On Robust Estimates of Correlated Risk in Cyber-Insured IT Firms

Abstract

In this article, we comment on the drawbacks of the existing AI-based Bayesian network (BN) cybervulnerability analysis (C-VA) model proposed in Mukhopadhyay et al. (2013) to assess cyber-risk in IT firms, where this quantity is usually a joint distribution of multiple risk (random) variables (e.g., quality of antivirus, frequency of monitoring, etc.) coming from heterogeneous distribution families. As a major modeling drawback, Mukhopadhyay et al. (2013) assume that any pair of random variables in the BN are linearly correlated with each other. This simplistic assumption might not always hold true for general IT organizational environments. Thus, the use of the C-VA model in general will result in loose estimates of correlated IT risk and will subsequently affect cyber-insurance companies in framing profitable coverage policies for IT organizations. To this end, we propose methods to (1) find a closed-form expression for the maximal correlation arising between pairs of discrete random variables, whose value finds importance in getting robust estimates of copula-induced computations of organizational cyber-risk, and (2) arrive at a computationally effective mechanism to compute nonlinear correlations among pairs of discrete random variables in the correlation matrix of the CBBN model (Mukhopadhyay et al. 2013). We also prove that an empirical computation of MC using our method converges rapidly, that is, exponentially fast, to the true correlation value in the number of samples. Our proposed method contributes to a tighter estimate of IT cyber-risk under environments of low-risk data availability and will enable insurers to better assess organizational risks and subsequently underwrite profitable cyber-insurance policies. CCS Concepts: • Mathematics of computing → Probability and statistics; Multivariate statistics; • Security and privacy → Human and societal aspects of security and privacy; Economics of security and privacy;

Insurance in the Industry 4.0 environment: A literature review, synthesis, and research agenda

“…Accessing and processing customer data obtained through devices raises many data protection and privacy issues not only for the customers but also for the multiple parties involved (Ostrowska, 2021). The awareness of such technologies is low, and the lack of robust cybersecurity systems increases the chances of cyberattacks, impeding their adoption by insurers (Pal et al, 2019). In the insurance sector, the multiple parties involved in such technologies need to be protected from fraudulent transactions and inherent solvency risks, and a mechanism for dispute settlement for automated transactions is necessary (Sheth and Subramanian, 2019).…”

Evaluation of AI-based use cases for enhancing the cyber security defense of small and medium-sized companies (SMEs)

“…AI can help to identify and prioritize security related risks [31]. AI-based approaches do already exist to assess cyber-risks in IT firms [18]. A major advantage: less personnel (e.g.…”