Joint Leiden-Delft-Erasmus project on Cyber Insurance 23 January, Delft, the Netherlands Intro , goede vraag aan de zaal. Who has car insurance? Who has cyber insurance? How did we connect to eachother? What did we do? How did we combine the different LDE universities? What are results/next steps?

How it al started Beste Wolter, Volgens mij hebben wij elkaar kort gesproken op een cyber security evenement in Den Haag … …. Toevallig ben ik volgende week 3 april in Delft voor het 'colloquium'. Lijkt het jou opportuun om die dag elkaar even te spreken over mogelijkheden tot kennisdeling? Groet, Bernold Beste André,  In de cc vind je Bernold Nieuwsteeg, hij en Wolter Pieters houden zich bezig met de subgroep cybersecurity and economics binnen het LDE center for safety and security. Omdat jij je ook hiermee bezig houdt heb ik jouw naam doorgegeven. Wellicht dat jullie iets voor elkaar kunnen betekenen?  Vriendelijke groeten,  Nina van der Knaap Beste Bernold,   Dank voor je belangstelling! ... Ik heb overigens op mijn todo-lijst staan het opzetten van een Leiden-Delft-Erasmus samenwerking op het gebied van economics of cyber security… Groet, Wolter

The team, dr.ir.mr.drs. combined Security risk management Econometrics Law & Economics Dr. Dr.ir Mr.ir Andre Wolter Bernold Not only different universitiies but alsodifferent backgrounds

The subject, multidisciplinary challenges of cyber security Information Externalities

Potential added value of cyber insurance Insurance = transfer of risk

Insurers have incentives to reduce risk and share information about efficient risk reduction

Internalization of externalities

Hence there is a research opportunity Lack of knowledge about actual insurance policies

Organizations and their differences (1) Desiderius Tax Advice de Waal F A C E Turnover greater than 1 Million

Organizations and their differences (2) Desiderius Tax Advice de Waal F A C E Low vers. High risk

We did research on these insurance companies

Very few insurers have ‘risk reduction’ clauses AIG: “Al reasonable steps” AON: more smart, weekly backup and update virusscanner

The added value of LDE research lies in the different perspectives and quickly accessible knowledge Different perspectives to analysis the status of the cyber insurance market Insurance contract Legal issues ( in fact in most contracts clauses were so vague that an insurer could easily work around it in case of severe damage) Security issues (frequency of occurrence and severity (expert thest could you rank the coverage clauses in order of importance?) Econometric issues (inducing the model that insurers based on premiums and contracts) Integrated view, that’s what the market demands. Quickly accessible knowledge You can obviously find the answer on the econometric model behind an insurance policy, but if you have Andre Hoogstrate in your team, thinkgs go more quick, Hard to find a common view? Well, you need to take some more time, but eventually the results are there, however, there are still a lot of researchers that do not look even beyond there own aile.

Next steps for future research Micro-level How can we compare coverage clauses? Meso-level How can we increase data about cyber insurance? What are the prerequisites to generalize the research to other fields? Macro-level Is cyber insurance the way to go? (maybe pooling is better?)

Next steps, example of cyber risk pooling Based on the insights we already received €5k cofunding for research regarding cyber pooling ( an alternative for cyber insurance Results externalize to broader society.

Questions?