基于成熟度模型的系统网络保险定价
Pricing cyber-insurance for systems via maturity models
AI总结：
针对网络保险历史数据有限、现有精算方法难适配的问题，研究提出由实体关系图、安全成熟度模型和经济模型组成的社会经济建模框架，可支撑网络保险定价与从业者风险共识，支持用户选择系统描述的抽象层级。
摘要：
为信息技术系统相关风险的保险定价是一项复杂的建模难题，融合了运营管理、安全和经济学等多学科领域。本研究提出了一套用于网络保险决策的社会经济建模框架，该框架由实体关系图、安全成熟度模型和经济模型组成，解决了在网络保险保单设计与定价中纳入组织结构特征这一长期存在的研究难题。保险定价通常依托保险公司长期积累的经验，即基于企业规模、行业部门和地理位置确定其损失规模与发生频率，因此保费计算会从由这些因素决定的基准值起步。网络保险的一项独特挑战在于历史数据有限，且未必能反映未来的损失风险，这意味着其他保险险种沿用的精算方法可能并非最优定价策略。本文提出的建模框架为网络保险生态中的从业者就网络安全风险达成共识提供了载体，还允许用户在系统描述中选择所需的抽象层级。
英文摘要：
Pricing insurance for risks associated with information technology systems presents a complex modelling challenge, combining the disciplines of operations management, security, and economics. This work proposes a socioeconomic modelling framework for cyber-insurance decisions compromised of entity relationship diagrams, security maturity models, and economic models, addressing a long-standing research challenge of capturing organizational structure in the design and pricing of cyber-insurance policies. Insurance pricing is usually informed by the long experience insurance companies have of the magnitude and frequency of losses that arise in organizations based on their size, industry sector, and location. Consequently, their calculations of premia will start from a baseline determined by these considerations. A unique challenge of cyber-insurance is that data history is limited and not necessarily informative of future loss risk meaning that established actuarial methodology for other lines of insurance may not be the optimal pricing strategy. The modelling framework proposed in this paper provides a vehicle for agreement between practitioners in the cyber-insurance ecosystem on cyber-security risks and allows for the users to choose their desired level of abstraction in the description of a system.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
