Can Competitive Insurers Improve Network Security?
Purchase on Springer.com
$29.95 / €24.95 / £19.95*
* Final gross prices may vary according to local VAT.
The interdependent nature of security on the Internet causes a negative externality that results in under-investment in technology-based defences. Previous research suggests that, in such an environment, cyber-insurance may serve as an important tool not only to manage risks but also to improve the incentives for investment in security. This paper investigates how competitive cyber-insurers affect network security and user welfare. We utilize a general setting, where the network is populated by identical users with arbitrary risk-aversion and network security is costly for the users. In our model, a user’s probability to incur damage (from being attacked) depends on both his security and the network security.
First, we consider cyber-insurers who cannot observe (and thus, affect) individual user security. This asymmetric information causes moral hazard. If an equilibrium exists, network security is always worse relative to the no-insurance equilibrium. Though user utility may rise due to a coverage of risks, total costs to society go up due to higher network insecurity.
Second, we consider insurers with full information about their users’ security. Here, user security is perfectly enforceable (zero cost). Each insurance contract stipulates the required user security and covers the entire user damage. Still, for a significant range of parameters, network security worsens relative to the no-insurance equilibrium. Thus, although cyber-insurance improves user welfare, in general, competitive cyber-insurers may fail to improve network security.
- Anderson, R., Böehme, R., Clayton, R., Moore, T.: Security economics and european policy. In: Proceedings of WEIS 2008, Hanover, USA, June 25-28 (2008)
- Böhme, R.: Cyber-insurance revisited. In: Proceedings of WEIS 2005, Cambridge, USA (2005)
- Gordon, L.A., Loeb, M., Sohail, T.: A framework for using insurance for cyber-risk management. Communications of the ACM 46(3), 81–85 (2003) CrossRef
- Majuca, R.P., Yurcik, W., Kesan, J.P.: The evolution of cyberinsurance. Technical Report CR/0601020, ACM Computing Research Repository (2006)
- Soohoo, K.: How much is enough? A risk-management approach to computer security. PhD thesis, Stanford University
- Schechter, S.E.: Computer security strength and risk: a quantitative approach. PhD thesis, Cambridge, MA, USA, Adviser-Smith, Michael D (2004)
- Bolot, J., Lelarge, M.: A new perspective on internet security using insurance. In: The 27th Conference on Computer Communications, INFOCOM 2008, April 2008, pp. 1948–1956. IEEE, Los Alamitos (2008) CrossRef
- Boehme, R., Kataria, G.: Models and measures for correlation in cyber-insurance. In: Fifth Workshop on the Economics of Information Security (2006)
- Kunreuther, H., Heal, G.: Interdependent security. Journal of Risk and Uncertainty 26(2-3), 231–249 (2003) CrossRef
- Gordon, L.A., Loeb, M.P.: The economics of information security investment. ACM Trans. Inf. Syst. Secur. 5(4), 438–457 (2002) CrossRef
- Hausken, K.: Returns to information security investment: The effect of alternative information security breach functions on optimal investment and sensitivity to vulnerability. Information Systems Frontiers 8(5), 338–349 (2006) CrossRef
- Grossklags, J., Christin, N., Chuang, J.: Secure or insure? a game-theoretic analysis of information security games. In: WWW 2008: Proceeding of the 17th international conference on World Wide Web, pp. 209–218. ACM, New York (2008) CrossRef
- Varian, H.: System reliability and free riding. In: Workshop on the Economics of Information Security, WEIS 2002, Cambridge, USA (2002)
- Ogut, H., Menon, N., Raghunathan, S.: Cyber insurance and it security investment: Impact of interdependent risk. In: Proceedings of WEIS 2005, Cambridge, USA (2005)
- Hofmann, A.: Internalizing externalities of loss prevention through insurance monopoly: an analysis of interdependent risks. Geneva Risk and Insurance Review 32(1), 91–111 (2007) CrossRef
- Baer, W.S., Parkinson, A.: Cyberinsurance in it security management. IEEE Security and Privacy 5(3), 50–56 (2007) CrossRef
- Fisk, M.: Causes and remedies for social acceptance of network insecurity. In: Proceedings of WEIS 2002, Berkeley, USA (2002)
- Honeyman, P., Schwartz, G., Assche, A.V.: Interdependence of reliability and security. In: Proceedings of WEIS 2007, Pittsburg, PA (2007)
- Lelarge, M., Bolot, J.: Economic incentives to increase security in the internet: The case for insurance. In: INFOCOM 2009, April 2009, pp. 1494–1502. IEEE, Los Alamitos (2009)
- Radosavac, S., Kempf, J., Kozat, U.: Using insurance to increase internet security. In: Proceedings of NetEcon 2008, Seattle, USA, August 22 (2008)
- Shetty, N., Schwartz, G., Walrand, J.: Can Competitive Insurers improve Network Security (2010) (in preparation), www.eecs.berkeley.edu/~nikhils/SSW-Trust-Long.pdf
- Schwartz, G., Shetty, N., Walrand, J.: Cyber Insurance with Interdepedent Security and Aysmmetric Information (2010) (in preparation), www.eecs.berkeley.edu/~nikhils/EconSec.pdf
- Rothschild, M., Stiglitz, J.E.: Equilibrium in competitive insurance markets: An essay on the economics of imperfect information. The Quarterly Journal of Economics 90(4), 630–649 (1976) CrossRef
- Akerlof, G.A.: The market for ‘lemons’: Quality uncertainty and the market mechanism. The Quarterly Journal of Economics 84(3), 488–500 (1970) CrossRef
- Can Competitive Insurers Improve Network Security?
- Book Title
- Trust and Trustworthy Computing
- Book Subtitle
- Third International Conference, TRUST 2010, Berlin, Germany, June 21-23, 2010. Proceedings
- pp 308-322
- Print ISBN
- Online ISBN
- Series Title
- Lecture Notes in Computer Science
- Series Volume
- Series ISSN
- Springer Berlin Heidelberg
- Copyright Holder
- Springer-Verlag Berlin Heidelberg
- Additional Links
- Industry Sectors
- eBook Packages
- Editor Affiliations
- 16. Heinz College, Carnegie Mellon University
- 17. Department of Computer Science, 6211 Sudikoff Laboratory, Dartmouth College
- 18. System Security Lab, Ruhr University Bochum
- Author Affiliations
- 19. Electrical Engineering and Computer Sciences, University of California, Berkeley, Berkeley, California, 94720
To view the rest of this content please follow the download PDF link above.