| 摘要(英) |
With the vigorous development of the cyber activity, the cyber risks of various countries have increased yearly. Therefore, the insurance industry is also actively developing the insurance market in the cyber security field. However, in Taiwan, the development of insurance industry in this field is still limited due to insufficient understanding of classification and measurement of cyber risks. In fact, even in the United States, where cyber insurance started early, insurers did not have enough confidence in their own risk assessment model. It is not surprising that Taiwan is in such a predicament.
This research will first summarize and introduce the classification, frequency, approach, loss status, severity classification, etc. of various cyber risk events, and use real or hypothetical cases to specifically reproduce the situation, which can not only be used as a reference for insurance enterprises when designing products and drawing up premiums, but also be used by the insured enterprises as a basis for the research and development of cyber security policies. After that, this research will explain FAIR (Factor Analysis of Information Risk) model developed by Jack Freund and Jack Jones, and NIST (National Institute of Standards and Technology) cyber security framework, then draw up the parameters in FAIR based on the information mentioned in the first half of the paper, and combined with NIST cyber security framework, several medical institutions are used as examples to evaluate the risk of data breach, and finally the process of insurers obtaining premiums based on risk value is further simulated for their reference.
The research results show the consequences of the analysis taking medical industry as example, and due to the similarity of business, we can expect that the process of risk assessment in this research can also be applied to many other types of insured industries. Besides, types of losses experienced by diverse industries in various cyber incidents have also been tabulated. That can be used by insureds or insurers as a basis to adjust operating policies. |
| 參考文獻 |
2017 Cyber Risk Landscape, p.12, Risk Management Solutions, Inc.
https://tw.appledaily.com/international/20210508/Q2FQQ6KCWRHX5KDRH23BZQHF6A/
https://udn.com/news/story/6811/5450840
2017 Cyber Risk Landscape, p.20, Risk Management Solutions, Inc.
https://ec.ltn.com.tw/article/paper/1444465
A Guide to Cyber Risk, p.4, Allianz Global Corporate & Specialty
A Guide to Cyber Risk, p.7, Allianz Global Corporate & Specialty
Cyber Risk Outlook, Risk Management Solutions, Inc., p.31
A Guide to Cyber Risk, p.5, Allianz Global Corporate & Specialty
Sasha Romanosky, Lillian Ablon, Andreas Kuehn and Therese Jones, ”Content analysis of cyber insurance policies: how do carriers price cyber risk?”, Journal of Cybersecurity, Vol. 5, No. 1, p.2, RAND Corporation, 2019
https://www.cna.com.tw/news/afe/201909140070.aspx
Sasha Romanosky, Lillian Ablon, Andreas Kuehn and Therese Jones, ”Content analysis of cyber insurance policies: how do carriers price cyber risk?”, Journal of Cybersecurity, Vol. 5, No. 1, p.13, RAND Corporation, 2019
https://qualitestgroup.com/insights/white-paper/data-breach-patterns-across-industries-and-time
https://www.hipaajournal.com/healthcare-data-breach-statistics/
https://www.taiwannews.com.tw/ch/news/2364722
https://news.ltn.com.tw/news/life/breakingnews/2550469
https://www.ithome.com.tw/news/144606
Managing Cyber Insurance Accumulation Risk, p.18, Risk Management Solutions, Inc.
Managing Cyber Insurance Accumulation Risk, p.14, Risk Management Solutions, Inc.
https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=J0140003
https://www.nhi.gov.tw/DL.aspx?sitessn=292&u=LzAwMS9VcGxvYWQvMjkyL3JlbGZpbGUvMC8xNDU5NTkv5o%2bQ5aCxMTA45bm06LKh5YuZ5aCx5ZGK6Yar6Zmi6Yar55mC5pyN5YuZ55Sz5aCx5oOF5b2iLeWFqOeQg%2bizh%2bioiue2suS4iue2si5vZHM%3d&n=5o%2bQ5aCxMTA45bm06LKh5YuZ5aCx5ZGK6Yar6Zmi6Yar55mC5pyN5YuZ55Sz5aCx5oOF5b2iLeWFqOeQg%2bizh%2bioiue2suS4iue2si5vZHM%3d&ico%20=.ods
Managing Cyber Insurance Accumulation Risk, p.25, Risk Management Solutions, Inc.
Managing Cyber Insurance Accumulation Risk, p.26, Risk Management Solutions, Inc.
Managing Cyber Insurance Accumulation Risk, p.27, Risk Management Solutions, Inc.
Benjamin Edwards, Steven Hofmeyr and Stephanie Forrest, ” Hype and heavy tails: A closer look at data breaches”, Journal of Cybersecurity, Vol. 2, No. 1, RAND Corporation, 2016
Managing Cyber Insurance Accumulation Risk, p.30, Risk Management Solutions, Inc.
Guidelines 01/2021 on Examples regarding Data Breach Notification, European Data Protection Board
2021 Data Breach Investigations Report (DBIR), Verison
https://www.ithome.com.tw/news/105160
Managing Cyber Insurance Accumulation Risk, p.52~ p.58, Risk Management Solutions, Inc.
The state of ransomware 2020, Sophos
https://www.ithome.com.tw/news/143958
https://www.bleepingcomputer.com/news/security/revil-gang-tries-to-extort-apple-threatens-to-sell-stolen-blueprints/
Managing Cyber Insurance Accumulation Risk, p.33~p.37, Risk Management Solutions, Inc.
Quarterly DDoS Attack Report, Radware
https://www.f5.com/labs/articles/threat-intelligence/ddos-attack-trends-for-2020
https://www.eweek.com/security/sony-data-breach-was-camouflaged-by-anonymous-ddos-attack/
https://www.pcmag.com/archive/playstation-hack-to-cost-sony-171m-quake-costs-far-higher-264796
https://www.ithome.com.tw/node/68865
https://arstechnica.com/gadgets/2011/07/how-charlie-miller-discovered-the-apple-battery-hackhow-a-security-researcher-discovered-the-apple-battery-hack/
https://gizmodo.com/new-hack-can-trick-power-bricks-into-starting-fires-1844441247
https://zh.wikipedia.org/wiki/%E9%9C%87%E7%BD%91
https://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html
https://ithelp.ithome.com.tw/articles/10186904
https://en.wikipedia.org/wiki/Operation_Chastise
https://en.wikipedia.org/wiki/Hwacheon_Dam
https://en.wikipedia.org/wiki/Attack_on_the_Sui-ho_Dam
https://www.itsfun.com.tw/%E7%9F%B3%E5%A2%A8%E7%82%B8%E5%BD%88/wiki-7655216-7562195
https://www.techbang.com/posts/42951-ukraines-power-system-has-been-hit-by-phishing-and-discussions-about-how-to-strengthen-security
https://www.ithome.com.tw/news/114880
https://www.ithome.com.tw/news/142702
https://www.ithome.com.tw/news/142729
https://www.ithome.com.tw/news/138971
https://www.ithome.com.tw/news/144276
Managing Cyber Insurance Accumulation Risk, p.40~ p.43, Risk Management Solutions, Inc.
https://blog.trendmicro.com.tw/?p=55029
https://nos.nl/artikel/2343025-nederlandse-onderzoekers-manipuleren-verkeerslichten-met-virtuele-fietsers
https://www.hk01.com/%E4%B8%AD%E5%9C%8B/34570/%E8%B6%8A%E5%8D%97%E6%A9%9F%E5%A0%B4%E7%96%91%E9%81%AD%E8%8F%AF%E9%BB%91%E5%AE%A2%E5%85%A5%E4%BE%B5-%E8%88%AA%E7%8F%AD%E8%B3%87%E6%96%99%E8%AE%8A-%E5%8D%97%E6%B5%B7%E6%98%AF%E4%B8%AD%E5%9C%8B%E7%9A%84?fbclid=IwAR3VzEaslA73NXA7x-V_3ghIodql8iE3W2wTjFTRV8fawlEkAlfu_FTvOBo
https://www.zdnet.com/article/iran-reports-failed-cyber-attack-on-strait-of-hormuz-port/
https://news.ltn.com.tw/news/world/breakingnews/3618540
http://www.tssdnews.com.tw/index.php?FID=9&CID=571695
Managing Cyber Insurance Accumulation Risk, p.46~ p.48, Risk Management Solutions, Inc.
Managing Cyber Insurance Accumulation Risk, p.49, Risk Management Solutions, Inc.
https://www.opengroup.org/forum/security-forum-0/openFAIRandquantitativerisk |
[Endnote RIS 格式]
[相關文章]
[文章引用]
[完整記錄]
[館藏目錄]
[檢視]
plurk
funp
live
udn
HD
myshare
netvibes
friend
youpush
delicious
baidu
Google bookmarks
del.icio.us
hemidemi
facebook
twitter
google
reddit