More Like this

1. Embracing and Controlling Risk Dependency in Cyber Insurance Policy Underwriting

   Khalili, M.; Liu, M. and (June 2018, The Annual Workshop on the Economics of Information Security (WEIS))

   This paper highlights how cyber risk dependencies can be taken into consideration when underwrit- ing cyber-insurance policies. This is done within the context of a base rate insurance policy framework, which is widely used in practice. Specifically, we show that there is an opportunity for an underwriter to better control the risk dependency and the risk spill-over, ultimately resulting in lower overall cyber risks across its portfolio. To do so, we consider a Service Provider (SP) and its customers as the interdependent insurer’s customers: a data breach suffered by the SP can cause business interruption to its customers. In underwriting both the SP and its customers, we show that the insurer can increase its profit by incentivizing the SP (through a discount on its premium) to invest more in security, thereby decreasing the chance of business interruption to the customers and increasing social welfare. For comparison, we also consider a scenario where the insurer underwrites only the SP’s customers (but not the SP), and receives compensation from the SP’s insurance carrier when losses are attributed to the SP. We show that the insurer cannot outperform the case where it underwrites both the SP and its customers. We use an actual cyber-insurance policy and claims data to calibrate and substantiate our analytical findings. 

   more » « less
2. Semantically Rich Framework to Automate Cyber Insurance Services

   https://doi.org/10.1109/TSC.2021.3113272  

   Sane, Ketki; Joshi, Karuna Pande; Mittal, Sudip (September 2021, IEEE Transactions on Services Computing)

   With the rapid enhancements in technology and the adoption of web services, there has been a significant increase in cyber threats faced by organizations in cyberspace. Organizations want to purchase adequate cyber insurance to safeguard against the third-party services they use. However, cyber insurance policies describe their coverages and exclusions using legal jargon that can be difficult to comprehend. Parsing these policy documents and extracting the rules embedded in them is currently a very manual time-consuming process. We have developed a novel framework that automatically extracts the coverage and exclusion key terms and rules embedded in a cyber policy. We have built our framework using Information Retrieval and Artificial Intelligence techniques, specifically Semantic Web and Modal Logic. We have also developed a web interface where users can find the best matching cyber insurance policy based on particular coverage criteria. To validate our approach, we used industry standards proposed by the Federal Trade Commission document (FTC) and have applied it against publicly available policies of seven insurance providers. Our system will allow cyber insurance seekers to explore various policy documents and compare the paradigms mentioned in those documents while selecting the best relevant policy documents. 

   more » « less
3. The Demand for Insurance and Rationale for a Mandate: Evidence from Workers’ Compensation Insurance

   https://doi.org/10.1257/aer.20190261  

   Cabral, Marika; Cui, Can; Dworsky, Michael (May 2022, American Economic Review)

   Workers’ compensation insurance, which provides no-fault coverage for work-related injuries, is mandatory in nearly all states. We use administrative data from a unique market without a coverage mandate to estimate the demand for workers’ compensation insurance, leveraging regulatory premium updates for identification. We find that a 1 percent increase in premiums leads to approximately a 0.3 percent decline in coverage. Drawing upon these estimates and data on costs, we examine potential justifications for government intervention to increase coverage. This analysis suggests that several forms of market failure—such as adverse selection, market power, and externalities—may not justify a mandate in this setting. (JEL G22, G52, J28, K13, K31) 

   more » « less
4. Embracing risk dependency in designing cyber-insurance contracts

   https://doi.org/10.1109/ALLERTON.2017.8262837  

   Khalili, Mohammad Mahdi; Naghizadeh, Parinaz; Liu, Mingyan (October 2017, 2017 55th Annual Allerton Conference on Communication, Control, and Computing (Allerton))

   We study the problem of designing cyber insurance policies in an interdependent network, where the loss of one agent (a primary party) depends not only on his own effort, but also on the investments and efforts of others (third parties) in the same eco-system (i.e., externalities). In designing cyber insurance policies, the conventional wisdom is to avoid insuring dependent parties for two reasons. First, simultaneous loss incidents threaten the insurer's business and capital. Second, when a loss incident can be attributed to a third party, the insurer of the primary party can get compensation from the insurer of the third party in order to reduce its own risk exposure. In this work, we analyze an interdependent network model in order to understand whether an insurer should avoid or embrace risks interdependencies. We focus on two interdependent agents, where the risk of one agent (primary party) depends on the other agent (third party), but not the other way around. We consider two potential scenarios: one in which an insurer only insures a primary party, and another one in which the insurer of the primary party further insures the third party agent. We show that it is in fact profitable for the primary party's insurer to insure both agents. Further, we show that insuring both agents not only provides higher profit for the insurer, but also reduces the collective risk. 

   more » « less
5. A Semantic Approach for Automating Knowledge in Policies of Cyber Insurance Services

   https://doi.org/10.1109/ICWS.2019.00018  

   Joshi, Ketki; Pande Joshi, Karuna; Mittal, Sudip (July 2019, 2019 IEEE International Conference on Web Services (ICWS))

   With the rapid adoption of web services, the need to protect against various threats has become imperative for organizations operating in cyberspace. Organizations are increasingly opting to get financial cover in the event of losses due to a security incident. This helps them safeguard against the threat posed to third-party services that the organization uses. It is in the organization’s interest to understand the insurance requirements and procure all necessary direct and liability coverages. This helps transfer some risks to the insurance providers. However, cyber insurance policies often list details about coverages and exclusions using legalese that can be difficult to comprehend. Currently, it takes a significant manual effort to parse and extract knowledgeable rules from these lengthy and complicated policy documents. We have developed a semantically rich machine processable framework to automatically analyze cyber insurance policy and populate a knowledge graph that efficiently captures various inclusion and exclusion terms and rules embedded in the policy. In this paper, we describe this framework that has been built using technologies from AI, including Semantic Web, Modal/ Deontic Logic, and Natural Language Processing. We have validated our approach using industry standards proposed by the United States Federal Trade Commission (FTC) and applying it against publicly available policies of 7 cyber insurance vendors. Our system will enable cyber insurance seekers to automatically analyze various policy documents and make a well informed decision by identifying its inclusions and exclusions. 

   more » « less