A framework for incorporating insurance in critical infrastructure cyber risk strategies

Smart critical infrastructure owners and operators are always looking for ways to minimize cyber risk while keeping a lid on cyber security expenditures. The insurance industry has been quantitatively assessing risk for hundreds of years to minimize risk and maximize profits. To achieve these goals, insurers continuously gather and analyze statistical data to improve their predictions, incentivize client investments in self-protection and periodically refine their models to improve the accuracy of risk estimates. This paper presents a framework that incorporates the operating principles of the insurance industry to provide quantitative estimates of cyber risk. The framework uses optimization techniques to suggest levels of investment in cyber security and insurance for critical infrastructure owners and operators. This analysis can be used to quantitatively formulate strategies to minimize cyber risk.