Pricing the Cost of Cybercrime—A Financial Protection Approach

Abstract

Infrastructures, businesses, end-users and services offered in the digitally integrated environment are exposed to a wide range of risks such as denial of service, hacking, phishing, ransomware, viruses, etc. Consequently, along with their physical life, individuals and organizations have to secure their digital life as well. Digital threats may have a major economic impact both on the individuals and the society, through the direct loss of income and/or property or even an indirect reduction of the individuals’ contribution back to the society and the state. The purpose of this paper is to study the effect of cyber-attacks to the economy, to price the associated cost and to recommend possible measures that internet service providers (ISPs) and policy makers can apply in order to mitigate these risks. In order to achieve that, we employ insurance (actuarial) pricing techniques to calculate the cost of cyber-attacks for an individual and for the economy of a country in total. We are therefore at the same time in place to recommend insurance coverage solutions that can assist in protecting the entity of interest from cyber risks. This resembles to the calculation of a risk premium, as the premium is calculated taking into account only the probability of occurrence of a cyber-attack and the interest rate and not any other loadings. In this context, we mimic the pricing of a policy that provides coverage for the cyber-attack, as well as the calculation of the amount that has to be set aside in order to compensate for the one-off economic loss suffered by the individual, as a result of its occurrence. Here lies our contribution to the scientific research in the field of cyber security insurance, as we employ insurance-based actuarial techniques in order to quantify the relevant loss.