A Scalable Approach to Joint Cyber Insurance and Security-as-a-Service Provisioning in Cloud Computing

Abstract

Abstract-As computing services are increasingly cloud-based, corporations are investing in cloud-based security measures. The Security-asa-Service (SECaaS) paradigm allows customers to outsource security to the cloud, through the payment of a subscription fee. However, no security system is bulletproof, and even one successful attack can result in the loss of data and revenue worth millions of dollars. To guard against this eventuality, customers may also purchase cyber insurance to receive recompense in the case of loss. To achieve cost effectiveness, it is necessary to balance provisioning of security and insurance, even when future costs and risks are uncertain. To this end, we introduce a stochastic optimization model to optimally provision security and insurance services in the cloud. Since the model we design is a mixed integer problem, we also introduce a partial Lagrange multiplier algorithm that takes advantage of the total unimodularity property to find the solution in polynomial time. We also apply sensitivity analysis to find the exact tolerance of decision variables to parameter changes. We show the effectiveness of these techniques using numerical results based on real attack data to demonstrate a realistic testing environment, and find that security and insurance are interdependent.

A Bonus-Malus Framework for Cyber Risk Insurance and Optimal Cybersecurity Provisioning

“…Recently, many studies analyzed the cyber risk insurance from a technology perspective. Security frameworks involving cyber risk insurance have been developed for specific IT systems, including computer networks (Fahrenwaldt, Weber, and Weske, 2018;Xu and Hua, 2019), heterogeneous wireless network (Lu, Niyato, Jiang, Wang, and Poor, 2018a), wireless cellular network (Lu et al, 2018b), plug-in electric vehicles (Hoang, Wang, Niyato, and Hossain, 2017), cloud computing (Chase, Niyato, Wang, Chaisiri, and Ko, 2019), and fog computing (Feng, Xiong, Niyato, Wang, and Leshem, 2018). Some studies considered the interplay between self-mitigation measures (i.e.…”

“…There are also studies which took the insured's perspective and analyzed the security provisioning process using dynamic models. Chase et al (2019) developed a framework based on stochastic optimization to jointly provision cyber risk insurance and cloud-based security services across multiple time periods in cloud computing applications. Zhang and Zhu (2018) modeled the decisions on self-protections of the insured by a Markov decision process and investigated the problem of insurance contract design.…”

Security Concerns in Cloud Computing: Analysis and Solution

“…It only ensures secrecy of data to all other users who use the same server for data storage. Chase et al in 2019 [4] proposed technique for cyber insurance provisioning and security in cloud computing. It utilized stochastic optimization technique that provides optimally both services.…”

A stochastic programming approach for risk management in mobile cloud computing

“…The numerical results showed that cyber insurance is an effective way to mitigate losses caused by cyberattacks for cloud providers. Alternatively, there are some other work introducing applications of cyber insurance to deal with cyber risks for cloud customers [10], [11]. The core idea of these papers is using stochastic programming to balance provisioning of security and insurance, even when future costs and risks are uncertain.…”