6th European Conference - Academic Conferences

Mecealus Cronkrite et al.
socially efficient level of cyber security which is greater than the private level The graph in Figure 2,
shows the public’s demand for security is greater than individual firms.
Figure 2: Demand vs. Investment in cyber security
4.4 Mitigation: Create information systems cyber security insurance market
Data breeches usually have no consequences or fines for the company that lost the customer data,
and even fewer for the development team that wrote the software or configured the servers. A cyber
security insurance market can create an economic incentive for firms to implement better security
standards. To establish the market governments would have to create laws placing partial liability for
cyber attacks on software publishers and operating firms if they negligent by failing to implement sufficient
security standards and practices. (Baer and Parkinson, 2007:50 – 56)
With better cyber incident, reporting research and insurance communities can find common risky behaviour
patterns. Since private insurance companies use actuary tables and measure risk they would
be able to establish scalable cyber security requirements. In exchange for coverage and premium
discounts, insurance companies can require private firms to take reasonable steps to protect their
systems, within a risk management system. Premiums can assign a higher risk to IT security
breaches stemming from programming errors and failure to adopt best practice standards in cyber
security.
Market forces will generate an insurance market that accommodates different sizes of firms. A major
difficulty regarding this policy implementation is to ensure premiums are not too costly for firms to afford.
As a result, it may be necessary for government to cap the amount of damages that a firm may
pay. The government can help establish the cyber insurance market by facilitating reinsurance
through indemnifying catastrophic losses.
4.5 Mitigation: Compliance in U.S Federal IT acquisition security standards (fines)
Government IT acquisition and procurement decisions are unlike private corporations. In private concerns,
shareholder value should ultimately control spending so the implementation of security is profit
goal driven. The US Federal Government has complex goals for the public good, accountability, fairness,
and transparency. However, the majority of CCI is located within the private sector so to encourage
effective standards government has to rely on market forces and voluntary partnerships with
industry. (Golumbic, 2008)
Governments and (CI) systems increasingly dependent on commercially developed software in doing
so they have transferred security risk upstream to the developers. As a result, the US government has
created many of its own models for secure IT acquisition and procurement that either impact system
development processes. For example, NIST Special Publication 800 series, the DOD standard
DIACAP, and Federal Information Security Management Act (FISMA) all are US regulations to deal
73