SECONDO: A Platform for Cybersecurity Investments and Cyber Insurance Decisions

Abstract

This paper represents the SECONDO framework to assist organizations with decisions related to cybersecurity investments and cyber-insurance. The platform supports cybersecurity and cyber-insurance decisions by implementing and integrating a number of software components. SECONDO operates in three distinct phases: (i) cyber-physical risk assessment and continuous monitoring; (ii) investment-driven optimized cyber-physical risk control; and (iii) blockchain-enabled cyberinsurance contract preparation and maintenance. Insurers can leverage SECONDO functionalities to actively participate in the management of cyber-physical risks of a shipping company to reduce their insured risk.

Analyzing Coverages of Cyber Insurance Policies Using Ontology

“…The proposed ontology will be used between the Insured, the Broker and the Agent. We have to note the cyber insurance ontology is not standalone, but it is part of the SECONDO [4] architecture, which is responsible for providing a holistic security solution as a platform for organizations to fight cyber risks providing them with innovative security controls including risk transfer.…”

“…As the cyber-attacks become more sophisticated targeting a broad range of companies and state or private institutions, the cybersecurity is evolving too, together with the cyber-insurance. Cyber insurance is a rapidly developing area and an alternative way to deal with residual risks [4], [13]. Cyber-insurance is a powerful tool to incentivize the market towards protecting online businesses from information technology-related risks.…”

SaCI: A Blockchain-Based Cyber Insurance Approach for the Deployment and Management of a Contract Coverage

“…In this context, [2] introduces a conceptual framework for cybersecurity investments and cyber insurance decisions. The framework advocates the use of SCs for cyber insurance coverage and premium management as one of its key pillars.…”

MITRE ATT&CK-driven Cyber Risk Assessment

“…Existing work on cyber risk management has covered specific aspects such as cyber security culture, awareness and training [28,38], the impact and mitigation of cyber-attacks [7,25,33] and the cyber risk management process [5,32]. Organisations must implement effective cyber risk management practices aligned with their business objectives through protection [4,6,24,29,36], mitigation [7,16,28] and insurance [5,26,30] to contain the cyber risk and exposure. Risk management is a continuous process that must acknowledge the changing internal and external environment of the organisation.…”