QCYRISK · Quantifying cyber risk: a computational insurance approach

Quantifying cyber risk: a computational insurance approach

Quantifying cyber risk is an important step in assigning resources to cybersecurity measures. Yet data limitations mean that current estimates ignore certain incidents (e.g. ransomware), rarely provide the financial cost, and rarely describe how risk varies based on the firm’s revenue or industry. This knowledge gap could lead organizations and policy-makers to either (a) under-estimate the problem and fail to assign enough resources to preventing adverse cybersecurity outcomes, or (b) possibly to become carried away by media attention surrounding cyber risk and to over-spend. The lack of firm-specific estimates likely means some organisations make the first type of errors and other organisations make the second type. The lack of data over certain incidents may mean the same organisation makes both errors regarding different aspects of cybersecurity. For example, a firm may over invest in measures intended to mitigate the risk of litigation over cybersecurity incidents and under invest in measures mitigating ransomware attacks. This problem affects society because the movement to integrate personal data into business models means we are all potentially exposed to privacy violations. Impacts can also be seen when ransomware attacks disrupt a firm’s operation, such as when the Colonial Pipeline attack caused soaring petrol prices in the USA. Thus, all of society can benefit from private firms making better risk decisions by incorporating fine-grained loss estimates. This project’s goal is to derive such risk estimates by inferring information from cyber insurance. Surprisingly insurers sell cyber insurance for the ignored incident types and vary the price based on firm-specific characteristics. Extracting insurers’ cyber loss models could help firms manage risk, regardless of whether they purchase insurance. Our contribution involved developing the underlying technique and also making practical estimates based on empirical data.

Текст от CORDIS, на английски · Данни: CORDIS, © Европейски съюз