Using insurance to increase internet security

ABSTRACT

Managing security risks in the Internet has so far mostly involved methods to reduce the risks and the severity of the damages. Those methods reduce but do not eliminate risk, and the question remains on how to handle the residual risk. Current schemes applied by Internet Service Providers (ISPs) penalize the users, who suffer from the consequences. In this paper, we take a new approach to the problem of Internet security and advocate managing the residual risk by buying insurance against it and consequently re-arranging the incentive chain. We first analyze the current state of the Internet and investigate if it is possible to alleviate the existing problems by introducing insurance schemes. By performing detailed analysis we define an insurance policy that can survive in a competitive market. Following that, we analyze the impact of insurance-based ISPs on the rest of the network and attempt to answer whether using insurance can increase the overall security of the system and provide incentive to other ISPs to implement such policies.

REFERENCES

• 1: J. Bolot and M. Lelarge. A New Perspective on Internet Security using Insurance. In Proc. of the IEEE Infocom, pp. 1948--1956, April 2008.
• 2: B. Hillier. The Economics of Asymmetric Insurance. Palgrave Macmillan, 1997.
• 3: R. A. Miura-Ko, B. Yolken, J. Mitchell, and N. Bambos. Security decision-making among interdependent organizations, 2008.
• 4: M. Rothschild and J. Stiglitz. Increasing risk: I. A Definition. Journal of Economic Theory, 2(3):225--243, 1970.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

General Terms:
Economics, Security

Keywords:
correlated risk, ddos, economy, incentive, insurance, risk transfer, security