A Framework for Incorporating Insurance into Critical Infrastructure Cyber Risk Strategies

Critical infrastructure owners and operators want to minimize their cyber risk and expenditures on cybersecurity. The insurance industry has been quantitatively assessing risk for hundreds of years in order to minimize risk and maximize profits. To achieve these goals, insurers continuously gather statistical data to improve their predictions, incentivize their clients\u27 investment in self-protection and periodically refine their models to improve the accuracy of risk estimates. This paper presents a framework which incorporates the operating principles of the insurance industry in order to provide quantitative estimates of cyber risk. The framework implements optimization techniques to suggest levels of investment for both cybersecurity and insurance for critical infrastructure owners and operators. This analysis can be used to quantitatively formulate strategies to minimize cyber risk

Cyber-Based Contingency Analysis and Insurance Implications of Power Grid

Cybersecurity for power communication infrastructure is a serious subject that has been discussed for a decade since the first North American Electric Reliability Corporation (NERC) critical infrastructure protection (CIP) initiative in 2006. Its credibility on plausibility has been evidenced by attack events in the recent past. Although this is a very high impact, rare probability event, the establishment of quantitative measures would help asset owners in making a series of investment decisions. First, this dissertation tackles attackers\u27 strategies based on the current communication architecture between remote IP-based (unmanned) power substations and energy control centers. Hypothetically, the identification of intrusion paths will lead to the worst-case scenarios that the attackers could do harm to the grid, e.g., how this switching attack may perturb to future cascading outages within a control area when an IP-based substation is compromised. Systematic approaches are proposed in this dissertation on how to systematically determine pivotal substations and how investment can be prioritized to maintain and appropriate a reasonable investment in protecting their existing cyberinfrastructure. More specifically, the second essay of this dissertation focuses on digital protecting relaying, which could have similar detrimental effects on the overall grid\u27s stability. The R-k contingency analyses are proposed to verify with steady-state and dynamic simulations to ensure consistencies of simulation outcome in the proposed modeling in a power system. This is under the assumption that attackers are able to enumerate all electronic devices and computers within a compromised substation network. The essay also assists stakeholders (the defenders) in planning out exhaustively to identify the critical digital relays to be deployed in substations. The systematic methods are the combinatorial evaluation to incorporate the simulated statistics in the proposed metrics that are used based on the physics and simulation studies using existing power system tools. Finally, a risk transfer mechanism of cyber insurance against disruptive switching attacks is studied comprehensively based on the aforementioned two attackers\u27 tactics. The evaluation hypothetically assesses the occurrence of anomalies and how these footprints of attackers can lead to a potential cascading blackout as well as to restore the power back to normal stage. The research proposes a framework of cyber insurance premium calculation based on the ruin probability theory, by modeling potential electronic intrusion and its direct impacts. This preliminary actuarial model can further improve the security of the protective parameters of the critical infrastructure via incentivizing investment in security technologies

Cybersecurity by executive order

This report explores the details of the Obama Administration\u27s executive order on cybersecurity, breaking down the challenges, criticisms, and successes of the effort to date, before offering clear lessons from the US experience that can be applied to the Australian context. Summary: On 12 February 2014 the United States National Institute of Standards & Technology (NIST) released the Framework for Improving Critical Infrastructure Cybersecurity, the flagship accomplishment of the Obama Administration’s 2013 cybersecurity Executive Order. Just weeks before the White House announced its executive order, the then Australian Prime Minister Julia Gillard made an equally exciting declaration introducing the Australian Cyber Security Centre (ACSC). One year on, the contrast between the two efforts is stark. The United States and Australia share a common interests in developing a robust partnership between the government and private sector to develop whole-of-system cybersecurity. To move beyond political optics, the ACSC must embrace existing best practices, commit to meaningful public-private partnerships, and set a pragmatic strategy moving forward. The Obama Administration’s efforts, while far from perfect, offer critical lessons that the Australian government can adopt and adapt to ensure that the ACSC is a successful endeavour and critical infrastructure cybersecurity is improved. This Strategic Insight report explores the details of the executive order, breaking down the challenges, criticisms, and successes of the effort to date, before offering clear lessons from the US experience that can be applied to the Australian context

The effect of cyber-attacks on stock returns

A widely debated issue in recent years is cybercrime. Breaches in the security of accessibility, integrity and confidentiality of information involve potentially high explicit and implicit costs for firms. This paper investigates the impact of information security breaches on stock returns. Using event-study methodology, the study provides empirical evidence on the effect of announcements of cyber-attacks on the market value of firms from 1995 to 2015. Results show that substantial negative market returns occur following announcements of cyber-attacks. Financial entities often suffer greater negative effects than other companies and non-confidential cyber-attacks are the most dangerous, especially for the financial sector. Overall findings seem to show a link between cybercrime and insider trading

Medical Cyber-Physical Systems Development: A Forensics-Driven Approach

The synthesis of technology and the medical industry has partly contributed to the increasing interest in Medical Cyber-Physical Systems (MCPS). While these systems provide benefits to patients and professionals, they also introduce new attack vectors for malicious actors (e.g. financially-and/or criminally-motivated actors). A successful breach involving a MCPS can impact patient data and system availability. The complexity and operating requirements of a MCPS complicates digital investigations. Coupling this information with the potentially vast amounts of information that a MCPS produces and/or has access to is generating discussions on, not only, how to compromise these systems but, more importantly, how to investigate these systems. The paper proposes the integration of forensics principles and concepts into the design and development of a MCPS to strengthen an organization's investigative posture. The framework sets the foundation for future research in the refinement of specific solutions for MCPS investigations.Comment: This is the pre-print version of a paper presented at the 2nd International Workshop on Security, Privacy, and Trustworthiness in Medical Cyber-Physical Systems (MedSPT 2017

Active Cyber Defense in the Healthcare Sector

The healthcare industry is a vulnerable sector when it comes to cybercrime. To date, it continues to suffer the highest losses for twelve consecutive years (IBM, 2022). As care- providing systems depend more and more on technology, information assets become an appealing target for cyber criminals. Health data often contains sensitive and identifiable information such as full names, addresses, phone numbers, emails, Social Security Numbers, etc. All these falls under the term Personal Identifiable Information (PII) which are protected by many laws and acts with the purpose of protecting one’s privacy from harms such as identity theft and other fraudulent offenses. In addition to the privacy concern, there is also financial and reputational concerns involved. The health sector suffers frequents attacks and the number continues to grow every year. The purpose of this research thesis paper is to analyze the cyber defense technique Active Cyber Defense (ACD) in relation to the healthcare sector. It seeks to investigate the ways in which the health sector can benefit from incorporating ACD in its security strategy as well as analyzing the various security challenges that the health sector faces and how it attempts to address them. This research will be supported by research papers, government documents, reports, and articles