Towards Insurable Network Architectures – 11/5/09
ø
This talk reviews opportunities and challenges in establishing a market for cyber-insurance. It is argued that dealing with cyber-risks, regardless on which level (individual,organizational, national), needs some kind of risk transfer. However, lack of system diversity in network architectures imposes tight upper bounds on the supply of cyber-insurance, as homogeneous architectures share common vulnerabilities and this increases the variance of the loss distribution due to security incidents in insurers’ portfolios. Hence, network architecture – and behind it the market structure of the ICT industry – is a significant factor in society’s ability to manage and absorb cyber-risks. The talk outlines the basic economic models behind these arguments, presents conditions under which markets for cyber-insurance can exist, and discusses policy options to stimulate the adoption of cyber-insurance as well as possible alternative forms of cyber-risk transfer.
