Cyber Security Risk Management: Public Policy Implications of Correlated Risk, Imperfect Ability to Prove Loss, and Observability of Self-Protection

Risk Analysis

Volumn 31, Issue 3, 2011, Pages 497-512

  Öǧüt, Hulisi ^a   Raghunathan, Srinivasan ^b   Menon, Nirup ^c  

^a TOBB UNIVERSITY OF ECONOMICS AND TECHNOLOGY   (Turkey)

^b UNIVERSITY OF TEXAS AT DALLAS   (United States)

^c GEORGE MASON UNIVERSITY   (United States)

Author keywords

Cyber security; Insurance; Risk management

Indexed keywords

CAN DESIGN; CORRELATED RISKS; CYBER SECURITY; EXTERNAL AGENTS; INSURANCE MARKETS; INSURANCE PREMIUMS; OPTIMAL LEVEL; OPTIMAL RESULTS; POLICY IMPLICATIONS; SECURITY BREACHES; SOCIAL PLANNERS;

INDUSTRY; INSURANCE; OPTIMIZATION; PUBLIC POLICY; PUBLIC RISKS; RISK MANAGEMENT;

SECURITY OF DATA;

INSURANCE SYSTEM; INTERNET; INVESTMENT; POLICY IMPLEMENTATION; RISK ASSESSMENT; SECURITY THREAT; SOCIAL POLICY; SUBSIDY SYSTEM; TAX SYSTEM;

EID: 79952411353     PISSN: 02724332     EISSN: 15396924     Source Type: Journal    
DOI: 10.1111/j.1539-6924.2010.01478.x     Document Type: Article

References (33)

1. Cavusoglu H, Mishra B, Raghunathan S. The effect of Internet security breach announcements on market value: Capital market reaction for breached firms and Internet security developers. International Journal of Electronic Commerce, 2004; 9(1):69-105.
2. Ponemon L. National Survey on the Detection and Prevention of Data Security Breaches, 2006. Available at:, Accessed on September 11, 2006.
3. Pauli D, Crawford M. Cyber Insurance, What's That 2006. Available at:, Accessed on July 23, 2006.
4. Harrington SE, Neihaus GR. Risk Management and Insurance, 2nd ed. New York: McGraw-Hill/Irwin, 2003.
5. Ehrlich I, Becker GS. Market insurance, self-insurance, and self-protection. Journal of Political Economy, 1972; 80(4):623-648.
6. Rothschild M, Stiglitz J. Equilibrium in competitive insurance markets: An essay on the economics of imperfect information. Quarterly Journal of Economics, 1976; 90(4):629-649.
7. Dionne G, Harrington SE. An Introduction to Insurance Economics, Foundations in Insurance Economics. Boston, MA Kluwer Academic Publishers, 1992.
8. Orszag PR, Stiglitz JE. Optimal Fire Departments: Evaluating Public Policy in the Face of Externalities, 2002. Available at:, Accessed on September 19, 2005.
9. Lakdawalla D, Zanjani G. Insurance, self-protection, and the economics of terrorism. Journal of Public Economics, 2005; 89(9-10):891-1905.
10. Anderson R. Why Information Security is Hard: A Economic Perspective, 2001. Available at:, Accessed on September 19, 2005.
11. Gordon LA, Loeb MP. The economics of information security investment. ACM Transactions on Information and System Security, 2002; 5(4):438-457.
12. Varian H. System Reliability and Free Riding, Workshop on Economics and Information Security, College Park, MD, 2002.
13. Kunreuther H, Heal G. Interdependent security. Journal of Risk and Uncertainty, 2003; 26(2-3):231-249.
14. Hausken K. Income, interdependence, and substitution effects affecting incentives for security investment. Journal of Accounting and Public Policy, 2006; 25(6):629-665.
15. Cremonini M, Nizovtsev D. Understanding and Influencing Attackers' Decisions: Implications for Security Investment Strategies. Workshop on the Economics of Information Security, Cambridge, UK 2006.
16. Gordon LA, Loeb MP, Lucyshyn W. Sharing information on computer system security: An economic analysis. Journal of Accounting and Public Policy, 2003; 22(6):461-485.
17. Gal-Or E, Ghose A. The economic incentives for sharing security information. Information Systems Research, 2005; 16(2):186-208.
18. Majuca RP, Yurcik W, Kesan JP. The Evolution of Cyberinsurance, 2005. Available at:, Accessed on September 19, 2005.
19. Gordon LA, Loeb MP, Sohail T. A framework for using insurance for cyber-risk management. Communications of the ACM, 2003; 44(9):70-75.
20. Böhme R, Kataria G. Models and Measures for Correlation in Cyber-Insurance. Workshop on the Economics of Information Security, Cambridge, UK 2006.
21. Mukhopadhyay A, Chatterjee S, Saha D, Mahanti A, Sadhukan SK. e-Risk Management with Insurance: A Framework Using Copula Aided Bayesian Belief Networks. Hawaii International Conference on System Sciences, Hawaii, 2006.
22. Herath H, Herath T. Cyber-Insurance: Copula Pricing Framework and Implications for Risk Management. Workshop on the Economics of Information Security, Pittsburgh, PA, 2007.
23. Bolot J, LeLarge M. Cyber Insurance as an Incentive for Internet Security. Workshop on the Economics of Information Security, Hanover, NH, 2008.
24. Shetty N, Schwartz G, Felegyhazi M, Walrand J. Competitive Cyber-Insurance and Internet Security. Workshop on the Economics of Information Security, London, 2009.
25. Arrow KJ. Uncertainty and the welfare of medical care. American Economic Review, 1963; 53:941-973.
26. Pauly MV. The economics of moral hazard: Comment. American Economic Review, 1968; 58:531-537.
27. Spence M, Zeckhauser R. Insurance, information and individual action. American Economic Review, 1971; 61(2):380-387.
28. Shavell S. On moral hazard and insurance. Quarterly Journal of Economics, 1979; 93(4):541-562.
29. Hart O, Holmstrom B. The theory of contracts. In Bewley T (ed). Advances in Economic Theory. New York Cambridge University Press, 1987.
30. Crews CW. 2005. Cyber Security Finger-Pointing, 2005. Available at:, Accessed on September 19, 2005.
31. Pigou AC. Economics of Welfare. London Macmillan, 1920.
32. Coase R. The problem of social cost. Journal of Law and Economics, 1960; 3:1-44.
33. Holmstrom B. Moral hazard in teams. Bell Journal of Economics, 1982; 13(2):324-340.