Although written from an insurance perspective, this recently published academic paper’s treatment of cloud concentration, correlated failure, and scenario calibration is highly transferable to operational resilience.
The paper develops a framework for modelling systemic cloud outages and measuring concentration risk across cyber-insurance portfolios, explicitly building on EIOPA’s use of cloud outage as a cyber stress scenario.
Authors: Olivier Lopez and Daniel Nkameni
Abstract
The expansion of the cyber insurance market remains exposed to the threat of accumulation events that could simultaneously affect a large number of policyholders. Although few such catastrophes have been observed so far, apart from worldwide cyberattacks such as WannaCry and NotPetya in 2017, the nature of cyber risk makes their occurrence plausible. Stress-testing tools are therefore needed to assess whether an insurance portfolio can withstand such crises. In this perspective, the European Insurance and Occupational Pensions Authority (EIOPA) has identified cloud outage as one of the key scenarios to consider in cyber insurance stress-testing frameworks. In this paper, [the authors] propose a framework to model and calibrate cloud-outage scenarios and to measure the diversification of a cyber insurance portfolio. [They] also show how this diversification can protect against accumulation risk and provide underwriting guidelines to reduce the vulnerability of a portfolio to cloud-outage scenario.
