Pricing the Cost of Cybercrime—A Financial Protection Approach

Abstract

Infrastructures, businesses, end-users and services offered in the digitally integrated environment are exposed to a wide range of risks such as denial of service, hacking, phishing, ransomware, viruses, etc. Consequently, along with their physical life, individuals and organizations have to secure their digital life as well. Digital threats may have a major economic impact both on the individuals and the society, through the direct loss of income and/or property or even an indirect reduction of the individuals' contribution back to the society and the state. The purpose of this paper is to study the effect of cyber-attacks to the economy, to price the associated cost and to recommend possible measures that internet service providers (ISPs) and policy makers can apply in order to mitigate these risks. In order to achieve that, we employ insurance (actuarial) pricing techniques to calculate the cost of cyber-attacks for an individual and for the economy of a country in total. We are therefore at the same time in place to recommend insurance coverage solutions that can assist in protecting the entity of interest from cyber risks. This resembles to the calculation of a risk premium, as the premium is calculated taking into account only the probability of occurrence of a cyber-attack and the interest rate and not any other loadings. In this context, we mimic the pricing of a policy that provides coverage for the cyber-attack, as well as the calculation of the amount that has to be set aside in order to compensate for the one-off economic loss suffered by the individual, as a result of its occurrence. Here lies our contribution to the scientific research in the field of cyber security insurance, as we employ insurance-based actuarial techniques in order to quantify the relevant loss.

Optimal Cyber Security Investment in a Mixed Risk Management Framework: Examining the Role of Cyber Insurance and Expenditure Analysis

“…Beyond the immediate consequences of attacks, being exposed to cyber attacks has extensive implications on the market value of companies, as examined by Smith and Lostri (2020); Arcuri et al (2017); and Kamiya et al (2020). Estimating the actual costs is a research topic in itself, as evidenced by several papers, such as those by Dieye et al (2020); Furnell et al (2020); Poufinas and Vordonis (2018); Romanosky (2016);and The Ponemon Institute (2016).…”

An Overview of Security Breach Probability Models

“…A similar reverse approach has been put forward by Woods et al (2021), who use particle swarm optimization to derive a cyberloss distribution from cyberinsurance prices. The estimation of the actual costs is a research theme itself, as shown in several papers, e.g., by Hua and Bapna (2013); Kamiya et al (2020); Poufinas et al (2018);World Economic Forum (2015) and The Ponemon Institute ( 2016). An econometric approach relating cyberlosses to company size has been proposed by Yamada et al (2019).…”