Cyber risk management: History and future research directions

McShane, Michael K.; Eling, Martin; Nguyen, Trung

doi:10.1111/rmir.12169

Cited by 60 publications

(28 citation statements)

References 135 publications

(235 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…With respect to CyberRM, Biener, Eling, Matt, et al (2015) as well as Eling and Schnell (2016), recommend the use of information security standards, such as the ISO 27001 standard, the IT Governance Framework COBIT or the US NIST Framework (see also BCBS, 2018; Higgs et al, 2016; Marotta & McShane, 2018). For a review of research on the respective process steps of cyber risk management, we refer to Eling et al (2021).…”

Section: Development Of Hypotheses Methodology and Data Samplementioning

confidence: 99%

“…There is currently no standardized definition of cyber risk, with a variety of concretizations in the literature (see, e.g., Biener, Eling, Matt, et al, 2015; Biener, Eling, & Wirfs, 2015; Eling & Schnell, 2016; Eling et al, 2021; Shetty et al, 2018). Empirical studies regarding cyber risks mainly focus in the market reactions of data, information, and internet security breaches, or specific methods of attack, such as denial‐of‐service attacks (see, e.g., Gatzlaff & McCullough, 2010).…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Cyber risk management in the US banking and insurance industry: A textual and empirical analysis of determinants and value

Gatzert

Schubert

2022

J of Risk & Insurance

View full text Add to dashboard Cite

In this paper, we first construct a cyber risk consciousness score using a text mining algorithm, applied to annual reports of large‐ and mid‐cap US banks and insurers from 2011 to 2018. We next categorize the firms' cyber risk management based on keywords to study determinants and value‐relevance. Our results show an increasing cyber risk consciousness, regardless of the industry. In addition, for the entire sample we find that firms belonging to the banking industry, with a higher cyber risk consciousness score and a higher general risk awareness are more likely to implement cyber risk management, which also holds for both industries separately. We find the opposite in the case of profitable firms for the entire sample and the insurer subsample. Finally, we observe a significant positive relationship between cyber risk management and firm value measured by Tobin's Q for the entire sample and the subsamples of banks and insurers.

show abstract

Section: Development Of Hypotheses Methodology and Data Samplementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Cyber risk management in the US banking and insurance industry: A textual and empirical analysis of determinants and value

Gatzert

Schubert

2022

J of Risk & Insurance

View full text Add to dashboard Cite

show abstract

“…Several interesting works have arisen that study the emerging market for cyber risk insurance, see discussions in Eling and Schnell ( 2016 ), McShane et al. ( 2021 ) and the editorial and associated special issue of Boyer ( 2020 ) and references therein. Recently, McShane et al.…”

Section: Significance Of Cyber Risk Losses and Cyber Insurance Marketsmentioning

confidence: 99%

Cyber loss model risk translates to premium mispricing and risk sensitivity

Peters

Malavasi

Shevchenko

et al. 2023

Geneva Pap Risk Insur Issues Pract

View full text Add to dashboard Cite

In this paper we focus on model risk and risk sensitivity when addressing the insurability of cyber risk. The standard statistical approaches to assessment of insurability and potential mispricing are enhanced in several aspects involving consideration of model risk. Model risk can arise from model uncertainty and parameter uncertainty. We demonstrate how to quantify the effect of model risk in this analysis by incorporating various robust estimators for key model parameters that apply in both marginal and joint cyber risk loss process modelling. Through this analysis we are able to address the question that, to the best of our knowledge, no other study has investigated in the context of cyber risk: is model risk present in cyber risk data, and how does is it translate into premium mispricing? We believe our findings should complement existing studies seeking to explore the insurability of cyber losses.

show abstract

“…From a quantitative perspective, the likelihood and impact are the main components of a risk equation [83]. Risk mitigation in healthcare systems involves prioritizing, evaluating, and implementing the appropriate risk-reducing controls recommended by the cybersecurity risk management journal [89]. Different risk mitigation options are risk acceptance, risk avoidance, risk reduction, and risk transference.…”

Section: F Nist Orientation -Security Controls and Risk Managementmentioning

confidence: 99%

Digital Healthcare - Cyberattacks in Asian Organizations: An Analysis of Vulnerabilities, Risks, NIST Perspectives, and Recommendations

et al. 2022

View full text Add to dashboard Cite

Cyberattacks on healthcare institutions are on an upsurge all over the world. Recently, Asian hospitals have become targets of numerous cyberattacks. While Western countries like the United States have implemented security-related laws, policies, standards, and other protective measures to deal with the healthcare cyberattacks, Asian countries are lagging. The Healthcare insurance portability and accountability act (HIPAA), enacted by the United States federal government, is a classic example of a law that has been in existence for a quarter-century now. Awareness about electronic health records (EHR) and their importance is increasing in Asia. Many hospitals and healthcare systems successfully implement solutions to protect healthcare data, including sensitive patient data. However, protecting healthcare data involves a sophisticated technology and compliance-driven approach due to the high value associated with the data. In this research, an earnest attempt is made to investigate the recent cyberattacks in Asian healthcare institutions. Based on the investigation, five types of cyberattacks are found to dominate Asian healthcare institutions. A detailed analysis of these attacks, their vulnerabilities, and associated risks are performed as a part of this study. In many countries with higher cybersecurity maturity, risk frameworks are successfully employed to manage the risks associated with healthcare data. In this study, the cyberattacks on Asian healthcare institutions are also analyzed through the lens of the National Institute of standards and technology (NIST) risk framework. Based on the literature review, a few unique recommendations are included in this research study to be used as risk mitigation measures by Asian healthcare organizations and researchers to manage and improve the growing situation of cyberattacks.

show abstract

Cyber risk management: History and future research directions

Cited by 60 publications

References 135 publications

Cyber risk management in the US banking and insurance industry: A textual and empirical analysis of determinants and value

Cyber risk management in the US banking and insurance industry: A textual and empirical analysis of determinants and value

Cyber loss model risk translates to premium mispricing and risk sensitivity

Digital Healthcare - Cyberattacks in Asian Organizations: An Analysis of Vulnerabilities, Risks, NIST Perspectives, and Recommendations

Contact Info

Product

Resources

About