Paper: arXiv 2312.13884

Authors: Gregor Svindland, Alexander Voß

Abstract

We introduce a decision-making framework tailored for the management of systemic risk in networks. This framework is constructed upon three fundamental components: (1) a set of acceptable network configurations, (2) a set of interventions aimed at risk mitigation, and (3) a cost function quantifying the expenses associated with these interventions. While our discussion primarily revolves around the management of systemic cyber risks in digital networks, we concurrently draw parallels to risk management of other complex systems where analogous approaches may be adequate.

Complexity vs Empirical Score

  • Math Complexity: 4.5/10
  • Empirical Rigor: 3.0/10
  • Quadrant: Philosophers — conceptual discussion, limited math and data

Why this score: The paper presents a conceptual decision-making framework for managing systemic cyber risk in networks using formal optimization notation. However, it lacks empirical validation, backtesting on real-world network data, and algorithmic implementation details.

Research Flowchart

  flowchart TD
    A["Goal: Manage & Mitigate Systemic Cyber Risk in Networks"] --> B["Define Input Components"]
    
    subgraph Inputs["Data & Inputs"]
        B1["1. Acceptable Configurations"]
        B2["2. Mitigation Interventions"]
        B3["3. Intervention Cost Function"]
    end
    
    B --> Inputs
    Inputs --> C["Cross-Asset Optimization & Modeling"]
    
    C --> D["Evaluate Interventions vs. Network Constraints"]
    D --> E["Optimal Risk Mitigation Strategy at Minimal Cost"]

Cited References (169)

  1. The Limits of Regulation by Insurance (2022)
  2. A concise survey of advancements in recovery strategies for resilient complex networks (2018) — link
  3. Resilience to contagion in financial networks (2016) — link
  4. Infinite Dimensional Analysis (2006)
  5. Allianz Risk Barometer (2022)
  6. Cyber Insurance Ratemaking: A Graph Mining Approach (2021)
  7. Multivariate Shortfall Risk Allocation and Systemic Risk (2018) — link
  8. Coherent Measures of Risk (1999)
and 161 more
  1. Modeling and pricing cyber insurance (2023)
  2. Building resilience in cybersecurity: An artificial lab approach (2024) — link
  3. Contagion in cyber security attacks (2017) — link
  4. Emergence of scaling in random networks (1999)
  5. Network Science (2016) — link
  6. Dynamical Processes on Complex Networks (2008)
  7. Principles of European Insurance Contract Law (PEICL) (2016)
  8. Optimisation and Stability Theory for Economic Analysis (1990)
  9. Total communicability as a centrality measure (2013) — link
  10. Multivariate Hawkes process for cyber insurance (2021)
  11. The Mathematical Concept of Measuring Risk (2014) — link
  12. A unified approach to systemic risk measures via acceptance sets (2019) — link
  13. Cyber-Insurance Revisited (2005)
  14. Models and measures for correlation in cyber-insurance. (2006)
  15. Modeling Cyber-Insurance: Towards a Unifying Framework (2010)
  16. A Fundamental Approach to Cyber Risk Analysis (2018)
  17. Modern Graph Theory (1998)
  18. A New Perspective on Internet Security using Insurance (2008) — link
  19. Economic incentives to increase security in the Internet: The case for insurance (2009)
  20. Cyber risk modeling using a two-phase Hawkes process with external excitation (2023) — link
  21. Cyber Mapping the Financial System (2020)
  22. Markov Chains (1999) — link
  23. Spectra of graphs (2012) — link
  24. IT-Grundschutz-Kompendium (2022)
  25. Cyber Insurance Exposure Data Schema v1.0 (2016)
  26. Risk measures for power failures in transmission systems (2016) — link
  27. A Taxonomy of Operational Cyber Security Risks Version 2 (2014)
  28. An Axiomatic Approach to Systemic Risk (2013)
  29. Realtime Robustification of Interdependent Networks under Cascading Attacks (2018) — link
  30. Dynamic Contract Design for Systemic Cyber Risk Management of Interdependent Enterprise Networks (2020)
  31. Cyber Network Resilience Against Self-Propagating Malware Attacks (2022)
  32. Modeling self-propagating malware with epidemiological models (2023)
  33. Framework for cyber risk loss distribution of hospital infrastructure: Bond percolation on mixed random graphs approach (2023) — link
  34. Cyber risk outlook (2019)
  35. Laplacian Spectra of Graphs and Cyber-Insurance Protection (2020)
  36. CRO Forum Concept Paper on a proposed categorisation methodology for cyber risk (2016)
  37. On a conjecture of V. Nikiforov (2009) — link
  38. Joint Cyber Risk Assessment of Network Systems with Heterogeneous Components (2020)
  39. Building up cyber resilience by better grasping cyber risk via a new algorithm for modelling heavy-tailed data (2023) — link
  40. Managing cyber risk, a science in the making (2023) — link
  41. The minimal spectral radius of graphs with a given diameter (2007) — link
  42. Systemic Risk in Networks (2019)
  43. Managing Default Contagion in Inhomogeneous Financial Networks (2019) — link
  44. The Price of Data Security: A guide to the insurability of GDPR fines across Europe (2020)
  45. EIOPA Strategy on Cyber Underwriting (2020)
  46. Systemic Risk in Financial Systems (2001)
  47. Cyber risk research in business and actuarial science (2020)
  48. The physics of communicability in complex networks (2012) — link
  49. Systemic cyber risk (2020)
  50. Mitigating systemic cyber risk (2022)
  51. On Random Graphs I (1959)
  52. A Framework for Measures of Risk under Uncertainty (2023) — link
  53. Pricing of cyber insurance contracts in a network model (2018)
  54. Cyber risk research impeded by disciplinary barriers (2019)
  55. Cyber Risk and the U.S. Financial System: A Pre-Mortem Analysis (2021)
  56. Measures of systemic risk (2017)
  57. Acceptable designs of traffic networks: stochastic cell transmission models and systemic risk (2023)
  58. Systemic Cyber Risk: A Primer (2022)
  59. Handbook on Systemic Risk (2013)
  60. CO-Fun: A German Dataset on Company Outsourcing in Fund Prospectuses for Named Entity Recognition and Relation Extraction (2024) — link
  61. Stochastic Finance: An Introduction in Discrete Time (2016)
  62. Spatial Risk Measures: Local Specification and Boundary Risk (2014)
  63. Spatial risk measures and their local specification: The locally law-invariant case (2014) — link
  64. The Axiomatic Approach to Risk Measures for Capital Determination (2015) — link
  65. $D^2M$: Dynamic Defense and Modeling of Adversarial Movement in Networks (2020)
  66. Graph Vulnerability and Robustness: A Survey (2022) — link
  67. A Bayesian Methodology for Systemic Risk Assessment in Financial Networks (2017) — link
  68. Allgemeine Versicherungsbedingungen f"ur die Cyberrisiko-Versicherung (AVB Cyber), Musterbedingungen des GDV (2017)
  69. Unverbindlicher Muster-Fragebogen zur Risikoerfassung im Rahmen von Cyber-Versicherungen f"ur kleine und mittelst"andische Unternehmen (2019)
  70. A general method for numerically simulating the stochastic time evolution of coupled chemical reactions (1976) — link
  71. Exact stochastic simulation of coupled chemical reactions (1977) — link
  72. Community structure in social and biological networks (2002) — link
  73. Graph Neural Networks: Foundations, Frontiers, and Applications (2022)
  74. Optimization of network protection against virus spread (2011)
  75. tikz-network: a LATEX library for vizualizing complex networks (2017)
  76. Complete game-theoretic characterization of SIS epidemics protection strategies (2014) — link
  77. Copula-based actuarial model for pricing cyber-insurance policies (2011)
  78. Cyber insurance and private governance: The enforcement power of markets (2021)
  79. An expansion formula for Hawkes processes and application to cyber-insurance derivatives (2023) — link
  80. Propagation of cyber incidents in an insurance portfolio: counting processes combined with compartmental epidemiological models (2021)
  81. Cyber-contagion model with network structure applied to insurance (2022)
  82. Risk-consistent conditional systemic risk measures (2016) — link
  83. Strongly consistent multivariate conditional risk measures (2018)
  84. Contagion! Systemic Risk in Financial Networks (2016) — link
  85. Unpacking cyber norms: private companies as norm entrepreneurs (2018)
  86. Systemic Risk in Financial Networks: A Survey (2021) — link
  87. Dynamic structural percolation model of loss distribution for cyber risk of small and medium-sized enterprises for tree-based LAN topology (2020)
  88. Introduction to Cataloging and Classification, 11th Edition (2015) — link
  89. Second look at the spread of epidemics on networks (2007) — link
  90. A contribution to the mathematical theory of epidemics (1927)
  91. Exact deterministic representation of Markovian SIR epidemics on networks with and without loops (2015) — link
  92. Mathematics of Epidemics on Networks (2017) — link
  93. Finding shortest and nearly shortest path nodes in large substantially incomplete networks by hyperbolic mapping (2023)
  94. Cybersecurity (2020)
  95. Macroprudential policy in Europe – the future depends on what we do today (2021) — link
  96. Cyber security in the age of COVID-19: A timeline and analysis of cyber-crime and cyber-attacks during the pandemic (2021) — link
  97. Becoming Cybercriminals: Incentives in Networks with Interdependent Security (2016)
  98. Efficient Behavior of Small-World Networks (2001) — link
  99. Fast response to infection spread and cyber attacks on large-scale networks (2013) — link
  100. Why cybersecurity insurance should be regulated and compulsory (2021)
  101. Here comes the wave of insurance claims for the CrowdStrike outage (2024) — link
  102. Voluntary Participation in Cyber-insurance Markets (2014)
  103. Smart rewiring for network robustness (2013) — link
  104. Cyber-insurance survey (2017)
  105. Rechtsfortbildung im Richtlinienrecht – Zur judikativen Rechtsangleichung durch den EuGH im Urheberrecht (2017)
  106. Non-Life Insurance Mathematics: An Introduction With Stochastic Processes (2004)
  107. Performance Analysis of Complex Networks and Systems (2014) — link
  108. A critical point for random graphs with a given degree sequence (1995)
  109. Networks (2018)
  110. Glossary of the National Institute of Standards and Technology (2022)
  111. Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (Text with EEA relevance) (2022)
  112. Zero Trust Architecture (2020) — link
  113. Reinforcement Learning on Graphs: A Survey (2023) — link
  114. National control and cyber resilience to safeguard national security. As open as possible, as secure as necessary (2022-2023)
  115. Encouraging Clarity in Cyber Insurance Coverage: The Role of Public Policy and Regulation (2020)
  116. Cyber insurance and IT security investment (2005)
  117. Will cyber insurance improve network security? A market analysis (2014)
  118. Epidemic processes in complex networks (2015)
  119. Networks of Scientific Papers (1965)
  120. A general theory of bibliometric and other cumulative advantage processes (1976)
  121. The making of a cyber crash: a conceptual model for systemic risk in the financial sector (2020)
  122. New European General Data Protection Regulation (2018)
  123. Versicherungsvertragsgesetz (2019)
  124. Resilience Decision-Making for Complex Systems (2020) — link
  125. Characterization of robustness and resilience in graphs: a mini-review (2021) — link
  126. Towards Cyber Mapping the German Financial System with Knowledge Graphs (2024)
  127. Cyber-insurance framework for large scale interdependent networks (2014)
  128. Bundesdatenschutzgesetz (2014)
  129. Maximum entropy formulation of the Kirkwood superposition approximation (2004)
  130. Deterministic epidemic models on contact networks: correlations and unbiological terms (2011)
  131. Exact Equations for SIR Epidemics on Tree Graphs. (2015) — link
  132. Can competitive insurers improve network security? (2010)
  133. Competitive cyber insurance and Internet Security (2010)
  134. Regression for copula-linked compound distributions with applications in modeling aggregate insurance claims (2020)
  135. An analysis of information security management strategies in the presence of interdependent security risk (2012)
  136. Proposal for a NIS directive 2.0: companies covered by the extended scope of application and their obligations (2021)
  137. The degree variance: An index of graph heterogeneity (1981) — link
  138. Self-similarity of complex networks (2005)
  139. Modeling Malicious Hacking Data Breach Risks (2020) — link
  140. Data Breach, Privacy, and Cyber Insurance: How Insurance Companies Act as “Compliance Managers” for Businesses (2018)
  141. Compulsory Corporate Cyber-Liability Insurance: Outsourcing Data Privacy Regulation to Prevent and Mitigate Data Breaches (2017)
  142. Guideline ``State of the Art’’ (2021)
  143. Network robustness versus multi-strategy sequential attack (2014) — link
  144. Characterizing complex networks with Forman-Ricci curvature and associated geometric flows (2017)
  145. Understanding Systemic Cyber Risk (2016)
  146. Systemic Cyber Risk and Aggregate Impacts (2022)
  147. Does Insurance Have a Future in Governing Cybersecurity? (2020) — link
  148. Cybersecurity insurance: Modeling and pricing (2019)
  149. Pricing cyber insurance for a large-scale network (2020)
  150. Security adoption and influence of cyber-insurance markets in heterogeneous networks (2014)
  151. A comprehensive model for cyber risk based on marked point processes and its application to insurance (2021)
  152. Risk mitigation services in cyber insurance: optimal contract design and price structure (2023)
  153. Is accumulation risk in cyber methodically underestimated? (2024) — link
  154. Iterative methods for linear complementarity problems with upperbounds and lowerbounds (1983)
  155. A continuation method for monotone variational inequalities (1995)
  156. A non-interior-point continuation method for linear complementarity problems (1993)
  157. Superlinear noninterior one-step continuation method for monotone \emph LCP in the absence of strict complementarity (2001)
  158. Non-interior continuous methods for solving semidefinite complementarity problems (2003)
  159. Biological invasions: Theory and practice (1997)
  160. Theorey and Applications of Hopf Bifurcation (1981)
  161. Introduction to Functional Differential Equations (1993)

0 of 169 cited works are in the corpus; resolved via arXiv source bundles, Semantic Scholar and OpenAlex. Corpus-wide: 2518 linked papers.