Reducing Informational Disadvantages to Improve Cyber Risk Management†

Security as a key contributor to organisational resilience: a bibliometric analysis of enterprise security risk management

“…Although in the late 1980s, there was already incipient work in the field, the risk management framework based on ERM appeared in the 1990s as a result of the need arising from a competitive and complex environment, seeking to link risk management with companies' activities (Arena et al 2010). ERM became the main form adopted by the companies making growing efforts to address uncertainty, which peaked in that decade (Shetty et al 2018). According to Govender (2019), Australia and New Zealand were the first countries to develop a holistic risk management model in 1999 through the AZ/NZS 4360 standard.…”

Time-varying effects of cyberattacks on firm value

“…More importantly, the impact of a cyberattack is difficult to estimate. Cybersecurity and insurance are subject to complex information asymmetry, correlated loss and interdependent security issues (Biener et al 2015;Eling 2018;Pooser et al 2018;Shetty et al 2018), making attacks difficult to prevent and problematic to adequately insure. 1 With widespread interconnectivity, a single attacker can cause simultaneous losses for multiple organisations running similar software platforms (correlated losses) and infiltration can occur via trusted external entities, such as a supplier or subcontractor, regardless of the robustness of the organisation's own cyber defense (interdependent security) (Böhme 2005;Ogut et al 2005;Akey et al 2020).…”

“…Even though estimated cyber losses were double those of natural catastrophe losses, total cyber premiums written in 2017 were only about USD 2 billion (Greenwald, 2018). 2 The articles in the special issue investigate the management of IT risks by banks (Ashby et al 2018), the perception of cyber risk by U.S. property casualty insurers (Pooser et al 2018), the role of insurance in managing cyber risk, including the proposal of a cyber risk scoring tool (Shetty et al 2018), and behavioural factors affecting perceptions of cyber risk by decision makers (de Smidt and Botzen 2018). particular, univariate and multivariate analyses of cumulative abnormal returns (CARs) indicate that stock market reactions were volatile during the early years of our sample, then became increasingly negative, but recently have started to moderate.…”

Integrating a Proactive Technique Into a Holistic Cyber Risk Management Approach

“…Unlike typical corporate risks, cyber threats result from intelligent actors who can adapt and change tactics as defenses are implemented, thus rendering past data quickly obsolete as a predictor of future attacks. In addition, cyber risks are plagued by information asymmetry, correlated loss, and interdependent security issues (Biener et al, 2015;Marotta et al, 2017;McShane et al, 2018;Shetty et al, 2018) that hamper traditional risk management and insurance practices from being effective.…”

“…An Institute for Critical Infrastructure Technology (ICIT) report argues that even a "script kiddie" 1 could cause serious damage to the system of a major healthcare provider, using only phishing attacks and exploit kits available on the Internet (ICIT, 2016). Generally, these attacks occur because organizations have common vulnerabilities (Böhme, 2005;Shetty et al, 2018), which are unintended flaws or design errors that enable an attacker to access multiple organizations.…”