After several decades of development on cyber security techniques, one clear conclusion can be drawn: no cyber security solution can completely remove the risks faced by the users. In this regard, cyber-insurance has been introduced as a means to enable the users to alleviate the damage from the cyber threats by transferring the cyber risks to an insurer. In this article, we study a cloud security service market, which is composed of cloud users and cloud security service vendors (CSSVs). The CSSVs work as the insurers for selling the cloud security plan, which is consisted of cloud security service and cloud-insurance. The users in the cloud platform can purchase the cloud security plan from the CSSVs to secure their cloud service. If the cloud service is attacked and loss happens, the users will receive the claim from the CSSVs. To lower the successful attack probability, the CSSV has an incentive to invest in improving its cloud security service. Specifically, we model and study the cloud security service market in the framework of a two-stage Stackelberg game. On the upper stage, the CSSVs lead to decide on their own strategies, i.e., the price of the cloud security plan and the security investment to improve their offered cloud security service. On the lower stage, the users follow to decide on the purchase of the cloud security plan according to the price of the cloud security plan and the perceived cyber breach probability of the cloud security service. We analytically verify that the Stackelberg equilibrium exists and is unique. Extensive simulations have been conducted to evaluate the performance of the Stackelberg game. The performance evaluation shows some insightful results. For example, when the users have strong interdependency, the profits of the CSSVs become lower.

Open-access blockchains based on proof-of-work protocols have gained tremendous popularity for their capabilities of providing decentralized tamper-proof ledgers and platforms for data-driven autonomous organization. Nevertheless, the proof-of-work based consensus protocols are vulnerable to cyber-attacks such as double-spending. In this paper, we propose a novel approach of cyber risk management for blockchain-based service. In particular, we adopt the cyber-insurance as an economic tool for neutralizing cyber risks due to attacks in blockchain networks. We consider a blockchain service market, which is composed of the infrastructure provider, the blockchain provider, the cyber-insurer, and the users. The blockchain provider purchases from the infrastructure provider, e.g., a cloud, the computing resources to maintain the blockchain consensus, and then offers blockchain services to the users. The blockchain provider strategizes its investment in the infrastructure and the service price charged to the users, in order to improve the security of the blockchain and thus optimize its profit. Meanwhile, the blockchain provider also purchases a cyber-insurance from the cyber-insurer to protect itself from the potential damage due to the attacks. In return, the cyber-insurer adjusts the insurance premium according to the perceived risk level of the blockchain service. Based on the assumption of rationality for the market entities, we model the interaction among the blockchain provider, the users, and the cyber-insurer as a two-level Stackelberg game. Namely, the blockchain provider and the cyber-insurer lead to set their pricing/investment strategies, and then the users follow to determine their demand of the blockchain service. Specifically, we consider the scenario of double-spending attacks and provide a series of analytical results about the Stackelberg equilibrium in the market game.

Benefit from the capabilities of providing decentralized tamper-proof ledgers and platforms for data-driven autonomous organization, open-access blockchains based on proof-of-work protocols have gained tremendous popularity. Yet, the proof-of-work based consensus protocols under threats, e.g., double-spending. In this paper, by adopting the cyber-insurance as an economic tool to neutralize cyber risks, we propose a novel approach of cyber risk management for blockchain-based service. The blockchain service market under our consideration is composed of four entities, i.e., the infrastructure provider, blockchain provider, cyber-insurer, and users. The blockchain provider purchases the computing resources, e.g., a cloud, from the infrastructure provider to maintain the blockchain consensus and then offers blockchain services to the users. The blockchain provider optimize its profit by strategizing its investment in the infrastructure in order to improve the security of the blockchain and the service price charged to the users. In the meantime, to prevent the potential damage incurred by the attacks and then fully secure the cyber-space, the blockchain provider purchases a cyber-insurance from the cyber-insurer. In return, the cyber- insurer adjusts the insurance premium according to the perceived risk level of the blockchain service and will pay the claim to the blockchain provider once attacks happen. Based on the rationality of the market entities, we model the interaction among the blockchain provider, users, and cyber-insurer as a two- stage Stackelberg game. Specifically, the blockchain provider and cyber-insurer lead to set their pricing/investment strategies in the upper level subgame, and then the users follow to determine their demand of the blockchain service in the lower level subgame. Specifically, we consider the scenario of double-spending attacks and provide a series of analytical results about the Stackelberg equilibrium in the market game.

Due to the fading and broadcast nature of wireless medium, it is challenging to provide full wireless coverage and secure the transmitted signals from unintended users in cellular networks. As a result, cyber risks, such as service outage and secrecy outage, would inevitably occur and cause loss/damage to the users. To transfer the cyber risks and mitigate the impact of loss, cyber insurance appears to be a promising solution for the economics of wireless services. In this paper, we introduce a cyber insurance framework for wireless users to relieve loss from the cyber risks. In this framework, each user pays a premium to an insurer. If the user experiences an outage, he/she will claim the loss, and the insurer will pay the corresponding %claim or indemnity to the user. Under the network model of a large-scale massive multiple-input multiple- output (MIMO) cellular networks and cyber insurance, we first characterize the user performance in terms of both service outage probability and secrecy outage probability using stochastic geometry analysis. Based on these performance results, we quantify the ruin probability of the cyber insurer, which indicates the chance that the insurer does not have enough capital reserve to afford the claims from the outage users. Through numerical evaluation, we show that the ruin probability of the insurer can be efficiently reduced by equipping a larger number of antennas at base stations or increasing network frequency reuse.

Cyber insurance has been introduced as the mean to transfer cyber risks to an insurance company, namely, insurer. The users are thus covered by the insurance to alleviate the damage from cyber threats. In this paper, we investigate the joint pricing and security investment in a cloud-insurance market. The market is composed of users, cloud providers, and cloud-insurers. The users subscribes to use the cloud service (platform) from the cloud providers. To protect from the damage, the users can buy a cloud-insurance product from the cloud-insurers which will pay a claim to the users if an attack happens to the cloud service. The users are interdependent in which they can take advantage of the positive security effects generated by other users' investments in security. We assume that the cloud provider and cloud-insurer are the business partners. Therefore, the cloud-insurers can invest in the cloud platform to improve the security level, i.e., quality, of the cloud service and hence reduce the probability of paying claim. Our proposed model consists of two stages, i.e., the Stackelberg game. In the first stage, cloud-insurers set the price charging to the users and decide on the investment for improving the cloud security quality. In the second stage, the users decide on the amount of these cloud-insurances to purchase based on the observed prices and qualities. The existence and uniqueness for the equilibrium of the Stackelberg game are proved analytically. The performance evaluation shows some interesting results. For example, when the users have strong interdependency, the price of the cloud-insurance becomes lower. This is from the fact that the users can be influenced more easily by their peers, when one cloud-insurer decreases the price, it can attract more users easily.

The development of mobile cloud computing has brought many benefits to mobile users as well as cloud service providers. However, mobile cloud computing is facing some challenges, especially security-related problems due to the growing number of cyberattacks which can cause serious losses. In this paper, we propose a dynamic framework together with advanced risk management strategies to minimize losses caused by cyberattacks to a cloud service provider. In particular, this framework allows the cloud service provider to select appropriate security solutions, e.g., security software/hardware implementation and insurance policies, to deal with different types of attacks. Furthermore, the stochastic programming approach is adopted to minimize the expected total loss for the cloud service provider under its financial capability and uncertainty of attacks and their potential losses. Through numerical evaluation, we show that our approach is an effective tool in not only dealing with cyberattacks under uncertainty, but also minimizing the total loss for the cloud service provider given its available budget.