Post-incident audits on cyber insurance discounts

Abstract

We introduce a game-theoretic model to investigate the strategic interaction between a cyber insurance policyholder whose premium depends on her self-reported security level and an insurer with the power to audit the security level upon receiving an indemnity claim. Audits can reveal fraudulent (or simply careless) policyholders not following reported security procedures, in which case the insurer can refuse to indemnify the policyholder. However, the insurer has to bear an audit cost even when the policyholders have followed the prescribed security procedures. As audits can be expensive, a key problem insurers face is to devise an auditing strategy to deter policyholders from misrepresenting their security levels to gain a premium discount. This decision-making problem was motivated by conducting interviews with underwriters and reviewing regulatory filings in the US; we discovered that premiums are determined by security posture, yet this is often self-reported and insurers are concerned by whether security procedures are practised as reported by the policyholders.To address this problem, we model this interaction as a Bayesian game of incomplete information and devise optimal auditing strategies for the insurers considering the possibility that the policyholder may misrepresent her security level. To the best of our knowledge, this work is the first theoretical consideration of post-incident claims management in cyber security. Our model captures the trade-off between the incentive to exaggerate security posture during the application process and the possibility of punishment for non-compliance with reported security policies. Simulations demonstrate that common sense techniques are not as efficient at providing effective cyber insurance audit decisions as the ones computed using game theory.

Optimising user security recommendations for AI-powered smart-homes

“…It is evident from the results that the risk to occupants increases with an increase in several smart devices in the home. Such insights on the level of risk could assist cyber insurers inappropriately profiling home occupants and designing custom insurance policy packages [36]- [38] with premium discounts [39]. To understand the impact of knowledge and time required to implement controls on a user group, we extend our analysis by considering the budget required to improve a level of time or knowledge i.e, from low to medium and medium to a high level.…”

MITRE ATT&CK-driven Cyber Risk Assessment

“…Existing work on cyber risk management has covered specific aspects such as cyber security culture, awareness and training [28,38], the impact and mitigation of cyber-attacks [7,25,33] and the cyber risk management process [5,32]. Organisations must implement effective cyber risk management practices aligned with their business objectives through protection [4,6,24,29,36], mitigation [7,16,28] and insurance [5,26,30] to contain the cyber risk and exposure. Risk management is a continuous process that must acknowledge the changing internal and external environment of the organisation.…”

GTM: Game Theoretic Methodology for optimal cybersecurity defending strategies and investments

“…On the other hand, one of the most pressing issues that organizations face nowadays is to manage cyber risks, which involves protection [2,3,11,17,27,34], mitigation [4,12,26,30] and insurance [10,24,28]. The most common reason that hinders this process is the limited budget.…”