Managing interdependent information security risks: A study of cyber insurance, managed security service and risk pooling

ICIS 2009 Proceedings - Thirtieth International Conference on Information Systems

Volumn , Issue , 2009, Pages

  Zhao, Xia ^a   Xue, Ling ^b   Whinston, Andrew B ^c  

^a UNIVERSITY OF NORTH CAROLINA AT GREENSBORO   (United States)

^b UNIVERSITY OF SCRANTON   (United States)

^c UNIVERSITY OF TEXAS AT AUSTIN   (United States)

Author keywords

Cyberinsurance; Economics of information systems; Information security; Managed security service; Risk management; Risk pooling

Indexed keywords

CYBERINSURANCE; ECONOMICS OF INFORMATION; MANAGED SECURITY; MONOPOLY MARKETS; NEGATIVE EXTERNALITIES; NETWORK EXTERNALITY; RISK POOLING; SECURITY INVESTMENTS;

INDUSTRY; INFORMATION SYSTEMS; INSURANCE; INVESTMENTS; PROFITABILITY; RISK MANAGEMENT; SATELLITES; SECURITY OF DATA;

ECONOMICS;

EID: 84870958312     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (45)

1. Allen, J, Gabbard, D., May C. 2003. "Outsourcing Managed Security Services, Carnegie Mellon Software Engineering Institute.
2. Anderson R., Moore, T. The Economics of Information Security. Science (314), 2006, pp. 610-613.
3. Axelrod, C. W. Outsourcing Information Security, Artech House. 2004.
4. Ayres, I. and Levitt, S. Measuring Positive Externalities from Unobservable Victim Precaution: An Empirical Analysis of Lojack, The Quarterly Journal of Economics (113:1), 1998, pp. 43-77.
5. Cavusoglu, H., Mishra, B., Raghunathan, S. A Model for Evaluating IT Security Investments, Communications of the ACM (47:7), 2004, pp. 87-92.
6. Cavusoglu, H., Mishra, B., Raghunathan, S. The Value of Intrusion Detection Systems in Information Technology Security Architecture, Information Systems Research (16:1), 2005, pp. 28-46.
7. Cummins, J. D., Weiss, M. A. Organizational Form and Efficiency: The Coexistence of Stock and Mutual Property-Liability Insurers, Management Science (45:9), 1999, pp.1254-1270.
8. Ding, W., Yurcik, W. Outsourcing Internet Security: The Effect of Transaction Costs on Managed Service Providers, The International Conference on Telecommunication Systems-Modeling and Analysis, Dallas, Texas, November 17-20, 2005.
9. Ding, W., Yurcik, W. Economics of Internet Security Outsourcing: Simulation Results Based on the Schneier Model," The Workshop on the Economics of Securing the Information Infrastructure (WESII), Washington D.C., October 23-24, 2006.
10. Ding, W., Yurcik, W., Yin, X. Outsourcing Internet Security: Economic Analysis of Incentives for Managed Security Service Providers, The Workshop on Internet and Network Economics (WINE), Hong Kong, China, December 15-17, 2005.
11. Doherty, N. A., Dionne, G. Insurance with Undiversifiable Risk: Contract Structure and Organizational Form of Insurance Firms, Journal of Risk and Uncertainty (6), 1993, pp.187-203.
12. Gal-Or, E., Ghose, A. The Economic Incentives for Sharing Security Information, Information Systems Research (16:2), 2005, pp. 186-208
13. Garfinkel, R., Gopal, R., Goes, P. Privacy Protection of Binary Confidential Data against Deterministic, Stochastic, and Insider Threat, Management Science (48:6), 2002, pp.749-764.
14. Gattiker, U. E., Kelley, H. Morality and Computers: Attitudes and Differences in Moral Judgments, Information Systems Research (10:3), 1999, pp. 233-255.
15. Ghose, A., Rajan, U. The Economic Impact of Regulatory Information Disclosure on Information Security Investments, Competition, and Social Welfare, The Fifth Workshop on Economics of Information Security (WEIS2006), University of Cambridge, United Kingdom, June 26-28, 2006.
16. Gordon, L. A., Loeb, M. P. The Economics of Information Security Investment, ACM Transactions on Information and Systems Security (5:4), 2002, pp. 428-457
17. Gordon, L. A., Loeb, M. P. Budgeting Process for Information Security Expenditure, Communications of the ACM (49:1), 2006, pp. 121-125
18. Gordon, L. A., Loeb, M. P., Sohail, T. A Framework for Using Insurance for Cyber-risk Management, Communication of ACM (46:3), 2003, pp. 81-85
19. Gordon, L. A., Lucyshyn, W. Sharing Information on Computer System Security: An Economic Analysis, Journal of Accounting and Public Policy (22), 2003, pp. 461-485
20. Gupta, A., Zhdanov, D. Growth and Sustainability of Managed Security Services Networks: An Economic Perspective, The Workshop of the Economics on Information Security (WEIS), Pittsburgh, Pennsylvania, June 7-8, 2007
21. Holmstrom, B. Moral Hazard in Teams, Bell Journal of Economics (13:2), 1982, pp. 324-340.
22. Infonetics Research. Security and Encrypted VPN Services. Infornetics Report, 2008.
23. Kannan, K., Telang, R. Market for Software Vulnerabilities? Think Again, Management Science (51:5), 2005, pp. 726-740.
24. Kesan, J. P., Majuca, R. P., Yurcik, W. The Economic Case for Cyberinsurance, Securing Privacy in the Internet Age Symposium, Stanford University Press, 2005.
25. Kunreuther, H., Heal, G. Interdependent Security, Journal of Risk and Uncertainty (26:2/3), 2003, pp. 231-249.
26. Lee, W., Ligon, J. A. Moral Hazard in Risk Pooling Arrangements, Journal of Risk and Insurance (68:1), 2001, pp. 175-190.
27. Ligon, J. A., Thistle, P. D. The Formation of Mutual Insurers in Markets with Adverse Selection, Journal of Business (78:2), 2005, pp. 529-555.
28. Loch K. D., Carr, H. H., Warkentin, M. E. Threats to Information Systems: Today's Reality, Yesterday's Understanding, MIS Quarterly (16:2), 1992, pp. 173-186h.
29. Marshall, J. M. Insurance Theory: Reserves versus Mutuality, Economic Inquiry (12), 1974, pp. 476-492.
30. Mayers, D. Ownership Structure across Lines of Property-Causality Insurance, Journal of Law and Economics (31), 1988, pp. 351-378.
31. Mayers, D., Smith, C. W. Contractual Provisions, Organizational Structure and Conflict in Insurance Markets, Journal of Business (54), 1981, pp. 407-434.
32. McQuillan, L. H. How to Work with a Managed Security Service Provider? Harold F. Tipton, Micki Krause (eds.) Information Security Management Handbook. CRC Press. 2007, pp. 631-642.
33. Muralidhar, K., Parsa, R., Sarathy, R. A General Additive Data Perturbation Method for Database Security, Management Science (45:10), 1999, pp. 1399-1416.
34. Ogut, H., Menon, N., Raghunathan, S. Cyber Insurance and IT Security Investment: Impact of Interdependent Risk, Working paper, University of Texas at Dallas, 2005.
35. Parameswaran, M., Zhao, X., Whinston, A.B. and Fang F. Reengineering the Internet for Better Security, IEEE Computer, (40:1), 2007, pp. 40-44.
36. Powell, B. Is Cybersecurity a Public Good? Evidence from the Financial Services Industry, Independent Institute Working Paper, No. 57, 2005.
37. Richardson, R. 2008 CSI Computer Crime & Security Survey, 2009.
38. Rowe, B. R. Will Outsourcing IT Security Lead to a Higher Social Level of Security? The Workshop of the Economics on Information Security (WEIS), Pittsburgh, Pennsylvania. June 7-8, 2007.
39. Sarathy, R., Muralidhar, K. The Security of Confidential Numerical Data in Databases, Information Systems Research (13:4), 2002, pp. 389-403.
40. Straub, D. W., Welke R. J. Coping with Systems Risk: Security Planning Models for Managerial Decision Making, MIS Quarterly (22:4), 1998, pp. 441-469.
41. Swiss Re. The Picture of ART, Sigma, No.1 2003. Copyright Swiss Re.
42. Symantec. IT Risk Management Report-Trend through December 2006, Volume 1. Report published by Symantec, February 2007. http://www.symantec.com/riskreport/
43. Tanaka, H., Matsuura, K., Sudoh, O. Vulnerability and Information Security Investment: An Empirical Analysis of E-local Government in Japan, Journal of Accounting and Public Policy (24), 2005, pp. 37-59.
44. Varian, H. R. Managing Online Security Risks, New York Times 2000
45. Zhao, X., Fang, F. and Whinston, A.B. An Economic Mechanism for Better Internet Security, Decision Support Systems, (45:4), 2008, pp. 811-821.