Optimal Risk Management in Critical Infrastructures against Cyber-Adversaries

One of the biggest cyber-security problems that our critical infrastructures face is the underinvestment in cyber-security solutions by private firms operating these systems. A healthy market insurance may incentivize asset owners to invest more in cyber-security protections in order to pay lower premiums to manage their residual risk. In this paper we model the problem of optimal risk management in critical infrastructures and show conditions where insurance motivates asset owners to invest more in security, and other conditions where even government incentives for the adoption of insurance may have the opposite effect of reducing cyber-security investments.