Improving Network Security Via Cyber-Insurance A Market Analysis

Transcription

1 1 Impoving Netwok Secuity Via Cybe-Insuance A Maket Analysis RANJAN PAL, LEANA GOLUBCHIK, KONSTANTINOS PSOUNIS Univesity of Southen Califonia PAN HUI Hong Kong Univesity of Science and Technology Recent wok in secuity has illustated that solutions aimed at detection and elimination of secuity theats alone ae unlikely to esult in a obust cybespace. As an othogonal appoach to mitigating secuity poblems, some have pusued the use of cybe-insuance as a suitable isk management technique. Such an appoach has the potential to jointly align the incentives of secuity vendos (e.g., Symantec, Micosoft), cybe-insues (e.g., ISPs, cloud povides, secuity vendos), egulatoy agencies (e.g., govenment), and netwok uses (individuals and oganizations), in tun paving the way fo compehensive and obust cybe-secuity mechanisms. To this end, in this wok, we ae motivated by the following impotant question: can cybe-insuance eally impove the secuity in a netwok? To addess this question, we adopt a maket-based appoach. Specifically, we analyze egulated monopolistic and competitive cybe-insuance makets, whee the maket elements consist of isk-avese cybe-insues, isk-avese netwok uses, a egulatoy agency, and secuity vendos. Ou esults show that (i) without contact discimination amongst uses, thee always exists a unique maket equilibium fo both maket types, but the equilibium is inefficient and does not impove netwok secuity, and (ii) in monopoly makets, contact discimination amongst uses esults in a unique maket equilibium that is efficient, which in tun esults in netwok secuity impovement - howeve, the cybe-insue can make zeo expected pofit. The latte fact is often sufficient to de-incentivize the insue to be a pat of a maket, and will eventually lead to its collapse. This fact also emphasizes the need fo designing mechanisms that incentivize the insue to pemanently be pat of the maket. In this egad, we popose a non-egulatoy mechanism to allow monopoly cybe-insues to make stictly positive pofit. Categoies and Subject Desciptos: C.4 [Pefomance of Systems] Modeling Techniques; K.6.5 [Management of Computing and Infomation Systems]: Secuity and Potection Insuance Geneal Tems: Pefomance, Secuity, Economics Additional Key Wods and Phases: secuity, cybe-insuance, maket, equilibium 1. INTRODUCTION The infastuctue, the uses, and the sevices offeed on compute netwoks today ae all subject to a wide vaiety of isks posed by theats that include distibuted denial of sevice attacks, intusions of vaious kinds, eavesdopping, hacking, phishing, woms, viuses, spams, etc. In ode to counte the isk posed by these theats, netwok uses have taditionally esoted to antivius and anti-spam softwae, fiewalls, intusion-detection systems (IDSs), and othe add-ons to educe the likelihood of being affected by theats. In pactice, a lage industy (companies like Symantec, McAfee, etc.) as well as consideable eseach effots ae cuently centeed aound developing and deploying tools and techniques to detect theats and anomalies in ode to potect the cybe infastuctue and its uses fom the esulting negative impact of the anomalies. Inspite of impovements in isk potection techniques ove the last decade due to hadwae, softwae and cyptogaphic methodologies, it is impossible to achieve pefect/nea-pefect cybe-secuity potection [Andeson and Mooe 2008][Lelage and Bolot 2009]. The impossibility aises due to a numbe of easons: (i) scace existence of sound technical solutions, (ii) difficulty in designing solutions cateed ACM Tansactions on Pefomance Evaluation of Compute Systems, Vol. V, No. N, Aticle 1, Publication date: Januay YY.

2 1:2 Pal, Golubhik, Psounis, and Hui to vaied intentions behind netwok attacks, (iii) misaligned incentives between netwok uses, secuity poduct vendos, and egulatoy authoities egading potecting the netwok, (iv) netwok uses taking advantage of the positive secuity effects geneated by othe uses investments in secuity, in tun themselves not investing in secuity and esulting in the fee-iding poblem, (v) custome lock-in and fist move effects of vulneable secuity poducts, (vi) difficulty to measue isks esulting in challenges to designing petinent isk emoval solutions, (vii) the poblem of a lemons maket [Akelof 1970], wheeby secuity vendos have no incentive to elease obust poducts in the maket, (viii) liability shell games played by poduct vendos, and (ix) use naiveness in optimally exploiting featue benefits of technical solutions. In view of the above mentioned inevitable baies to nea 100% isk mitigation, the need aises fo altenative methods fo isk management in cybespace 1. In this egad, some secuity eseaches in the ecent past have identified cybe-insuance as a potential tool fo effective isk management. Cybe-insuance is a isk management technique via which netwok use isks ae tansfeed to an insuance company, in etun fo a fee, i.e., the insuance pemium. Examples of potential cybeinsues might include ISP, cloud povide, taditional insuance oganizations. Poponents of cybeinsuance believe that cybe-insuance would lead to the design of insuance contacts that would shift appopiate amounts of self-defense liability to the clients, theeby making the cybespace moe obust. Hee the tem self-defense implies the effots by a netwok use to secue thei system though technical solutions such as anti-vius and anti-spam softwae, fiewalls, using secue opeating systems, etc. Cybe-insuance has also the potential to be a maket solution that can align with economic incentives of cybe-insues, uses (individuals/oganizations), policy makes, and secuity softwae vendos. i.e., the cybe-insues will ean pofit fom appopiately picing pemiums, netwok uses will seek to hedge potential losses by jointly buying insuance and investing in self-defense mechanisms, policy makes would ensue the incease in oveall netwok secuity, and the secuity softwae vendos could expeience an incease in thei poduct sales via foming alliances with cybe-insues. 1.1 Reseach Motivation Despite initial hopes, cuent cybe-insuance makets ae modeately competitive and specialized - lage to medium/scale business being the sole insuance clients. Thee ae cuently ove 30 insuance companies offeing cybe-insuance contacts in the United States. Many insues have epoted gowths of 10-25% in pemiums in a 2012 suvey of the maket, with some companies even epoting highe ates [Naghizadeh and Liu 2014]. We efe the inteested eade to [Romanovsky 2013][Bettely 2012][Aimic 2013] fo additional infomation on both the US and UK insuance makets, as well as common types of coveage offeed though these policies, and the typical exclusions. The impotant thing to note fom these studies is that the total cybe-insuance business cuently amounts to US$ 2 billion, wheeas the total cost of secuity beaches to the global economy amounts to a whopping US$ 445 billion [Thompson 2014]. The inability to bidge this huge financial gap and fom a successful cybe-insuance maket is mainly due to the fact that cuent cybe-insuance makets pimaily taget businesses and fail to each out to the common population mass. A plausible eason fo this tend is the existence of a numbe of unesolved eseach challenges and pactical consideations [Bohme and Schwatz 2010], the most pominent amongst them being (i) infomation asymmety between the insue and the insued on loss infomation, and (ii) the intedependent and coelated natue of cybe-isks 2. We efe the eade 1 To highlight the impotance of impoving the cuent state of cybe-secuity, US Pesident Baack Obama has passed a secuity bill in 2013 that emphasizes the need to educe cybe-theats and be esilient to them. 2 In this wok we use the tems isk and expected loss intechangeably. ACM Tansactions on Pefomance Evaluation of Compute Systems, Vol. V, No. N, Aticle 1, Publication date: Januay YY.

3 Impoving Netwok Secuity Via Cybe-Insuance: A Maket Analysis 1:3 to Section 2 and the Appendix espectively, fo a bief desciption of insuance and economic tems elated to the pape. In this pape we investigate the following impotant question: can cybe-insuance solutions induce efficient makets that impove the secuity of a netwok consisting of netwok individuals as well as oganizations? In the pocess of studying impovement of netwok secuity, we ae inteested in analyzing the welfae of elements (stakeholdes) that fom a cybe-insuance maket (if one exists). 1.2 Reseach Contibutions We make the following pimay eseach contibutions in this pape. We show that unde egulation, a isk-avese monopoly cybe-insue poviding full o patial coveage to its clients without contact discimination, enables the existence of an inefficient cybeinsuance maket that does not impove netwok secuity. Howeve, with client contact discimination, the cybe-insue is successful in enabling an efficient cybe-insuance maket that alleviates the moal hazad poblem and impoves netwok secuity. In the pocess, the insue makes non-negative expected pofit. Though ou contibutions we (i) pove qualitiative statements made in pevious wok on the benefits of pemium discimination fo achieving efficient cybe-insuance makets, and (ii) conside isk-avese cybe-insues compaed to isk-neutal ones modeled in liteatue. (See Sections 4 and 5.) We show that in pefectly competitive and geneal oligopolistic cybe-insuance settings with iskavese cybe-insues, full/patial loss coveage, and unde the pesense of a egulatoy agency, thee exists an inefficient insuance maket that does not impove netwok secuity. (See Section 6.) In ode to allow isk-avese cybe-insues to make stictly positive pofit, we deive in theoy, nonegulated pemium disciminating contacts in a monopoly scenaio that allow a isk-avese cybeinsue to make a cetain amount of expected pofit, and at the same time maximize social welfae at maket equilibium. In this egad, we also study contacts that completely intenalize all netwok extenalities caused by use secuity effots, and at the same time maximize social welfae at maket equilibium. (See Section 7.) The est of the pape is stuctued as follows. We popose a supply-demand model of cybe-insuance makets in Section 2. In Sections 3-7, we analyse diffeent types of cybe-insuance makets. We discuss elated wok in Section 8. In Section 9, we biefly look into some pactical aspects of ealizing cybe-insuance makets. We conclude ou pape in Section SUPPLY-DEMAND MODEL In this section we popose a model of a cybe-insuance maket. The section has two pats: in the fist pat we descibe ou model fom a demand (netwok use) pespective, in the second pat we descibe ou model fom a supply (cybe-insue) pespective. Impotant notation used in the pape is summaized in Table 1. Relevant economic tems ae biefly descibed in the Appendix. 2.1 Model fom a Demand Pespective We stuctue this section in seveal components which when combined togethe fom the demand side of the cybe-insuance maket Netwok Topology. We conside a communication netwok compised of a continuum of iskavese uses. Hee we use the notion of uses as pe the individual isk model in the indemnity insuance liteatue, whee uses ae consideed as atomic nodes (individuals, oganizations, entepise, data cente elements, etc.) in the netwok, each contolling a possible collection of devices [Bohme ACM Tansactions on Pefomance Evaluation of Compute Systems, Vol. V, No. N, Aticle 1, Publication date: Januay YY.

4 1:4 Pal, Golubhik, Psounis, and Hui and Schwatz 2010]. The links between the nodes need not necessaily be physical connections (e.g., netwok link), and could also epesent logical o social ties amongst the nodes (e.g., fo social engineeing attacks). We emphasize hee that fo diffeent types of theats (e.g., tageted attacks, viuses and woms, social engineeing attacks, etc.) we will have diffeent netwok topologies Netwok Use Utility Function. Each isk-avese use i in the communication netwok is assumed to be pefectly ational and has the standad von Neumann-Mogensten (VNM) utility, U i ( )[Mas-Collel et al. 1995]. VNM utilities ae a function of a use s final wealth, and is twice continuously diffeentiable, inceasing, and stictly concave. By the tem final wealth, we imply a use s esulting wealth afte being affected by theats, and (potentially) paying a pemium to his cybeinsue. We assume that each use in the netwok initially stats with a net woth of w Cost of Investing in Self-Defense Solutions. Each theat type has the potential to inflict loss of a paticula amount on a use. Howeve, depending on his latent secuity stength pofile, each use is heteogenous and incus a diffeent cost to pevent the loss. Fo example, a use knowledgable about Intenet secuity might adopt safe bowsing pactices, use secue OSs, and hence invest less in self-defense solutions compaed to a use ignoant about safe secuity pactices. Moe fomally, fo a paticula loss size of (the loss amount coesponding to a given theat), each use i incus a cost x i to invest in self-defense mechanisms to pevent the loss. Recall that self-defense mechanisms include antivius and anti-spam softwaes, fiewalls, buying secue OSs, etc. We assume that x i lies in the inteval [0, ], i.e., a use does not invest moe in self-defense mechanisms than the total loss amount. We also assume that a use does not completely avoid loss on self-defense. In this pape we will use the tems self-defense and self-potection intechangeably. Fo a given theat type, we define x m to be the maginal cost of investing in self-defense mechanisms, i.e., it is the cost to a use who is indiffeent between investing and not investing in self-defense. Such a use s net utility on investment in self-defense solutions is the same as his net utility on noninvestment. In the emainde of the pape, we assume that such a use always invests in self-defense. All othe isk-avese uses eithe decide to invest o not invest in self-defense mechanisms, depending on whethe thei cost of investment is lowe o highe than x m. Thoughout the pape we let and x i s have the same units Loss Types. Following the model by Kuneuthe and Heal [Kuneuthe and Heal 2002], we assume that a use is subject to two types of losses: diect and indiect. A diect loss to a use is caused when it is diectly attacked by a malicious entity (theat). An indiect loss to a use is caused when it is indiectly affected by diect theats to othe uses in the netwok. A use can be indiectly affected only by a use who is aleady diectly affected. Most common theats ae of the diect/indiect type. A bief desciption of some examples of diect and indiect theats is given in Section 7. Regading attacks, we assume them to be exogenous in natue athe than them being launched by stategic playes Loss Pobabilities. Let p i, d denote the pobability of a diect loss to a use fo a given theat type that has the potential to incu a loss of amount on use i. Hee p i, d is a function of x i, i.e., p i, d = p d if use i invests does not invest in self-defense solutions and pi, d = 0 if he invests an amount x i in self-potection. Thus, conditioned on the fact that a use i invests a non-zeo amount x i, he incus a constant pobability of loss that is the same fo all othe investing uses, given a paticula theat type. Let p i, ind (l) denote the pobability of a use i getting indiectly affected by othe netwok uses fo a given theat type, whee l is the popotion of uses in the netwok not adopting self-defense (selfpotection) mechanisms, which in tun is a function of x m, i.e., the maginal cost to a use indiffeent to investing in self-defense investments. x m is a function of (i) the vecto of use investments, (ii) the ACM Tansactions on Pefomance Evaluation of Compute Systems, Vol. V, No. N, Aticle 1, Publication date: Januay YY.

5 Impoving Netwok Secuity Via Cybe-Insuance: A Maket Analysis 1:5 netwok topology, and (iii) the numbe of uses in the netwok who ae aleady affected by a theat. Thus, p i, ind (l) = pi, ind (l(xm )). Note that the popotion of individuals without self-defense investments is stictly deceasing in x m as moe uses find it pefeable to invest in self-defense with inceasing maginal costs. Regading the connection between p i, ind (l) and l(xm ), the highe the value of l(x m ), the geate is the value of p i, ind (l). Theefoe, pi, ind (l(xm )) > 0, and 0 p i, ind (l(xm )) p max ind. Hee pmax ind is the maximum value of the function p i, ind (l) taken at an agument value of 1, and we assume that pi, ind (0) = 0. The intepetation behind p i, ind (l) is that if nobody invests in self-defense, a use gets indiectly affected with pobability p max ind, and if eveyone invests in self-defense, the pobability of indiect loss to a use is zeo. Note that x m is dependent on the investment of one s neighbos in the communication netwok, which in tun is dependent on the investment of neighbo s neighbos and so on. The events whee a use incus a diect loss and an indiect loss ae assumed to be statistically independent. In the case when a use does not completely avoid loss on self-defense, we assume that he has no diect loss on investing in self-potection but incus an indiect loss. We denote p i to be the pobability of a use i facing a loss fo a given theat type. In this case, when i invests in self-potection, p i, is given by p i = p i, ind (l(xm )). In a simila fashion, when i does not invest in self-defense mechanisms, p i is given by p i = p d + (1 p d)p i, ind (l(xm )). We note that one paticula way of computing the value of p i as a function of paametes pi, d and p i, ind in a netwok gaph, is using Local Mean Field Analysis (LMFA) [Lelage and Bolot 2008b][Lelage and Bolot 2008c][Yang and Lui 2012]. 2.2 Model fom a Supply Pespective The supply side of the maket compises of cybe-insues selling insuance solutions. We assume that cybe-insues bundle contacts fo evey theat type. In this pape, ou analysis is fo a paticula theat type with potential to inflict a loss of pe use. Simila to the section on demand pespectives, we stuctue this section into multiple pats compising the supply side of a cybe-insuance maket Regulation and Maket Types. In this pape we conside monopolistic and competitive (both pefect competition and oligopolistic competition) cybe-insuance makets unde a egulated setting. A egulatoy agency is typically a govenment agency whose ole is to ensue (i) monopoly insues ae limited to execising cetain client options and make pofits unde cetain limits, (ii) insues make the contact unde-witing pocess effective and tanspaent, (iii) effective shaing of cybe-secuity infomation by establishing an anti-tust exemption to allow insues to pool data on vulneabilities and attacks, and (iv) the pactical implementation of cetain collective action mechanisms that potentially mitigate undesiable extenalities and help impove netwok secuity. Of couse, in envionments of high isk intedependence and global coelation, egulatoy steps might not esult in the desied level of success (else widey adopted cybe-insuance makets would be a success by now), nonetheless the steps ensue smoothe maket opeation Insue Types. A cybe-insue could be any combination of an ISP, secuity poduct vendo, taditional insuance company, and a secuity thid paty. We assume that insues ae isk-avese (in contast to common assumption in insuance economics [Dionne and Haington 1992]). This assumption makes sense in the light of the fact that isks in cybe-space ae highly intedependent and globally coelated; as a esult the insue can get bankupt. ACM Tansactions on Pefomance Evaluation of Compute Systems, Vol. V, No. N, Aticle 1, Publication date: Januay YY.

6 1:6 Pal, Golubhik, Psounis, and Hui Insuance Paametes. In this wok we assume that cybe-insues povide full o patial coveage to thei clients (uses), who must buy cybe-insuance. We conside mandatoy insuance as a egulato s tool to impove cybe-secuity. The authos in [Pal et al. 2011][Naghizadeh and Liu 2014] addess the need fo mandatoy insuance, pimaily stating the inability of voluntay cybe-insuance to maximize social welfae due to the public natue of secuity goods. In this pape, we conside social welfae maximization as the pimay goal of a maket and so enfoce compulsoy insuance. As a matte of fact, in a ecent aticle [Khouzani et al. 2013], the authos cite the need of the US govenment to impose mandates on ISPs to incease cybe-secuity. Fom a policy viewpoint, compulsoy insuance might aise some eyebows [Bohme and Schwatz 2010], howeve we envision a futue whee pope incentives would be in place to make sue that netwok uses voluntaily buy insuance. As mentioned befoe, in a coelated and intedependent isk envionment such as the Intenet, a cybe-insue cannot affod to be isk-neutal as it could become bankupt if the expected aggegate loss in a peiod is geate than what it could affod to cove. We assume the isk-avese behavio of the insue by equiing it to hold safety capital. A safety capital is an amount of money that a cybeinsue buys fom an agency to cove the isk of being bankupt in the case of a catastophic event caused by the facto of global coelation and isk intedependence. The cost of holding safety capital is distibuted acoss the clients though the pemiums chaged to them. We assume that the shae of safety capital cost pe client is less than his expected isk value. Each client is chaged a pemium of (1 + λ)e(r), whee λ 0 is the loading facto pe contact, and E(R) is the expected loss value of the client. Hee, E[R] equals p i, fo a given theat type. The loading facto epesents the amount of pofit pe contact the cybe-insue is keen on making and/o the shae of the safety capital cost of each use. A pemium is said to be fai if its value equals E(R), and is unfai if its value is geate than E(R) Infomation Asymmety. Infomation asymmety has a significant negative effect on most insuance envionments, whee typical consideations include inability to distinguish between uses of diffeent (high and low isk) types, i.e., the so called advese selection poblem, as well as uses undetaking actions that advesely affect loss pobabilities afte the insuance contact is signed, i.e., the so called moal hazad poblem. The scale of infomation asymmety is lage in the Intenet than in othe pactical insuance scenaios, due to the intedependent and coelated natue of cybe-isks. We assume that cybe-insues can appoximately esolve the infomation asymmety poblem, i.e., it can stochastically estimate loss pobabilities fo diffeent isk categoies via pope infomation shaing policies 3, and effective computational tools (e.g., the local mean field method), theeby esolving the advese selection poblem to an extent 4. In a seies of ecent woks, [Johnson et al. 2014][Lazska et al. 2014] states ways to effectively estimate loss distibutions in a computationally tactable manne fo eal wold netwok (fomed by individuals and oganizations) topologies, and on a global scale. The woks duly account fo the uncetainty and inability to get infomation elated to cybe-losses on a lage geogaphical scale. In the oganizational netwok context, the authos in [Mukhopadhyay et al. 2013][Heath and Heath 2011] povide statistical tools to appopiately compute cybe-insuance pemiums unde loss infomation uncetainty settings. Regading the moal hazad poblem, we assume that it exists and we will design a mechanism in this pape that will alleviate this poblem (efe to Section 6.). We also assume that cybe-insues can appopiately estimate losses. In this context, 3 Pecedents include the Infomation and Readiness Disclosue Act (1998), and Electonic Feedom of Infomation Act (1996). 4 It is fai to assume that we cannot have a pefect scenaio whee infomation asymmety will not exist. Such a state is impactical and infeasible. We can at best stive to achive a state whee uses will be happy to bea some cybe-isk, the insues will be satisfied with the loss infomation they have, and the egulatoy agencies will appove of the stength of cybe-secuity. [Odlyzko 2003] ACM Tansactions on Pefomance Evaluation of Compute Systems, Vol. V, No. N, Aticle 1, Publication date: Januay YY.

7 Impoving Netwok Secuity Via Cybe-Insuance: A Maket Analysis 1:7 cybe-insues can esot to a mixtue of actuaial, nomative, and emotional consideations poposed in [Baddeley 2011] to measue losses in cybe-space, apat fom esoting to infomation shaing pools. Given the challenges of (i) uncetainty in computing isk, (ii) loss dependencies, and (iii) isk coelations, the cybe-insues can ovepice contacts and make clients unhappy [Toegas and Zahn 2014], despite adopting best estimation pactices. To pevent netwok uses fom not signing up fo insuance, egulatoy agencies need to design incentives fo uses to mandatoily/voluntaily buy insuance. 3. MARKET TYPE 1: NO INSURANCE SOLUTIONS OFFERED In this section we analyze the case when netwok uses do not have access to insuance coveage. This case is useful fo compaison of optimal use investments in secuity between scenaios of no insuance coveage and those with coveage. Fo a given theat type having a potential to incu a loss of amount on any use i, let Undef i (l(xm )) be the utility to a use i in Maket Type 1 when he does not invest in self-defense. x m is the maginal cost of self-defense fo this maket. The expected utility of use i, when he does not invest in self-defense mechanisms is thus given by E[U i ndef (l(x m ))] = p du i (w 0 ) + (1 p d)q i ind, whee Q i ind is the pobability of use i facing indiect loss, and is given5 by Q i ind = p i, ind (l(xm ))U i (w 0 ) + (1 p i, ind (l(xm ))U i (w 0 ), Similaly, the expected utility of a use who does invest in self-defense mechanisms is given by E[U i def (l(x m ), x i )] = p i, ind (l(xm ))U i (w 0 x i ) + (1 p i, ind (l(xm ))U i (w 0 x i ). Binay Investment Model. Thoughout this pape we will use the binay investment model, i.e., a use eithe does not invest in secuity mechanisms o invests an appopiate amount he thinks fit given his latent secuity pofile. In this wok, the cux of ou analysis deals with the cost of secuity investment to a maginal use. Thus, one of ou main goals is to pove the existence of a maginal use (see Section 2.1.3) fo all maket settings. Once we ae able to find a maginal use, we can deduce maket popeties fom the class of high and low investing uses. In this egad, a binay investment model is sufficient. A non-binay model will also lead to the existence of a maginal use, but without changing the natue of the esults. Social Welfae. We define the social welfae of a netwok of uses in the no insuance case as the sum of the expected utility of all the netwok uses. We denote social welfae of the no insuance case by SW NI (x m1 ) and expess it as SW NI (x m ) = x m 0 E[U def (l(x m, x)]f(x)dx + E[U ndef (l(x m )]l(x m ). The fist tem in SW NI (x m ) denotes the sum of the expected utility of all agents adopting self-defense; the second tem denotes the sum of the expected utilities of all uses not investing in self-defense. f(.) denotes the pobability density function of X, the andom vaiable epesenting the self-defense investment costs of uses. X takes on values in the ange [0, ]. We have the following theoem egading maket popeties when no insuance solutions ae available. The poof of the theoem is in the Appendix. 5 In ode to have moe condensed equations, we somewhat abuse the expession fo expected utility, and use Q i ind instead of the entie expession denoting Q i ind. ACM Tansactions on Pefomance Evaluation of Compute Systems, Vol. V, No. N, Aticle 1, Publication date: Januay YY.

8 1:8 Pal, Golubhik, Psounis, and Hui THEOREM 3.1. Fo a given theat type, when netwok uses do not have cybe-insuance potection, thee exists a unique maket equilibium (ME) cost to invest in self-defense, x eq. Uses facing self-defense costs below x eq invest in self-defense mechanisms, wheeas othe uses do not. This ME cost of selfdefense does not esult in maximizing use social welfae in the netwok, i.e., the popotion of uses not esoting to self-defense mechanisms is highe in the maket equilibium than in the welfae optimum, the netwok secuity is sub-optimal, and the moal hazad poblem pesists. Poof Sketch. The main poof intuition behind the existence of unique equilibia is showing the monotonicity of a potential function elating E[U ndef (l(x m ))] and E[U def (l(x m ), x i )], fo any abitay use i. The monotonic popety of the potential function leads us to a unique maket equilibium cost of self-defense investment, x eq. We show that x eq equals x m. Regading testing fo social welfae maximum at maket equilibia, we equate the fist ode condition fo SW NI (x m ) to zeo to find x sopt - the cost of self-defense investment that maximizes social welfae, and then test whethe this cost equals the maket equilibium cost of self-defense, i.e., x eq. Theoem Intuition and Pactical Implications. The theoem esult is not novel and has been also been aived at by [N.Shetty et al. 2009][Lelage and Bolot 2009][Omic et al. 2009][Miua-Ko et al. 2008]. The intuition behind Theoem 3.1 is based on the fist fundamental theoem in welfae economics [Mas-Collel et al. 1995] which states that the netwok extenalities geneated by use investments ae not intenalized (i.e., uses do not pay fo extenality benefits), by the uses fo public goods such as secuity measues, and esults in the fee-iding poblem. Thus, isk -avese uses do not end up putting in optimal self-defense effots, and this esults in sub-optimal netwok secuity, i.e., the aveage of use isk pobabilities (denoted as p avg(x m )), is not minimized at maket equilibium, fo a given theat type. In [N.Shetty et al. 2009], the authos state that p avg(x m ) is minimized if and only if social welfae is maximized. At maket equilibium we intuitively have two categoies of the netwok use population - (i) the class of uses who face a cost of investment above the ME cost, do not buy secuity poducts, and face a loss on being attacked, and (ii) the othe class consisting of uses who invest in secuity measues, do not face diect isks but ae still susceptible to indiect isks. 4. MARKET TYPE 2: MONOPOLY MARKETS (NO CLIENT DISCRIMINATION) In the pevious section, we obseved the non-optimality of netwok secuity when insuance solutions ae not available. In this and subsequent sections, we analyse the state of netwok secuity impovement unde vaious insuance envionments. In this section we analyze a egulated monopolistic cybe-insuance maket unde conditions of impefect pevention (self-potection does not guaantee isk emoval). Hee the tem egulated implies the ole of a govenmental agency to (i) ensue each Intenet use buys voluntay/compulsoy cybe-insuance, and (ii) allow basic monitoing of use secuity behavio by insuance agencies in ode to estimate isks bette and pice pemiums effectively. In this section we analyze the case when thee is no contact discimination amongst clients, i.e., λ - the insuance loading facto chaged pe use is the same fo evey use. Fo a given theat type with the potential to inflict a loss of on any use, the expected utility of a use i who does not invest is self-defense is given by E[U i ndef (l(x m ))] = p du i (w 0 + (1 + λ)p i ) + (1 p d)q i ind, whee Q i ind is the pobability of the use facing indiect loss, and is given by Q i ind = p i, ind (l(xm ))U i (w 0 + (1 + λ)p i, ind ) + (1 pi, ind (l(xm ))U i (w 0 (1 + λ)p i, ind ). ACM Tansactions on Pefomance Evaluation of Compute Systems, Vol. V, No. N, Aticle 1, Publication date: Januay YY.

9 Impoving Netwok Secuity Via Cybe-Insuance: A Maket Analysis 1:9 Hee (1 + λ)p i, and (1 + λ)pi, ind (l(xm )) ae insuance pemiums that a use in Maket Type 2 not investing in secuity, pays to his cybe-insue in etun fo full/patial coveage of his loss (hence the + tem in U i ). x m is the maginal cost of investment in this maket type. The expected utility of the same use when he invests in self-defense mechanisms is given by E[U i def (l(x m ), x i )] = U i (w 0 x i (1 + λ)p i, ind (l(xm )) ), whee (1 + λ)p i, ind (l(xm )) is the insuance pemium a use in this maket type, and investing in secuity, pays to his insue. Patial Coveage - We emphasize hee that in the above equations can be eplaced by any k ɛ [0, ] fo the case of patial coveage. Hee patial coveage implies the decision of the netwok uses to not tansfe his entie isk to a cybe-insue. The esidual isk could eithe be absobed by him, o be tansfeed to a self-insuance mechanism [Johnson et al. 2011]. Social Welfae Maximization. We define the social welfae of a netwok of uses as the sum of the expected utility of all the uses. We denote social welfae in the monopoly setting of Maket Type 2 as SW Mncd (x m2 ) (Hee, M ncd denoting monopoly with no client discimination ), which evaluates to SW Mncd (x m ) = 0 x m 0 E[U def (l(x m, x)]f(x)dxdλ + E[U ndef (x m )]l(x m ). The fist tem of SW Mncd (x m ) denotes the sum of the expected utility of all agents adopting self-defense, the second tem denotes the sum of the expected utilities of all agents not investing in self-defense and buying cybe-insuance only (be it full coveage o patial coveage). f(.) denotes the pobability density function of X, the andom vaiable epesenting the self-defense investment costs of uses. X takes on values in the ange [0, ]. We assume hee that cybe-insues have knowledge of the distibution, f, fom actuaial studies of use secuity behavio. We have the following theoem egading maket popeties fo Maket Type 2. The poof of the theoem is in the Appendix. THEOREM 4.1. Fo a given theat type, thee exists a unique monopoly maket equilibium (MME) cost, x eq, of investing in self-defense in a monopolistic cybe-insuance setting with no client discimination. Uses facing potection costs below x eq invest in self-defense mechanisms, wheeas othe uses buy cybe-insuance only (be it full coveage o patial coveage). This MME cost of self-defense does not esult in maximizing use social welfae in the netwok (i.e., the popotion of uses not esoting to selfdefense mechanisms is highe in the maket equilibium than in the welfae optimum.), cybe-insuance does not incentivize uses to invest in self-defense mechanisms, the netwok secuity is sub-optimal, and the moal hazad poblem pesists. Poof Sketch. The main poof intuition behind the existence of unique equilibia is simila to that of Theoem 3.1. We show the monotonicity of a potential function elating E[U ndef (l(x m ))] and E[U def (l(x m ), x i )], fo any abitay use i. The monotonic popety of the potential function leads us to a unique maket equilibium cost of self-defense investment, x eq. We show that x eq equals x m. Regading testing fo social welfae maximum at maket equilibia, we equate the fist ode condition fo SW Mncd (x m ) to zeo to find x sopt - the cost of self-defense investment that maximizes social welfae, and then test whethe this cost equals the maket equilibium cost of self-defense, i.e., x eq. Theoem Intuition and Pactical Implications: The intuition behind Theoem 4.1 is that extenalities caused due to individual use investment in secuity mechanisms ae not intenalized by the uses, and as a esult social welfae is not maximized at maket equilibium. The implications of the theoem ae (i) cybe-insuance does not incentivize netwok uses to invest in self-defense mech- ACM Tansactions on Pefomance Evaluation of Compute Systems, Vol. V, No. N, Aticle 1, Publication date: Januay YY.

10 1:10 Pal, Golubhik, Psounis, and Hui anisms 6, (ii) cybe-insuance exacebates the moal hazad poblem, i.e., once uses buy insuance they do not spend as much in self-defense as they would without it. This makes sense fom an economic viewpoint as uses would loath to bea excessive cost in self-defense if thee is an altenative to canceling out isk albeit at an unfai pemium, i.e., pemium geate than the fai amount, and (iii) cybe-insuance might incease individual use utilities (as uses get full coveage of thei losses) but does not positively contibute to the incease of oveall netwok secuity. As a esult, a egulato inteested in impoving netwok secuity is not satisfied. Also note, since λ 0, the cybe-insue makes non-negative expected pofits. In context of a secuity vendo, it does not satisfy its inteests fom an existing cybe-insuance maket, i.e., compaed to Maket Type 1, as the sales of its poducts ae going to go down with uses elying on cybe-insuance fo isk mitigation. Fom a netwok pespective, uses with high netwok degee will tend to unde-invest in secuity investments and fee-ide on thei neighbos investments, wheeas uses with low netwok degee cannot affod to fee ide (due to lesse numbe of neighbos), and being isk-avese, they will invest popely in self-defense mechanisms. Also, the low degee uses would be the ones moe inclined towads investing in cybe-insuance than high-degee uses. 5. MARKET TYPE 3: MONOPOLY WITH CLIENT DISCRIMINATION In the pevious section we obseved why despite mandating cybe-insuance on netwok uses, a social welfae maximum could not be eached. In this section we aim to impove upon this dawback by allowing the insue to pemium disciminate its clients, and keeping all othe factos the same as in the case without pemium discimination 7. The ationale fo client discimination is that uses who take (do not take) appopiate self-defense actions educe (incease) thei chances of getting attacked as well as educe (incease) othe netwok uses chances of facing a loss. In ode to diffeentiate between clients, the cybe-insue imposes a fine of amount a pe use of high isk type, and povides a ebate of amount b pe use of low isk type. A use is consideed of high isk type if he does not invest in self-defense mechanisms, and is consideed of low isk type when he appopiately invests in the same. Analytical mechanisms to decide which uses get fines and which uses get ebates ae poposed in [Pal and Hui 2013][Pal and Hui 2012][Pal et al. 2013]. A use decides whethe it wants to invest in self-potection depending on the cost of investment and the povided fine/ebate. The sequence of the potocol between the insue and the clients can be seen as follows: Stage 1 - the insue advetises appopiate contacts to its clients that include the fine/ebate values. Stage 2 - the uses simultaneously decide whethe o not to invest in self-defense based on the cost of investment and thei signed contact infomation, and Stage 3 - when a coveage claim is filed by clients, the cybe-insue examines the claims and chages the suitable ebate/fine to each client based on whethe his investment amounts wee above o below 6 As an exception, cybe-insuance incentivizes self-defense investments of uses in the case when insuable and non-insuable isk co-exist togethe and it is not easy fo a use to distinguish between the two [Pal et al. 2011]. Fo example, a hadwae failue can be caused due to eithe a secuity lapse, o hadwae defect, and it is difficult fo a naive use to figue out the ight eason fo the failue. 7 In a ecent pape [Pal and Golubchik 2010a], the authos have poposed coopeation amongst uses on thei self-defense investment infomation, as a way to ensue social welfae maximization of netwok uses unde a cybe-insuance setting. The authos use the well known Coase Bagaining Theoem [R.H.Coase 1960] to aive at thei esult. Howeve, use coopeation can only be sustained only unde esticted netwok settings whee all uses wok towads a common goal, e.g., system pefomance maximization in a multicasting scenaio. ACM Tansactions on Pefomance Evaluation of Compute Systems, Vol. V, No. N, Aticle 1, Publication date: Januay YY.

11 Impoving Netwok Secuity Via Cybe-Insuance: A Maket Analysis 1:11 a paticula theshold. Hee we assume that the cybe-insue can obseve o stochastically lean the investment amounts of its clients afte a claim is made. Note that the pemium diffeentiation appoach is feasible only in the case of monopolistic cybeinsuance makets o impefect competitive makets. In the case of pefectly competitive makets (efe to Section 6.), pice competition will not allow insues to disciminate amongst thei clients fo commecial demand puposes, and insues will have to sell contacts at absolute fai pemiums making zeo expected pofits. Fo a given theat type capable of inflicting a potential loss of on any use, a use not willing to invest in self-defense investments will pay a fine a ove his pemium. At maket equilibium the following esult needs to hold fo the cybe-insue to teat equally (faily), a use i who invests in self-defense investments, as well as a use j who does not invest in self-defense investments. U i def (w 0 x i (1 + λ)p i, ind (l(xm )) ) = U j ndef (w 0 ((1 + λ)p i + a)). (1) Similaly, a use willing to invest in self-defense investments will eceive a ebate of b on his pemium. At maket equilibium the following esult needs to hold fo the cybe-insue to teat equally (faily), a use i who invests in self-defense investments, as well as a use j who does not invest in self-defense investments. U i def (w 0 x i ((1 + λ)p i, ind (l(xm )) ) b)) = U j ndef (w 0 (1 + λ)p i ). (2) We emphasize hee that in the above equations can be eplaced by any k ɛ [0, ] fo the case of patial coveage. Via equations (1) and (2), ou goal is to find the optimal self-defense cost x sopt that achieves maximum social welfae, and one that equals the maket equilibium self-defense cost, x eq. In this wok, we have assumed two classes of uses: the high isk uses, and the low isk uses. Howeve, ou analysis easily extend to the case of multiple use classes. We now have the following theoem stating the popeties of Maket Type 3. The poof of the theoem is the Appendix. THEOREM 5.1. Unde conditions of monopolistic cybe-insuance, a isk-avese cybe-insue can help achieve social welfae maximization by pemium disciminating clients. In tun, it makes nonnegative expected pofit, and also incentivizes uses to invest in self-defense investments. The netwok secuity is optimal, the moal hazad poblem is esolved, and the cybe-insuance maket is efficient. Poof Sketch. The poof method is simila to those of Theoems 3.1 and 5.1. Theoem Intuition and Pactical Implications: By pemium disciminating clients in the fom of fines and ebates, cybe-insues guide isk-avese uses to intenalize the extenalities (though not completely) caused by use pees, and as a esult help uses invest in optimal self-defense amounts that lead to social welfae maximization. The poblem of moal hazad in mitigated and as a esult the oveall netwok secuity is optimal, which would please secuity egulatoy bodies. Regading pofits, cybe-insues make non-negative expected pofits 8, and secuity poduct vendos would see an incease in thei poduct sales (and subsequently pofits) due to uses being incentivized to invest appopiate amounts in self-defense mechanisms. In egad to netwok effects, high degee netwok uses would have to pay fines on fee iding on thei neighbos extenalities, and the low degee uses would be ewaded with ebates fo appopiately investing in self-defense and geneating positive extenalities fo othe netwok uses. The netwok extenalities ae not completely intenalized because it is not pactically possible to tansfe all complete liability to a use who does not invest in secuity. 8 Note that in most cases the cybe-insue would set λ values to be positive, which implies stictly positive expected pofit, unless thee is a huge catastophe and all the evenue + safety capital get expended on insuing uses. ACM Tansactions on Pefomance Evaluation of Compute Systems, Vol. V, No. N, Aticle 1, Publication date: Januay YY.

12 1:12 Pal, Golubhik, Psounis, and Hui 6. MARKET TYPE 4: COMPETITIVE MARKETS In pactice, thee may be multiple cybe-insuance companies existing in a maket scenaio. In this section, we assume pefect and impefect competitive cybe-insuance makets. In competitive makets, multiple cybe-insues povide thei clients with full/patial coveage at fai o unfai pemiums. Unde pefect competition, the equilibium stategy fo all fims in a maket is to chage fai pemiums [Dionne and Haington 1992]. This is because in the pesence of advese selection, individual insues cannot induce agents without pevention to pay a pemium loading due to the fact that othe insues can undecut the demanded pemium by ignoing extenalities. Chaging unfai pemiums will esult in a fim having zeo demand. In the case of impefect o oligopolistic competition, in pactice a fim can affod to pemium disciminate, one of the main easons being insues locking-in thei clients (with high costs of moving to othe insuance vendos) with cetain poduct featues that attact diffeent types of clients in the maket to diffeent insues. In this wok we will pimaily analyse the case of pefectly competitive makets. Late in this section, we will comment on contact picing in non-pefect competitive (oligopolistic) makets. Due to impefect natue of secuity mechanisms, we assume that a isk-avese use esots to insuance solutions wheneve he invests in self-defense mechanisms. Fo a given theat type capable of inflicting a loss of on any use, the expected utility of use i who does not invest in self-defense mechanisms in Maket Type 4, and only buys insuance is given by E[U i ndef (l(x m )] = p d U i (w 0 + p i ) + (1 p d )Q i ind, whee Q i ind is the pobability of the use i facing indiect loss in this maket type, and is given as Q i ind = p i, ind (l(xm ))U i (w 0 + p i, ind (l(xm ) ) + (1 p i, ind (l(xm ))U i (w 0 p i, ind l(xm ) ), Hee p i, and pi, ind (l(xm )) ae insuance pemiums that a use in Maket Type 4 not investing in secuity, pays to his cybe-insue in etun fo full/patial coveage of his loss. x m is the maginal cost of investment in this maket type. Similaly, the expected utility of the same use when he invests in self-defense mechanisms is given as E[U def (l(x m ), x i )] = U i (w 0 x i p i, ind l(xm ) ), whee p i, ind l(xm ) is the actuaially fai insuance pemium that a use in this maket type not investing in self-defense, pays to his cybe-insue in etun fo full/patial coveage of his loss. We emphasize hee that in the above equations can be eplaced by any k ɛ [0, ] fo the case of patial coveage. Social Welfae Maximization: We define the social welfae of a netwok of uses as the sum of the expected utility of all the uses. Mathematically, we denote social welfae in a competitive maket setting as SW C (x m ) and it is evaluated as SW C (x m ) = x m 0 E[U def (l(x m ), x)]f(x)dx + E[U ndef (x m )] l(x m ). The fist tem of SW C (x m ) denotes the sum of the expected utility of all agents with adopting selfdefense, the second tem denotes the sum of the expected utilities of all agents not investing in selfdefense and buying cybe-insuance. f(.) denotes the pobability density function of X, the andom vaiable epesenting the self-defense investment costs of uses. X takes on values in the ange [0, ]. We assume hee that cybe-insues have knowledge of the distibution, f, fom actuaial studies of use secuity behavio. We have the following theoem egading maket popeties fo Maket Type 4. The poof of the theoem is in the Appendix. ACM Tansactions on Pefomance Evaluation of Compute Systems, Vol. V, No. N, Aticle 1, Publication date: Januay YY.

13 Impoving Netwok Secuity Via Cybe-Insuance: A Maket Analysis 1:13 THEOREM 6.1. When netwok uses have the option of cybe-insuance potection, thee exists a unique competitive maket equilibium cost of investing in self-defense, x eq. Uses facing potection costs below x eq jointly invest in self-defense mechanisms and insuance, wheeas othe uses only buy cybe-insuance. This maket equilibium cost of self-defense does not esult in maximizing use social welfae in the netwok and cybe-insuance does not incentivize uses into making self-defense investments. In addition, the insues make zeo expected pofit. The netwok secuity is sub-optimal, poblem of moal hazad pesists, and cybe-insuance makets ae inefficient. Poof Sketch: The poof method is simila to that of Theoems 3.1, 4.1, and 5.1. Theoem Intuition and Pactical Implications: The intuition and implications behind Theoem 6.1 ae vey simila to that of Theoem 4.1. The intuition fo a cybe-insue in the pefectly competitive setting to chage actuaially fai pemiums is that advese selection cannot induce uses to pay a pemium loading as othe insues can undecut the demanded pice by ignoing extenalities. Thus, the extenalities in a competitive cybe-insuance maket cannot be intenalized. So it makes sense that geate the amount of extenalities in a netwok, the moe it makes sense to enfoce a monopolistic cybe-insuance maket with client contact discimination. In tems of pofits since λ = 0, the expected pofit a insue makes is zeo. One moe impotant point egading intenalizing extenalities comes fom the compulsoy natue of cybe-insuance contacts. If thee exists a mechanism such that all uses voluntaily buy cybe-insuance, the situation is exactly simila to the case when insuance is made compulsoy, and in both these cases the netwok extenalities ae not intenalized. If it is the case that some uses buy cybe-insuance and the othes do not then it is moe the case that extenalities will not be intenalized. As a esult with no voluntay/compulsoy insuance,even pefectly competitive cybe-insuance makets ae likely to be inefficient. A Note on Oligopolistic Makets: Oligopolistic makets esemble impefect (not pefectly competitive) competition between fims in a maket. In these makets, fo a cybe-insuance setting, the insues have maket powe to set pices unlike in the pefect competition case, whee each insue is pice taking (has no maket powe to chage actuaially unfai pemiums) and can only chage actuaially fai pemiums to its clients. We have aleady mentioned that secuity being a public good is the main culpit behind extenalities not completely being intenalized, even if the makets ae pefectly competitive. Thus, in an oligopoly with a fixed numbe of insues, poduct non-discimination will not esult in an efficient maket. Poduct discimination will lead to custome lock-in, but has the potential to ensue efficient makets only if insuance can be made compulsoy, something which is debatable at this point fom a policy implementation viewpoint. With non-compulsoy insuance it will become vey had to ensue efficient makets, soley because of the public natue of secuity poducts. n the case when the numbe of cybe-insuance fims in a maket ae geate than two, the authos in [N.Shetty et al. 2009] show thee exists a maket equilibium which does not maximize social welfae. 7. MAKING STRICTLY POSITIVE PROFIT In Section 5, we showed that pemium discimination in a monopoly setting leads to social welfae maximization, but does not necessaily guaantee a stictly positive expected pofit fo the cybeinsue. This in tun is stong enough a disincentive fo the cybe-insue to dop out of the maket. In this section, we aim to alleviate this poblem by designing contacts that allow the monopolistic insue to make stictly positive pofit, and at the same time ensue social welfae maximization. We take a non-egulated appoach of chaging fines and ebates to insuance clients so that the insue always makes positive pofit in expectation. Ou solution is moe theoetical in natue, pimaily looking at a way to intenalize all extenalities. In a pactical setting, ou solution technique equies the assumption of pefect infomation and the possibility of no outside options - both of which ae eally ACM Tansactions on Pefomance Evaluation of Compute Systems, Vol. V, No. N, Aticle 1, Publication date: Januay YY.