Optimisation of cyber insurance coverage with selection of cost effective security controls

TL;DR

The paper tackles the problem of optimally distributing budget between cyber insurance and self‑protection while selecting cost‑effective security controls for a risk‑averse organization. It models the problem as a multi‑objective 0‑1 knapsack, linking investments and control configurations to residual risk, and analyzes both insuring residual risk and paying premiums under a competitive market. The authors propose an exact dynamic programming solution with a projection‑based dominance refinement and compare it to Greedy and Genetic Algorithm variants, showing trade‑offs between optimality and computation time. Experiments indicate that full insurance is optimal in a competitive market, and the DP with projection provides scalable exact solutions for moderate problem sizes, while GA offers stronger performance for larger problem instances. The work yields practical guidance for cyber risk management by enabling explicit security‑control selection alongside insurance budgeting to achieve cost‑effective risk reduction.

Abstract

Nowadays, cyber threats are considered among the most dangerous risks by top management of enterprises. One way to deal with these risks is to insure them, but cyber insurance is still quite expensive. The insurance fee can be reduced if organisations improve their cyber security protection, i.e., reducing the insured risk. In other words, organisations need an investment strategy to decide the optimal amount of investments into cyber insurance and self-protection. In this work, we propose an approach to help a risk-averse organisation to distribute its cyber security investments in a cost-efficient way. What makes our approach unique is that next to defining the amount of investments in cyber insurance and self-protection, our proposal also explicitly defines how these investments should be spent by selecting the most cost-efficient security controls. Moreover, we provide an exact algorithm for the control selection problem considering several threats at the same time and compare this algorithm with other approximate algorithmic solutions.

Figures (6)

• Figure 1: Recursive algorithm
• Figure 2: Crossover techniques
• Figure 3: Mutation process
• Figure 4: ($Exp$) expenditure for security self-investments $x$
• Figure 5: Comparison of execution time for 4 solutions in case of increasing number of threats with 20 control cases