Optimal Investment in Cyber-Security under Cyber Insurance for a Multi-Branch Firm

Abstract

Investments in security and cyber-insurance are two cyber-risk management strategies that can be employed together to optimize the overall security expense. In this paper, we provide a closed form for the optimal investment under a full set of insurance liability scenarios (full liability, limited liability, and limited liability with deductibles) when we consider a multi-branch firm with correlated vulnerability. The insurance component results to be the major expense. It ends up being the only recommended approach (i.e., setting zero investments in security) when the intrinsic vulnerability is either very low or very high. We also study the robustness of the investment choices when our knowledge of vulnerability and correlation is uncertain, concluding that the uncertainty induced on investment by either uncertain correlation or uncertain vulnerability is not significant.

Cyber Insurance Premium Setting for Multi-Site Companies under Risk Correlation

“…They use ruin theory to compute the premium, which is based on the loading factor formula, precisely as loading on the average amount of claims. The same approach considered here has been proposed by Xu et al (2019) for the optimal allocation of cyber security investments for headquarters and its branches subjected to cyber risk interconnections and by Mazzoccoli and Naldi (2021) to obtain a closed formula for the optimal investment in security under a set of cyber insurance liability scenarios considering a multi-branch firm with correlated vulnerability.…”

“…A further problem arises when we consider a set of vulnerable entities whose risks are correlated. This is the case, e.g., for a company's headquarters and its branches, where a breach in any of the entities may disclose information to breach other entities Khalili et al (2018); Mazzoccoli and Naldi (2021); Xu et al (2019). Though this topic has been extensively addressed in the literature, the models proposed are often complex and may not be easy to apply in an industrial context.…”

An Overview of Security Breach Probability Models

“…The model is graphed in Figure 2. 2016) and Mazzoccoli and Naldi (2021). Young et al (2016), Rosson et al (2019), and Mazzoccoli and Naldi (2020b) used this model to evaluate the optimal investment in security together with the presence of insurance coverage against cyber-risks, either through simulation or through closed mathematical formulas.…”

“…Skeoch (2022) has also embraced a similar approach, but employing a utility function (either logarithmic or exponential) and adopting a percentage premium. The analysis has then been extended by Mazzoccoli and Naldi (2021) to the case of a firm with multiple branches and interdependencies, chasing the problem introduced by . The importance of interdependencies is also examined by Uuganbayar et al (2021), who examine the possible incentivizing impact that cyberinsurance has on security investments in the case of interdependence.…”

Risk mitigation services in cyber insurance: optimal contract design and price structure

“…( 2016 ), and subsequently Mazzoccoli and Naldi ( 2020 ), or Yang and Lui ( 2014 ), Chase et al. ( 2017 ), and Mazzoccoli and Naldi ( 2021 ) who investigate optimal security investments under the presence of cyber insurance in a heterogeneous network, in a cloud computing environment, and for a multi-branch firm with correlated vulnerabilities, respectively. Zhang and Zhu ( 2021 ) use a dynamic moral hazard type of principal–agent model with Markov decision processes to capture decisions on self-protection of the insured and Skeoch ( 2022 ) expands the Gordon–Loeb model (Gordon and Loeb 2002 ) for cybersecurity to a cyber insurance context.…”