On a way to improve cyber-insurer profits when a security vendor becomes the cyber-insurer

摘要

Current research on cyber-insurance has mainly been about studying the market success of an insurance-driven security ecosystem. Such an ecosystem comprises of a set of market elements (e.g., cyber-insurers, network users, security vendors (SVs), regulatory agencies, etc.,) that coexist together as a system with the success goal of mutually satisfying each other's interests. However, existing works have not explicitly considered SVs as market elements, and have analytically proved the moderate/no success1 of cyber-insurance markets due to insurers not satisfying their interests in making zero expected profits at times. In this paper, we model a security vendor (e.g., Symantec, Microsoft) as a cyber-insurer, thereby making the former as an explicit market element. We then propose a novel consumer pricing mechanism for SVs based on their client/consumer logical network and consumer security investment amounts, with the goal to improve SV profits. Our simulation results show that SVs could improve up to 25% of their current profit margins by accounting for client location and investment information. A fraction of the extra profits could then be used up by the SVs to recover costs related to providing insurance coverage to their clients, and also to always make strictly positive profits as insurers. Finally, we propose a discrete-time sequential dynamic pricing strategy for an SV, and show that it leads to improved SV profits when compared to a static pricing strategy. Our work demonstrates one particular way for a cyber-insurance market to be successful on a more than moderate scale.