Skip to main content

Mapping the Coverage of Security Controls in Cyber Insurance Proposal Forms

Woods, Daniel, Agrafiotis, Ioannis, Nurse, Jason R. C., Creese, Sadie (2017) Mapping the Coverage of Security Controls in Cyber Insurance Proposal Forms. Journal of Internet Services and Applications, 8 (8). ISSN 1867-4828. (doi:10.1186/s13174-017-0059-y)

Abstract

Policy discussions often assume that wider adoption of cyber insurance will promote information security best practice. However, this depends on the process that applicants need to go through to apply for cyber insurance. A typical process would require an applicant to fill out a proposal form, which is a self-assessed questionnaire. In this paper, we examine 24 proposal forms, offered by insurers based in the UK and the US, to determine which security controls are present in the forms. Our aim is to establish whether the collection of security controls mentioned in the analysed forms corresponds to the controls defined in ISO/IEC 27002 and the CIS Critical Security Controls; these two control sets are generally held to be best practice. This work contains a novel research direction as we are the first to systematically analyse cyber insurance proposal forms. Our contributions include evidence regarding the assumption that the insurance industry will promote security best practice. To address the problem of adverse selection, we suggest the number of controls that proposal forms should include to be in alignment with the two information security frameworks. Finally, we discuss the incentives that could lead to this disparity between insurance practice and information security best practice, emphasising the importance of information security economics in studying cyber insurance.

Item Type: Article
DOI/Identification number: 10.1186/s13174-017-0059-y
Uncontrolled keywords: Business security, Security controls, Cyber insurance, SANS20 controls, ISO/IEC 27000 series
Subjects: H Social Sciences > HG Finance
Q Science
T Technology
Divisions: Faculties > Sciences > School of Computing > Security Group
Faculties > Social Sciences > Kent Business School
Depositing User: Jason Nurse
Date Deposited: 03 Jul 2018 15:47 UTC
Last Modified: 01 Aug 2019 10:43 UTC
Resource URI: https://kar.kent.ac.uk/id/eprint/67473 (The current URI for this page, for reference purposes)
Nurse, Jason R. C.: https://orcid.org/0000-0003-4118-1680
  • Depositors only (login required):

Downloads

Downloads per month over past year