Managing Interdependent Information Security Risks: Cyberinsurance, Managed Security Services, and Risk Pooling Arrangements.

Author List: Zhao, Xia; Xue, Ling; Whinston, Andrew B.;

Journal of Management Information Systems, 2013, Volume 30, Issue 1, Page 123-152.

The interdependency of information security risks often induces firms to invest inefficiently in information technology security management. Cyberinsurance has been proposed as a promising solution to help firms optimize security spending. However, cyberinsurance is ineffective in addressing the investment inefficiency caused by risk interdependency. In this paper, we examine two alternative risk management approaches: risk pooling arrangements (RPAs) and managed security services (MSSs). We show that firms can use an RPA as a complement to cyberinsurance to address the overinvestment issue caused by negative externalities of security investments; however, the adoption of an RPA is not incentive-compatible for firms when the security investments generate positive externalities. We then show that the MSS provider serving multiple firms can internalize the externalities of security investments and mitigate the security investment inefficiency. As a result of risk interdependency, collective outsourcing arises as an equilibrium only when the total number of firms is small.

Keywords: cyberinsurance; information security; interdependent risks; managed security services; risk management; risk pooling

Algorithm:

List of Topics

#264	0.211	risk risks management associated managing financial appropriate losses expected future literature reduce loss approach alternative mitigate failures failure cause mitigation
#186	0.203	security information compliance policy organizations breach disclosure policies deterrence breaches incidents results study abuse managed isp violations based comply protection
#271	0.183	technology investments investment information firm firms profitability value performance impact data higher evidence diversification industry payoff return findings decisions greater
#207	0.140	design artifacts alternative method artifact generation approaches alternatives tool science generate set promising requirements evaluation problem designed incentives components addressing
#112	0.126	services service network effects optimal online pricing strategies model provider provide externalities providing base providers fee complementary demand offer derive
#168	0.064	firms firm financial services firm's size examine new based result level including results industry important account does suggests characterize limited