotis I, Nurse JRC, Goldsmith M, Creese S, Upton J (2018) A taxonomy of cyber-harms: defining the impacts of cyber-attacks and understanding how they propagate. J Cybersecur 4(1):1–15
Poufinas T, Vordonis N (2018) Pricing the cost of cybercrime—a financial protection approach. iBusiness 10(3):128–143
Anderson R, Barton C, Böhme R, van Eeten MJG, Levi M, Moore T, Savage S (2013) Measuring the cost of cybercrime. Econ Inf Secur Privacy 12:265–300
Nguyen KD, Rosoff H, Richard SJ (2017) Valuing information security from a phishing attack. J Cybersecur 3(3):159–171
Axon L, Erola A, Agrafiotis I, Goldsmith M, Creese S (2019) Analysing cyber-insurance claims to design harm-propagation trees. Working Paper, Department of Computer Science, University of Oxford, UK, https://ora.ox.ac.uk/objects/uuid:496b5fb7-9da3-4305-a0b1-e4cbf0c41bfb. Last Accessed 10 Jan 2020
World Health Organization (WHO) (2018) WHO methods and data sources for global burden of disease estimates 2000–2016, Department of Information, Evidence and Research WHO, Geneva, Global Health Estimates Technical Paper WHO/HIS/IER/GHE/2018.4, https://www.who.int/healthinfo/global_burden_disease/GlobalDALY_method_2000_2016.pdf. Last Accessed 16 Dec 2019
Federal Bureau of Investigation (FBI)-Internet Crime complaint center (2018) Internet crime report. https://pdf.ic3.gov/2018_IC3Report.pdf. Last Accessed 16 Dec 2019