tailieunhanh - Models and Measures for Correlation in Cyber-Insurance

In just over a third of the firms visited we found there were inadequate systems and controls in place around the sales process. Inadequate systems and controls of this sort indicate that the firm and the senior management have not given appropriate priority to compliance with regulatory obligations that were designed to provide positive outcomes for consumers. Just under two thirds of firms visited could not demonstrate they had taken sufficient steps to ensure their sales processes meet the required standards. This was particularly the case for those selling single-premium PPI alongside unsecured personal loans. We found differences in the quality of the systems and. | Models and Measures for Correlation in Cyber-Insurance Rainer Bohme Gaurav Kataria Institute for System Architecture Technische Universitat Dresden Heinz School of Policy and Management Carnegie Mellon University gauravk@ WORKING PAPER Abstract High correlation in failure of information systems due to worms and viruses has been cited as major impediment to cyber-insurance. However of the many cyber-risk classes that influence failure of information systems not all exhibit similar correlation properties. In this paper we introduce a new classification of correlation properties of cyber-risks based on a twin-tier approach. At the first tier is the correlation of cyber-risks within a firm . correlated failure of multiple systems on its internal network. At second tier is the correlation in risk at a global level . correlation across independent firms in an insurer s portfolio. Various classes of cyber-risks exhibit different level of correlation at two tiers for instance insider attacks exhibit high internal but low global correlation. While internal risk correlation within a firm influences its decision to seek insurance the global correlation influences insurers decision in setting the premium. Citing real data we study the combined dynamics of the two-step risk arrival process to determine conditions conducive to the existence of cyber-insurance market. We address technical managerial and policy choices influencing the correlation at both steps and the business implications thereof. Revision Workshop on the Economics of Information Security WEIS University of Cambridge UK June 2006 Contents 1 Introduction 3 2 The Correlated Nature of IT Security Risks 4 Classes of Cyber-Risk and Correlation. 4 Implications for Cyber-Insurance Policy Design. 5 3 Modeling the Market for Cyber-Insurance 5 Supply-Side Two-Step Risk Arrival with Correlation. 6 Intra-Firm Risk Correlation. 6 Global Risk .