Voluntary Participation in Cyber-insurance Markets Parinaz Naghizadeh, Mingyan Liu Department of Electrical Engineering and Computer Science University of Michigan, Ann Arbor, MI 13th Workshop on the Economics of Information Security (WEIS) June 24, 2014
Introduction Model and Contract Design Voluntary Participation Conclusion The cyber-insurance market 1 • Over 30 companies offering insurance in the US. • Growth of 10-25% in premiums reported. • Total amount of premiums estimated between $500M and $1bn. • Premiums $10k - $50M, coverage limits $16M - $300M. • Cyber-insurance proposed for both risk transfer and shaping incentives. 1 Romanosky, Comments to the Department of Commerce on Incentives to Adopt Improved Cybersecurity Practices , 2013. The Betterley Report: Cyber/Privacy Insurance Market Survey , 2012. Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 2 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion Interdependent security risks • Security investments of a user have positive externalities on other users. • Users’ preferences are in general heterogeneous: • Heterogeneous costs. • Different valuations of security risks. • Heterogeneity leads to under-investment. Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 3 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion Cyber-insurance literature Competitive markets Monopolistic markets [Shetty 10, Pal 13] [Hoffman 07, Lelarge 09] • Perfect competition with free • A single profit neutral insurer entry. (social planner). • Insurance contracts • Socially optimal investments optimized from individual in model with binary users’ viewpoint. decisions. • Decreases incentive to invest • Assumes compulsory in security, but individually insurance, participation rational. incentives not studied. Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 4 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion Outline Introduction Model and Contract Design Voluntary Participation Discussion and Conclusion Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 5 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion Interdependent security (IDS) investment game • A set of N users. • User i ’s action: invest x i ≥ 0 in security. • User i chooses x i to maximize its utility: u i ( x ) := − L i f i ( x ) − h i ( x i ) . L i : assets subject to loss f i ( x ): security risk of i , x vector of investments h i ( · ): cost of investment Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 6 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion Interdependent security (IDS) investment game • A set of N users. • User i ’s action: invest x i ≥ 0 in security. • User i chooses x i to maximize its utility: u i ( x ) := − L i f i ( x ) − h i ( x i ) . L i : assets subject to loss f i ( x ): security risk of i , x vector of investments h i ( · ): cost of investment Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 6 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion Interdependent security (IDS) investment game • A set of N users. • User i ’s action: invest x i ≥ 0 in security. • User i chooses x i to maximize its utility: u i ( x ) := − L i f i ( x ) − h i ( x i ) . L i : assets subject to loss f i ( x ): security risk of i , x vector of investments h i ( · ): cost of investment Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 6 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion Interdependent security (IDS) investment game • A set of N users. • User i ’s action: invest x i ≥ 0 in security. • User i chooses x i to maximize its utility: u i ( x ) := − L i f i ( x ) − h i ( x i ) . L i : assets subject to loss f i ( x ): security risk of i , x vector of investments h i ( · ): cost of investment Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 6 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion Interdependent security (IDS) investment game • A set of N users. • User i ’s action: invest x i ≥ 0 in security. • User i chooses x i to maximize its utility: u i ( x ) := − L i f i ( x ) − h i ( x i ) . L i : assets subject to loss f i ( x ): security risk of i , x vector of investments h i ( · ): cost of investment Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 6 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion Cyber-insurance implementation • A monopolist profit-neutral insurer, determines { ( ρ i , I i ) } N i =1 : premium and indemnification payment (coverage). • Utility of user i when purchasing insurance: u i ( x , ρ i , I i ) = − ( L i − I i ) f i ( x ) − h i ( x i ) − ρ i . • The positive externality investment mechanism [Hurwicz 79] Each participant i inputs message m i := ( χ i , π i ), consisting of an investment profile and a price profile. Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 7 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion Cyber-insurance implementation • A monopolist profit-neutral insurer, determines { ( ρ i , I i ) } N i =1 : premium and indemnification payment (coverage). • Utility of user i when purchasing insurance: u i ( x , ρ i , I i ) = − ( L i − I i ) f i ( x ) − h i ( x i ) − ρ i . • The positive externality investment mechanism [Hurwicz 79] Each participant i inputs message m i := ( χ i , π i ), consisting of an investment profile and a price profile. Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 7 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion Outline Introduction Model and Contract Design Voluntary Participation Discussion and Conclusion Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 8 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion On incentives to participate • User participation depends on: 1. game form 2. options when staying out • Most public good problems assume a zero share of resources for those staying out. • Security is a non-excludable public good: users can stay out and still free-ride on (possibly lower) levels of security. • Loner : stays out and best responds to the remaining N − 1 users. Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 9 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion On incentives to participate • User participation depends on: 1. game form 2. options when staying out • Most public good problems assume a zero share of resources for those staying out. • Security is a non-excludable public good: users can stay out and still free-ride on (possibly lower) levels of security. • Loner : stays out and best responds to the remaining N − 1 users. Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 9 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion On incentives to participate • User participation depends on: 1. game form 2. options when staying out • Most public good problems assume a zero share of resources for those staying out. • Security is a non-excludable public good: users can stay out and still free-ride on (possibly lower) levels of security. • Loner : stays out and best responds to the remaining N − 1 users. Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 9 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion On incentives to participate • User participation depends on: 1. game form 2. options when staying out • Most public good problems assume a zero share of resources for those staying out. • Security is a non-excludable public good: users can stay out and still free-ride on (possibly lower) levels of security. • Loner : stays out and best responds to the remaining N − 1 users. Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 9 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion On incentives to participate • User participation depends on: 1. game form 2. options when staying out • Most public good problems assume a zero share of resources for those staying out. • Security is a non-excludable public good: users can stay out and still free-ride on (possibly lower) levels of security. • Loner : stays out and best responds to the remaining N − 1 users. Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 9 / 14
Introduction Model and Contract Design Voluntary Participation Conclusion Reasons for opting out (I) Free riders paying for security; can enjoy spill-overs without paying. Free-rider 4 is happy; free-rider 1 would rather stay out. Expenditure in security in NE vs SO User Costs in PESIM vs Staying Out 50 50 Nash Equilibrium Socially Optimal Socially Optimal Staying Out 40 40 Investment in Security User Costs 30 30 20 20 10 10 0 0 1 2 3 4 5 1 2 3 4 5 User Index User Index Figure : Expenditure in security Figure : Participation Incentive Naghizadeh, Liu (Michigan) VP in Cyber-Insurance 10 / 14
Recommend
More recommend
