Optimisation of cyber insurance coverage with selection of cost effective security controls

2021-02-01

Computers & security

AI Summary

This study addresses enterprise cybersecurity risk management by jointly optimizing cybersecurity investments (i.e., security control configurations) and cyber insurance decisions (coverage amount and premium) to minimize total risk cost. We propose the first unified optimization framework that simultaneously incorporates insurance strategies and technical security investments, thereby balancing risk transfer and risk reduction. Our methodology integrates integer nonlinear programming, attack graph modeling, Monte Carlo risk simulation, and cost–benefit sensitivity analysis. Evaluated across multiple industry case studies, the model reduces aggregate risk cost by 18–32% and significantly improves the risk-mitigation efficiency per unit security investment. The framework delivers a computationally tractable, empirically verifiable, and quantitatively grounded decision-support tool for strategic cybersecurity resource allocation.

Technology Category

• Search and Optimization: Combinatorial Optimization
• Constraint Satisfaction and Optimization: Distributed CSP/Optimization
• Reasoning under Uncertainty: Stochastic Optimization

Application Category

• Security and Privacy: Large-scale security measurements
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Problem

• Optimize cyber insurance and self-protection investments
• Select cost-effective security controls for risk reduction
• Compare exact and approximate algorithms for control selection

Innovation

• Optimizes cyber insurance and security investments
• Selects cost-efficient security controls explicitly
• Provides exact algorithm for control selection