Dambra Savino

Leyla Eurecom

Bilge

Davide Balzarotti Eurecom

SoK: Cyber Insurance -Technical Challenges and a System Security Roadmap

Cyber attacks have increased in number and complexity in recent years, and companies and organizations have accordingly raised their investments in more robust infrastructure to preserve their data, assets and reputation. However, the full protection against these countless and constantly evolving threats is unattainable by the sole use of preventive measures. Therefore, to handle residual risks and contain business losses in case of an incident, firms are increasingly adopting a cyber insurance as part of their corporate risk management strategy.

As a result, the cyber insurance sector -which offers to transfer the financial risks related to network and computer incidents to a third party -is rapidly growing, with recent claims that already reached a $100M dollars. However, while other insurance sectors rely on consolidated methodologies to accurately predict risks, the many peculiarities of the cyber domain resulted in carriers to often resort to qualitative approaches based on experts opinions.

This paper looks at past research conducted in the area of cyber insurance and classifies previous studies in four different areas, focused respectively on studying the economical aspects, the mathematical models, the risk management methodologies, and the predictions of cyber events. We then identify, for each insurance phase, a group of practical research problems where security experts can help develop new data-driven methodologies and automated tools to replace the existing qualitative approaches.

I. INTRODUCTION

The modern society is highly dependent on Information and Communication Technologies (ICT). However, despite its paramount importance, the use of ICT also introduces a series of hazards. In fact, computer systems and services are routinely compromised and cyber incidents adversely impact many organizations, hampering business-goal achievements and resulting in copious financial losses [START_REF]Cyber Incident & Breach Trends Report[END_REF]. For this reason, cybersecurity has quickly become a subject of debate in executive boards [START_REF] Bdo | Bdo -board survey[END_REF] and companies are increasingly investing in ICT security products [START_REF]Managing Cyber Security as a Business Risk: Cyber Insurance in the Digital Age[END_REF]. Overall, the security sector is expected to grow in 2019 to a 124 billion USD market, with application security testing, data loss prevention, and advanced threat protection representing the core investments [START_REF] Gartner | Gartner forecasts worldwide information security spending to exceed $124 billion in 2019[END_REF].

Despite the importance of this considerable and rapidly-increasing effort, it is well understood that cyber attacks cannot be prevented by technical solutions alone and the protection against all possible threats is neither possible nor economically feasible. Thus, in order to handle the residual risk, organizations are rapidly moving towards managing their cyber risk by incorporating cyber insurance into their multi-layer security frameworks. Cyber insurance is defined to be the way to transfer the financial risks related to network and computer incidents to a third party [START_REF] Böhme | Modeling cyber-insurance: Towards a unifying framework[END_REF]. Compared with traditional insurance policies for business interruption and crime, a cyber-insurance policy can also cover, for instance, digital data loss, damage and theft, as well as losses due to network outages, computer failures, and website defacements.

A. A booming phenomenon missing solid foundations

As evinced by recent market reports, the adoption of cyber insurance has tremendously increased over the last decade, achieving an annual growth rate of over 30% since 2011 [START_REF]Global cyber market overview[END_REF]. This is also reflected in the growing number of claims submitted for cyber incidents in a wide range of business sectors [START_REF]Cyber insurance claims: Ransomware disrupts business[END_REF] and that, in few striking cases, have seen insurance companies paying even hundred-million-dollar indemnities [START_REF]insurers pay large claims for high profile cyber attacks[END_REF].

Following this trend, the cyber-insurance market is forecasted to reach 14 billion USD in gross premiums by 2022 [START_REF] Potdar | Cyber insurance market overview[END_REF] and several indicators confirm this direction. First, cyber crimes have never been so profitable [START_REF] Nohe | Re-hashed: 2018 cybercrime statistics: A closer look at the web of profit[END_REF] and the growing number of attacks is increasing the awareness of board members about cyber risks and the impossibility of only relying on preventive solutions [START_REF] Sussman | 5 reasons cyber insurance market will hit $23 billion[END_REF]. This pushes a growing number of companies, among which even more small-and medium-size enterprises, to start considering cybersecurity insurance as a risk mitigation strategy: in fact, data show that 66% of them would need to shut down if hit by a data breach [START_REF] Nohe | Study: 66% of smbs would shut down if hit by a data breach[END_REF]. Another strong driver for the cyber-insurance domain is the introduction of global regulations on personally identifiable information loss, such as GDPR and CCPA. For instance, the need to cover fines and the high cost of handling user notifications are already creating interest in purchasing cyber insurance [START_REF] White | What is GDPR's impact on Cyber Insurance?[END_REF].

In other words, while researchers and security experts are still debating whether cyber insurances even make sense and how they could be better implemented, insurance companies are already selling them as part of their portfolio. We may like it or not, but this is already a reality -and as it often happens in our field, security needs to catch up with an immature technology that was rushed to the market. As we will see in the rest of the paper, companies are currently struggling against the demand of cyber policies as existing tools and methodologies to assess risk exposures and pricing are inadequate in the cyber domain. Although past studies have concluded that, without considering catastrophic scenarios, the vast majority of cyber risks are insurable [START_REF]Cyber Risk: Too Big to Insure?[END_REF]- [START_REF] Biener | Insurability of cyber risk: An empirical analysis[END_REF], carriers are missing solid methodologies, standards, and tools to carry out their measurements. The result, as we will comprehensively detail later in this work, is that purely qualitative assessment of such risks leads to inaccurate evaluations, not properly tailored to the customers but mainly based on averages for their industrial sectors [START_REF]Views from the C-suite Survey 2018[END_REF].

B. Motivation

Researchers and practitioners have studied the main aspects, the evolution, and the core challenges of cyber insurance for more than two decades [START_REF] Majuca | The evolution of cyberinsurance[END_REF]. Marotta et al. [START_REF] Marotta | Cyberinsurance survey[END_REF] recently published a survey in which they discuss the history, current status, peculiarities, formalization, and future directions of the cyber-insurance domain. However, while researchers have extensively looked at the theoretical aspects of the cyber ecosystem, there exists a very limited number of studies that relied on real data and leveraged the domain expertise of system security experts [START_REF] Liu | Cloudy with a chance of breach: Forecasting cyber security incidents[END_REF]- [START_REF] Bossler | On-line activities, guardianship, and malware infection: An examination of routine activities theory[END_REF]. For example, as noted by Allodi et al [START_REF] Allodi | Security events and vulnerability data for cybersecurity risk estimation[END_REF], while in other sectors risk assessment is based on quantitative estimations, cybersecurity risks are typically computed by using qualitative risk matrices that rely on subjective experts opinions. And this is just the tip of the iceberg. Researchers have so far focused on understating if, and to what extent, a cyber-insurance market can be useful, and which advantages and incentives it can bring to the different parties and to the global ecosystem (both in economic and security terms). However, very little has been done to explore how such insurance schemes can be implemented in a rigorous and scientific way.

To cover this gap, this paper aims at providing an extensive discussion of the technical aspects and open challenges in the cyber-insurance domain, emphasizing how security experts can contribute to this rapidly evolving area. For example, we will discuss how, despite their apparent similarity, risk assessment and risk prediction are not interchangeable concepts, and the method provided by the first may fall short on the requirements for accurately predicting future cyber incidents.

We believe the cyber-insurance field raises many technical questions that require the expertise of system security researchers: how can one identify and collect low-level risk indicators and compare them with externally-observable events? Is it possible to automatically extract dependencies among different software and services and capture the risk introduced by the supply-chain of a company? These are only two examples out of a long list of open research problems we have identified throughout this paper. Our main goal is to present a thorough discussion on these problems such that researchers understand that to work properly cyber insurance will require practical solutions that go well beyond its economic and game-theoretical aspects.

C. Structure of the paper

Our study starts from the description of a classic insurance process for the purpose of identifying its main phases and actors, and clarifying the differences and peculiarities of the cyber domain (section II). We will then look at the existing literature, covering risk management and game theoretical methods, but also economic studies and previous works that tried to predict security events. We will try to clearly organize each contribution and point out which part of the cyber-insurance puzzle it tries to address.

In the second half of the paper, we introduce four main research areas where we believe that expertise in computer security can support the cyber-insurance domain. This includes risk prediction (Section V), automated data collection (Section VI), catastrophe modeling (Section VII), and computer forensics (Section VIII).

II. PROLOGUE: FROM INSURANCE TO CYBER INSURANCE

A traditional insurance process includes several interacting components, as depicted in the diagram reported in Figure 1. Even though its main concepts and stages might be familiar to most readers, for the sake of completeness, in this section, we briefly provide the basic definitions. This short introduction allows us to then discuss what makes cyber insurance unique compared to all other types of insurances.

The Traditional Insurance process

Insurance is a risk management method whose main purpose is to convert the risk of harmful events into an expenditure. The insurance process generally involves two players: a first supply-side entity who provides insurance, named insurer or insurance company, and a second demand-side entity who buys the insurance, known as insured or policyholder. The two parties interact in two different phases, respectively identified as underwriting (or policy stipulation) and claiming for compensation. During the drafting of a policy, an insurance carrier needs to acquire useful information about the prospective client with the purpose of identifying his risk class. Afterwards, the two parties need to clearly define the conditions, circumstances, and nature of the events that are covered by the policy. Coverage can encompass both first-and third-party losses: while the former is purchased to cover the policyholder against damages or losses suffered by the insured to his person or property (e.g., health, disability insurance), the latter is intended to protect the policyholder against liability for damages or losses caused by the insured to other people or their property (e.g., bystanders hit by insured's car in an accident, stranger's properties damaged by a fire that comes out of insured's house). At this point, the insurer quantifies the material damage that the insured -or third subjects if considered -would be subjected to if these occurrences were to happen. Finally, the insurance company takes on the liability and management of such situations cashing a premium payout from the insured.

The management of client portfolios is another crucial task insurance companies need to consider during the underwriting phase. The goal is typically to maintain a pool of policies, each of them having an independent probability of claim. This diversification averts catastrophic scenarios in which a single incident impacts a large fraction of the clients: in such cases, a significant number of claims would be submitted at the same time and the insurance would suffer a huge blow in covering losses. For instance, it may not be a good strategy for an insurance company to insure against fire hazards all apartments located in the same building.

Finally, when experiencing losses due to an incident which is potentially covered by the insurance policy, the victim submits a claim to the insurer who makes sure of its validity, assesses the impact of the event and compensates the claimer with an indemnity determined according to the terms of the policy. The contract can also include a deductible, i.e., an amount for which the insured is liable on each loss.

In order to make this entire process possible, the insurer must carefully set its tariffs to ensure that the premiums collected are enough to cover future claims, in addition to yield profit for the insurance firm itself. Unfortunately, this is anything but easy. Indeed, when it comes to selling a finished product or service, a firm can easily determine its price knowing which costs have been incurred for its realization. On the contrary, an insurer who places its product on the market does not know in advance the amount of money required for claim compensations because of their inherent uncertain nature. In this respect, actuarial techniques allow to estimate these disbursements and overcome the cost uncertainty related to this inverted production cycle. A key element for this estimation relies on statistical methods that study how claims for covered events have evolved over the previous years to forecast their future evolution. Thus, the raw information required to build a classic insurance product consists of a large set of historical records containing claims and compensations for events which have similar characteristics to the ones being insured. Insurance firms usually do not rely only on their own data sources but also take advantage of the market statistics that aggregate historical data of other companies in the same domain. This statistical information, which normally goes under the name of actuarial data, is what allows an insurance company to estimate the risk of a certain event or client, given a number of relevant contextual information (acquired during the underwriting phase). This includes, for instance, the driver's age and neighborhood for a car insurance or the age of the building in a house insurance. Unfortunately, as we will discuss next, actuarial data are scarce in the cyber domain and the characteristics that need to be collected about a client (and that presumably are good predictors for future incidents) are not yet well understood.

Extending Insurances to the Cyber Domain

With the help of Figure 1, we now look more closely at how the previous process is applied to the cyber domain by discussing the differences and the main challenges that affect each insurance phase.

Underwriting -As we discussed above, the policy underwriting requires the insurer to collect information from the client that can be useful for the purpose of risk assessment. Following a traditional model, also in the cyber domain this is still performed by a mix of self-assessment questionnaires, checklists, business documentation, meetings, and interviews [START_REF] Vaughan | Fundamentals of risk and insurance[END_REF]- [START_REF] Clusif | Processing guide for risk analysis and management[END_REF], whose objective is to identify the adopted software and technologies, the deployed security measures, the presence of sensitive data and how it is stored and processed, and any other information that can affect the global security posture of the company under investigation [START_REF] Romanosky | Content analysis of cyber insurance policies: How do carriers write policies and price cyber risk?[END_REF], [START_REF] Franke | The cyber insurance market in sweden[END_REF]. A deeper analysis can be carried out to tailor the product to the specific customer based on its characteristics and requirements: a monitoring software equipment together with an overhaul of preexisting security logs and telemetry serve this purpose. Finally, some deficiencies and precautions are often advised to the client in order to comply with the best-known security practices [START_REF]The iso/iec 27000 family of information security standards[END_REF].

Assessing the cyber risk of organizations or individuals is an overly challenging problem due to a number of reasons including the existence of asymmetric information, the dynamic nature of the cyber ecosystem, and the indirect risk that might be propagated from the relations with the third parties (we will come back to these points in more details later in the paper). Although with the traditional meticulous risk assessment methodologies the underwriters could draw an approximate picture of the customer's risk exposure, they might not be aware of the residual risks that might be known to the counterparts. The possession of a greater material knowledge by one of two parties involved in an economic transaction creates the problem of carrying asymmetric information and this represents a major issue in cyber insurance [START_REF] Böhme | Modeling cyber-insurance: Towards a unifying framework[END_REF], [START_REF] Biener | Insurability of cyber risk: An empirical analysis[END_REF], [START_REF] Bandyopadhyay | Why it managers don't go for cyber-insurance products[END_REF]- [START_REF] Shetty | Competitive cyber-insurance and internet security[END_REF]. A risk assessment that is made by analyzing asymmetric information can lead to adverse selection [START_REF] Gordon | A framework for using insurance for cyber-risk management[END_REF], [START_REF] Hedrick | Cyberinsurance: a risk management tool?[END_REF]. For example, unfair risk scores might be assigned to a company whose private and inaccessible information may reveal a severe exposure to risk compared to another with a better security hygiene.

The existence of asymmetric information also impacts negatively the customer side as insurance firms may raise premium prices due to incomplete knowledge and risk overestimation, leading to an expensive, niche, and not-appealing product [START_REF] Toregas | Insurance for cyber attacks: The issue of setting premiums in context[END_REF], [START_REF] Meland | Facing uncertainty in cyber insurance policies[END_REF]. High premiums are also the result of insufficient criteria to reduce them: even if a company holds security certifications and profusely invests in self-protection, the effectiveness of these actions against the wide variety of cyber attacks is not clear, making, in turn, difficult to assess to what extent they are useful to reduce the overall risk [START_REF] Toregas | Insurance for cyber attacks: The issue of setting premiums in context[END_REF]. A timid step in this direction is the one of some carriers who reduce premiums or deductibles if the client uses risk assessment tools, security technologies, and breach response services of specific vendors [START_REF] Wolff | Cyberinsurance tackles the wildly unpredictable world of hacks[END_REF].

The interdependent nature of the cyber ecosystem makes the risk estimation even more complicated. Nowadays, when cloud computing and outsourcing are two mainstream phenomena, cyber risk is intertwined among all entities that depend on one another [START_REF] Böhme | Modeling cyber-insurance: Towards a unifying framework[END_REF], [START_REF] Robinson | Incentives and barriers of the cyber insurance market in europe[END_REF], [START_REF] Böhme | On the limits of cyber-insurance[END_REF]. Companies may indirectly get damaged because they use external services that are targeted by a cyber attack: an example is the recent DDoS attack against DynDNS -which impacted more than sixty of its customers [START_REF]dyn cyberattack: Timeline and impact[END_REF]. Thus, a firm's measures and expenditures in self-protection may not proportionally increase its security level when making use of services from third parties that do not invest as well [START_REF] Böhme | Modeling cyber-insurance: Towards a unifying framework[END_REF], [START_REF] Majuca | The evolution of cyberinsurance[END_REF]. In the pre-binding phase, risk exposure must be then identified from a holistic standpoint, preferring a due diligence approach to a simple checklist and including in the review all internal and external threat vectors that could potentially compromise pre-insured's security [START_REF] Caglar | A new approach to risk assessment for cyber insurance[END_REF].

Actuarial and Pricing -The actuarial approach based on statistical models described above does not fit the cyber domain where historical data of claims and compensations are still scant [START_REF] Biener | Insurability of cyber risk: An empirical analysis[END_REF], [START_REF] Robinson | Incentives and barriers of the cyber insurance market in europe[END_REF], [START_REF] Gordon | A framework for using insurance for cyber-risk management[END_REF], [START_REF] Toregas | Insurance for cyber attacks: The issue of setting premiums in context[END_REF], [START_REF] Heslault | Actuaries beware: Pricing cyber insurance is a different ballgame[END_REF], [START_REF] Gemalto | Cyber insurance: The challenges facing actuaries in measuring cyber risk[END_REF]. Enterprises experiencing a cyber incident have a strong incentive not to publicly disclose it as this would tarnish their image. As a result, the few available databases [START_REF]Hackmageddon: Information security timelines and statistics[END_REF]- [START_REF]Owasp wasc web hacking incidents database project[END_REF] contain records which are often vague, missing details, and biased towards large and serious incidents, whose disclosure is unavoidable due to their resonance or due to mandatory-notification laws [START_REF]Security breach notification laws[END_REF], [START_REF]An overview of the main changes under gpdr and how they differ from the previous directive[END_REF]. The infeasibility of the actuarial approach alone for an accurate risk estimation is corroborated by its ever-evolving components: cyber threats and attack methods swiftly evolve alike defense methods and strategies do [START_REF] Majuca | The evolution of cyberinsurance[END_REF], [START_REF] Franke | The cyber insurance market in sweden[END_REF], [START_REF] Robinson | Incentives and barriers of the cyber insurance market in europe[END_REF].

Portfolio Management -As briefly discussed before, a fundamental requirement of traditional insurance schemes is that the insurer should strive to obtain a portfolio of policies with an independent probability of claim submission. This diversification can reduce the likelihood that a single incident could harm a considerable portion of clients -a catastrophic event that can have severe consequences and cause the bankruptcy of the insurer [START_REF] Tomas Girnius | Aggregated cyber risk: The nightmare scenarios[END_REF]- [START_REF]Sybil logic bomb cyber catastrophe scenario[END_REF]. Unfortunately, it is harder to obtain such diversified portfolio in the cyber domain, due to the monoculture of software and hardware products [START_REF] Geer | Cyberinsecurity: The cost of monopoly[END_REF]- [START_REF] Schneier | The dangers of a software monoculture[END_REF]. Although deploying different configurations is possible, recent events have shown that the business continuity of a large set of possible clients -independently of their size, sector, and assets to protect -is simultaneously undermined when a piece of a broadly-used software or hardware is found to suffer from a severe vulnerability [START_REF] Higgins | More than a half million servers exposed to heartbleed flaw[END_REF]- [START_REF] Lipp | Meltdown[END_REF].

In other domains, a common way insurers protect themselves against catastrophic events such as wildfire and hurricanes is by purchasing policies from other insurance companies. Sadly, the current lack of re-insurers in the cyber domain further exacerbates this problem [START_REF] Robinson | Incentives and barriers of the cyber insurance market in europe[END_REF], [START_REF] Finance | Promoting uk cyber prosperity: Public-private cyber-catastrophe reinsurance[END_REF]- [START_REF] News | Cyber re/insurance market "frustratingly immature[END_REF].

Post-Binding Phase -Due to the complications in both the policy underwriting and claiming phases, an additional post-binding phase is introduced, which does not exist in other forms of insurance [START_REF] Caglar | A new approach to risk assessment for cyber insurance[END_REF]. In fact, in traditional insurances, the relationship between the firm providing coverage and the policyholder ends once the contract has been signed and the two parties interact again only in case of a claim submission. On the contrary, a cyber insurance may require periodic risk assessment after the underwriting is completed, to allow the insurer and the policyholder to collect updated information related to new threats and evolved risks. Indeed, many cyber-insurance policies already bring supplemental value through the inclusion of risk mitigation, tracking and loss-prevention tools [START_REF] Association | Cyber insurance buying guide[END_REF]. Clients, in particular small organizations that lack experience, can benefit from this continuous interaction to better ponder their measures towards higher-priority situations [START_REF] Meland | Facing uncertainty in cyber insurance policies[END_REF]. The post-binding phase also helps to prevent the well-known issue of moral hazard [START_REF] Majuca | The evolution of cyberinsurance[END_REF], [START_REF] Gordon | A framework for using insurance for cyber-risk management[END_REF], [START_REF] Bailey | Mitigating moral hazard in cyber-risk insurance[END_REF], [START_REF] Tøndel | Using cyber-insurance as a risk management strategy: Knowledge gaps and recommendations for further research[END_REF] -a form of post-underwriting opportunism by the policyholder, who undertakes incautious actions knowing that, in case of incidents, there exists a counterpart who will bear the brunt and will not be able to verify the presence of negligent and fraudulent actions. In this regard, insurers have to conduct continuous risk assessments to resize the set of inaccessible information of the insured and mitigate its unfair behaviors.

Claim Submission and Validation -Cyber-insurance policies usually cover the costs of incident response and forensic investigations, including the identification of stolen or compromised data and the extent to which third parties have to be informed according to the current regulations. Despite this, a precise quantification of the involved and compromised assets is complicated by their intangible nature [START_REF] Robinson | Incentives and barriers of the cyber insurance market in europe[END_REF], [START_REF] Gordon | A framework for using insurance for cyber-risk management[END_REF]. In addition, since jurisdictions may apply different notification laws, each case must be accurately evaluated according to the localization of the indirectly-damaged third party.

The insurer as well compensates for economic losses related to the event. In particular, cyber insurance may refund losses due to business interruption caused by an attack, as well as cyber extortion and stolen assets. This approach is insufficient in the cyber scenario where the above primary losses are often followed by secondary ones that result from a loss of reputation whenever the incident is publicly disclosed [START_REF] Bandyopadhyay | Why it managers don't go for cyber-insurance products[END_REF].

Time is also a key component when it comes to claim submission. Some attacks may silently compromise a system and remain undiscovered for a considerable time-frame. The validity of claims in such situations is a more arduous issue to formalize in cyber policies. Furthermore, carriers may require forensic investigations prior to claim submission to verify its validity, resulting in an initial disbursement from the insured and a reputation damage due to the disclosed incident.

III. LITERATURE ON CYBER INSURANCE

A. Categorization and Source Selection

Since its first appearance in the late 90s [START_REF] Majuca | The evolution of cyberinsurance[END_REF], cyber insurance has been the focus of researchers from different disciplines.

For our study, we selected and analyzed 93 works among academic papers, standards, and frameworks. As shown in Figure 2, we grouped these works in four main categories and fourteen sub-categories. In particular, we found that previous research has mainly focused on two areas: cyber risk management, which tries to estimate attack probabilities and possible damages, and mathematical modeling and game theory simulations, which aim at deriving interesting properties on the consequences of cyber-insurance adoption. Two additional areas complete the picture: research conducted by the economics community reporting figures from past incidents or discussing the costs of possible scenarios, and research focusing on the prediction of future cybersecurity events.

Since these four macro categories refer to very different research domains, we adopted distinct criteria to select and present the contributions from each of them. Risk management is a very wide topic that covers a wide range of domains, ranging from pharmaceutical products to natural disasters. We reported all methodologies and frameworks that are currently used in IT, together with those academic papers presenting risk aggregation techniques. Regarding the contribution from the economics community, as an exhaustive discussion would be out of scope for a security conference, we focused on the papers needed to emphasize research problems, existing tools, and on the major findings that can affect the work of security researchers. For this reason, we comprehensively reported

Cyber insurance

Prediction

Cyber incidents [START_REF] Liu | Cloudy with a chance of breach: Forecasting cyber security incidents[END_REF][START_REF] Sarabi | Prioritizing security spending: A quantitative analysis of risk distributions for different business profiles[END_REF][START_REF] Thonnard | Are you at risk? profiling organizations and individuals subject to targeted attacks[END_REF] Vulnerability exploitations [START_REF] Browne | A trend analysis of exploitations[END_REF][START_REF] Bozorgi | Beyond heuristics: learning to classify vulnerabilities and predict exploits[END_REF] Malware encounters [START_REF] Bilge | Riskteller: Predicting the risk of cyber incidents[END_REF][START_REF] Yen | An epidemiological study of malware encounters in a large enterprise[END_REF] Malicious website encounters [START_REF] Canali | On the effectiveness of risk prediction based on users browsing behavior[END_REF][START_REF] Sharif | Predicting impending exposure to malicious content from user behavior[END_REF] Losses from infections [START_REF] Bossler | On-line activities, guardianship, and malware infection: An examination of routine activities theory[END_REF] Economics Scenario simulations [START_REF]Sybil logic bomb cyber catastrophe scenario[END_REF][118][119][120][121][122][123][124][START_REF]the International Actuarial Association et al[END_REF][126] Data-breach cost [START_REF] Biener | Insurability of cyber risk: An empirical analysis[END_REF][START_REF] Herath | Copula-based actuarial model for pricing cyber-insurance policies[END_REF][START_REF] Eling | Data breaches: Goodness of fit, pricing, and risk measurement[END_REF][START_REF] Wheatley | The extreme risk of personal data breaches and the erosion of privacy[END_REF][START_REF] Layton | A methodology for estimating the tangible cost of data breaches[END_REF][START_REF] Yayla | The impact of information security events on the stock value of firms: The effect of contingency factors[END_REF] Fig. 2: Cyber-insurance research areas all of the attempts made in quantifying economic losses following cyber incidents. The works employing mathematical modeling and game theory have already been deeply analyzed by Marotta et al. in [START_REF] Marotta | Cyberinsurance survey[END_REF]. Therefore, in Section III-C, we decided to offer a different systematization that focuses on which property the authors were interested to prove, along with the choice of the simulation parameters -e.g., the market model, the presence of asymmetric information, and the network topology. Finally, since our ultimate goal is a call to actions for security researchers to provide data-driven solutions for the cyber-insurance domain, our study comprehensively presents and compares previous prediction attempts in section III-E.

B. Approaches and techniques for cyber risk management

According to the ISO standard 31000, a risk management process can be described as a set of tasks whereby it is possible to measure the risk and subsequently develop strategies to monitor and control its evolution [START_REF]2018 -Risk management: Principles and guidelines[END_REF]. As a result, the first phase of risk management is dedicated to the identification of the valuable assets and of the related threats that represent the main components of risk. Each threat is then analyzed by evaluating its likelihood and possible impact from both a qualitative and quantitative perspective, and results are then aggregated to obtain an overview of the whole risk. These two phases, grouped and referred to as risk assessment, are usually followed by a risk treatment step, which covers the choice of non-exclusive countermeasures that can be adopted to tackle each of the risk components. Finally, as risks may suddenly change, causing the previous estimations to become incorrect and countermeasure ineffective, a number of monitoring and reviewing actions are required to continuously update the risk estimation.

Risk management is an important process when it comes to information technologies. Therefore, the literature is rich of guidelines, frameworks, and techniques that contextualize it to the digital world. As depicted in Figure 2, we grouped under the risk management sub-category the studies that provide a walk-through of the entire procedure [START_REF] Stoneburner | Sp 800-30. risk management guide for information technology systems[END_REF]- [START_REF] Alberts | Managing information security risks: the OCTAVE approach[END_REF], [START_REF]Information technology -Security techniques -Information security risk management[END_REF]- [START_REF]club da la sécurité de l'information franc ¸ais[END_REF], defining terms and providing a helpful documentation of how to address issues on risk assessment and treatment, as well as insights on risk monitoring and reviewing. Other works often inherit or revisit a previous risk management methodology and introduce new techniques to implement a specific sub-component. In this respect, we created two different sub-categories in which we respectively list the works addressing the whole risk assessment [START_REF] Clusif | Processing guide for risk analysis and management[END_REF], [START_REF] Caralli | Introducing octave allegro: Improving the information security risk assessment process[END_REF]- [START_REF]Guide for conducting risk assessments[END_REF] and those narrowing down the discussion on risk analysis [START_REF] Karabacak | Isram: information security risk analysis method[END_REF], [START_REF] Lund | Model-driven risk analysis: the CORAS approach[END_REF], [START_REF] Butler | Security attribute evaluation method: a cost-benefit approach[END_REF].

Although widely used standards (such as ISO 27005 [START_REF]Information technology -Security techniques -Information security risk management[END_REF]) and tools (e.g., NIST SP 800-30 [START_REF] Stoneburner | Sp 800-30. risk management guide for information technology systems[END_REF], Magerit [START_REF] Amutio | Magerit-version 3, methodology for information systems risk analysis and management, book i-the method[END_REF], OCTAVE Allegro [START_REF] Alberts | Managing information security risks: the OCTAVE approach[END_REF], Clusif [START_REF] Clusif | Processing guide for risk analysis and management[END_REF] and the one proposed by Microsoft [START_REF]Microsoft solutions for security and compliance and microsoft security center of excellence -the security risk management guide[END_REF]) handle the single stages of the management procedure in a different way, they share a common underlying workflow for assessing individual risks. According to it, the process typically starts by brainstorming which and how cyber-based threats could prevent the company from reaching business goals and team objectives. In this respect, real-life cyber events previously occurred to other companies can be used as source of inspiration. In addition, frameworks often provide guidelines on how to identify this collection, including checklists or questionnaires, and advising to adopt a what-if approach to understand what could go wrong and what the possible consequences are. The outcome of this process is the creation of a risk register, whose structure, together with some examples, is reported in Table I. Once each row has been filled with a description of the threat, including its possible triggers and effects, the impact and likelihood of its materialization are assessed to define the inherent risk. Two approaches exist for scoring these factors and the choice of one rather than the other depends on the company itself. Indeed, some tools provide a table of decipherable words with a qualitative description, whilst others opt for a quantitative numerical sliding scale (e.g., Table I3 andH3 of [101]). It is worth pointing out that the same event could be assigned different values across distinct situations: if an organization's public statement is "we have built our reputation on our commitment [. . . ] to protect the privacy and confidentiality of personal information", the impact of user-data leaks for this company will be higher if compared to another one with different prerogatives. The next step is the identification and mapping of existing mitigations or controls the could reduce the likelihood of each threat: companies often take advantage of existing frameworks that list critical checks and best practices, and indicate the extent to which the control environment reduces the inherent risk. As a result, a value reflecting the residual risk is obtained and a threefold choice opens up: if the value falls within the company's risk appetite limit, no further action is needed in this phase. If not, more controls and mitigations have to be investigated or the residual risk has to be transferred to a third party -e.g., with a cyber-insurance policy.

Finally, in the last sub-category of Figure 2, we reported all the methodologies that have been proposed to aggregate and propagate individual risks based on tools that capture the relationships among different information components or requirements of an attack. These modeling tools make use of graph theory or model checking to draw conclusions starting from some preconditions. Among them, attack trees are widely used techniques to capture dependencies among threats [START_REF] Pardue | Thrats to healthcare date: A threat tree for risk assessment[END_REF]- [START_REF] Balzarotti | Assessing the risk of using vulnerable components[END_REF]. Each tree is a leveled diagram made of nodes, leaves and a root; each node represents an attack or a threat which materializes only if all its children are satisfied. The root attack is completed if all nodes are satisfied. Similarly, vulnerabilities or exploits are represented as nodes in attack graphs and conditionally linked to each other according to their preconditions and results. Such composition of vulnerabilities is used to simulate incremental network penetration and attack likelihood propagation with the purpose of measuring the overall security of a system or network [START_REF] Sheyner | Tools for generating and analyzing attack graphs[END_REF]- [START_REF] Sheyner | Automated generation and analysis of attack graphs[END_REF]. Finally, hazard and operability studies (HAZOP) [START_REF] Commission | Iec bs en 61882:2016 -hazard and operability study (hazop studies) -application guide[END_REF] and failure mode and effects analysis (FMEA) [START_REF] Commission | Analysis techniques for system reliability -procedure for failure mode and effects analysis (fmea)[END_REF], are other two techniques used to break down a complex process into small sections and reason about possible undesired situations, their causes and consequences. Such kind of tools are mostly employed when the use of ICT can introduce a series of hazards in industrial environments [START_REF] Ralston | Cyber security risk assessment for scada and dcs networks[END_REF]- [START_REF] Schmittner | Security application of failure mode and effect analysis (fmea)[END_REF].

As we will discuss later in this section, these methodologies, inherited from other domains, can be unsuitable when employed in cyber scenarios.

C. Cyber insurance and Game Theory

A large portion of existing contributions employ mathematical modeling and game theory to infer properties and effects of adopting cyber insurance. As comprehensively reported in [START_REF] Marotta | Cyberinsurance survey[END_REF], this approach allows in the first place to create a mathematical model of cyber insurance which takes into account its main actors (insurance carriers, policyholders and regulatory entities), their interdependences (probability of infection and externalities), the network topology (independent nodes, complete graph, random graph, or others) and the market type (competitive, monopolistic, or oligopoly). Once a model has been defined, game theory is used to simulate the behavior of agents: insureds choose their desired level of protection and contract type, insurers instantiate contracts, and regulators come into play by imposing regulation options (mandatory insurance, fines, bonuses, penalties, mandatory investment, etc.). The use of game theory makes it possible to also include in the models the major issue of information asymmetry in its moral hazard and adverse selection forms. This way of tackling cyber insurance is very useful for strategic purposes and allowed researchers, practitioners, and governments to reason about consequences and peculiarities of its employment, and market viability.

1) Viability of the cyber-insurance market: As already discussed, the starting point of each simulation is the definition of a mathematical model of cyber insurance that considers its main aspects, e.g. market type, type of coverage, existence of asymmetric information, network topology, etc. Therefore, an important finding of each simulation is to verify whether the market defined by such pre-conditions may exist or not, i.e., whether the actors would opt for the insurance case over the non-insurance one. One way to achieve this result is the comparison between the average utility function for agents with (E[U I ]) and without (E[U N ]) insurance: in the economic theory, this function measures the welfare or satisfaction of an entity from consuming a certain number of goods. Then, if E[U I ]≥E[U N ] holds, the choice of an insurance policy directly contributes to increase the wealth of an agent [START_REF] Marotta | Cyberinsurance survey[END_REF]. Almost all previous works -among which we find the more realistic settings that include a competitive insurance market, non-zero-profit carriers, the presence of moral hazard and adverse selection, and a partial coverage whose level is defined by the policyholder-fall in this category [START_REF] Shetty | Competitive cyber-insurance and internet security[END_REF], [START_REF] Ogut | Cyber insurance and it security investment: Impact of interdependent risk[END_REF]- [START_REF] Shim | An analysis of information security management strategies in the presence of interdependent security risk[END_REF], [START_REF] Bolot | A new perspective on internet security using insurance[END_REF], [START_REF] Bolot | Cyber insurance as an incentive for internet security[END_REF]- [START_REF] Pal | Will cyber-insurance improve network security? a market analysis[END_REF], [START_REF] Schwartz | Cyber-insurance: Missing market driven by user heterogeneity[END_REF], [START_REF] Yang | Security adoption and influence of cyber-insurance markets in heterogeneous networks[END_REF]. Only two studies found that actors who decide not to invest in a cyber policy would benefit from this choice [START_REF] Yang | Security adoption and influence of cyber-insurance markets in heterogeneous networks[END_REF], [START_REF] Naghizadeh | Voluntary participation in cyber-insurance markets[END_REF]. Yang and Lui [START_REF] Yang | Security adoption and influence of cyber-insurance markets in heterogeneous networks[END_REF] concluded that cyber insurance is not a good incentive for all nodes when modeling a competitive market with zero-profit carriers only offering full coverage and accepting asymmetric information in its moral-hazard form. Naghizadeh and Liu [START_REF] Naghizadeh | Voluntary participation in cyber-insurance markets[END_REF] simulated instead a monopolistic profit-neutral insurer, acting as a regulator that imposes fines and grants rebates, and found that this leads to a market failure because of agents would not voluntarily purchase any insurance.

2) Consequences of cyber-insurance employment: Among the main topics of interest in this area, we find the use of cyber insurance as an incentive for internet security [START_REF] Kesan | The economic case for cyberinsurance[END_REF], [START_REF] Lelarge | Economic incentives to increase security in the internet: The case for insurance[END_REF], [START_REF] Bolot | A new perspective on internet security using insurance[END_REF], [START_REF] Bolot | Cyber insurance as an incentive for internet security[END_REF]- [START_REF] Laszka | Should cyber-insurance providers invest in software security?[END_REF], the change in self-protection investments when insurance is available [START_REF] Kesan | The economic case for cyberinsurance[END_REF]- [START_REF] Martinelli | Preventing the drop in security investments for non-competitive cyber-insurance market[END_REF] and its contribution for reaching the social welfare [START_REF] Kesan | The economic case for cyberinsurance[END_REF], [START_REF] Shetty | Can competitive insurers improve network security?[END_REF], [START_REF] Schwartz | Cyber-insurance: Missing market driven by user heterogeneity[END_REF], [START_REF] Pal | On the economics of information security: the problem of designing optimal cyber-insurance contracts[END_REF]. These studies concluded that cyber insurance is not a good incentive for internet security in presence of a competitive or monopolistic market and asymmetric information in its moral hazard form [START_REF] Shetty | Competitive cyber-insurance and internet security[END_REF], [START_REF] Lelarge | Economic incentives to increase security in the internet: The case for insurance[END_REF], [START_REF] Bolot | A new perspective on internet security using insurance[END_REF], [START_REF] Bolot | Cyber insurance as an incentive for internet security[END_REF], [START_REF] Shetty | Can competitive insurers improve network security?[END_REF]. On the other hand, researchers also concluded that a non-competitive cyber-insurance market can increase internet security if fines are imposed by regulation entities and policy are carefully designed. When analyzing the effect of employing cyber insurance on self-protection, some works show that, if insurance is available, agents prefer not to invest in self-protection, but rather in insurance contracts [START_REF] Grossklags | Secure or insure?: a gametheoretic analysis of information security games[END_REF], [START_REF] Johnson | Security games with market insurance[END_REF]. In this case, minimal investments imposed by regulators do not change the results. Finally, the usefulness of insurance as a tool to reach the social welfare and the optimal level of self-protection investments has not been yet understood: different studies [START_REF] Schwartz | Cyber-insurance framework for large scale interdependent networks[END_REF], [START_REF] Ogut | Cyber insurance and it security investment: Impact of interdependence risk[END_REF] reached contradictory conclusions on this topic although considering the same preconditions, probably because of adopting different network topologies -which lead to different interactions among actors-throughout their simulations.

D. The Economics Perspective

Since cyber attacks are often considered inevitable events, cyber experts are increasingly focusing on their economic consequences [119]. In this respect, scenario-based evaluations are a very common approach used to serve two main purposes. For a company, these scenarios provide a useful way to assess the possible consequences of a cyber event [123], to measure the incident response capabilities [122], and to identify the critical systems, people and premises that are needed to continue to serve their customers [120]. On the insurance carriers side, simulations based on scenarios are often used to estimate the financial impact of large-scale attacks or catastrophic events that hit many businesses at once [121]. This simulation practice is rapidly gaining popularity due to the current cyber landscape, in which the costs of recovering from particular types of attacks are way greater than the cost required to prevent them [118]. Furthermore, tests can help companies to emphasize the presence of valuable data to protect and shed light on interconnected risks that could lead to catastrophic events [119]. Good evidence of this can be found in the decision of the European Insurance and Occupational Pensions Authority (EIOPA) to include, for the first time in 2018, cyber scenarios in the collective insurance stress test used to assess cyber-risk response [136].

The creation process of a scenario-based simulation goes through a multi-stage procedure [START_REF]Sybil logic bomb cyber catastrophe scenario[END_REF] and it is usually performed by C-Suite executives due to their expertise in business-critical roles and operations [119]. The process starts with the creation of a plausible scenario, defined by a footprint of events to be simulated and a contagion mechanisms among the involved entities [124]. There is a wide range in the type of scenarios that can be used for different applications. For instance, scenarios can be based on historical or synthetic events, they can be generic or specific for a given company or sector, and they can consider single or multiple events [START_REF]the International Actuarial Association et al[END_REF]. Scenarios allow the simulation of both common digital incidents -like data exfiltration, cyber extortion, denial of service attacks, financial transaction compromise, and cloud service provider failure -as well as rare events -such as cyber-induced fires in buildings or industrial plants, cyber theft of marine cargo, cyber attacks on power grids, or oil rig explosions due to platform control system (PCS) compromise [126].

Developing a scenario is a challenging task as it is not easy to fully understand all the systems involved and predict the possible cascading effects that could be triggered [START_REF]Sybil logic bomb cyber catastrophe scenario[END_REF]. For this reason, developing a coherent scenario is a key aspect for successfully achieving the second phase of the simulation that consists of estimating the inducted losses to a business or the impact of claims submitted to an insurance company by taking into account its client portfolio.

The output of the simulation can be further extended beyond a single company by taking into account macroeconomic consequences too [124]. This result can be achieved by selecting a representative subset of the whole population of companies from a wide range of different business sectors and use them to estimate the losses of a given scenario. In turn, this allows for a quantification of the effects on many variables of the global economy [START_REF]Sybil logic bomb cyber catastrophe scenario[END_REF].

Besides scenario-based simulations, other economic studies attempted to gain insights into cyber risks by leveraging publicly available data. For instance, Eling and Loperfido [START_REF] Eling | Data breaches: Goodness of fit, pricing, and risk measurement[END_REF] analyze statistical properties of a data breach information database to show that data breaches significantly differ among each other, hence they must not be put in the same basket but must be mapped to separate risk categories. Using another dataset of publicly available survey data, Herath et al. attempted instead to build a pricing model for cyberinsurance premiums with the robust copula methodology [START_REF] Herath | Copula-based actuarial model for pricing cyber-insurance policies[END_REF]. Premiums for first-party losses due to virus intrusions are computed with a probabilistic model based on three factors: the occurrence of the events covered by the policy, the time from the issue of the policy to the incident, and the indemnity paid by the insurance in case of the breach occurring. Biener et al. [START_REF] Biener | Insurability of cyber risk: An empirical analysis[END_REF] analyzed the world's largest collection of publicly reported operational losses to draw empirical conclusions on whether cyber risks are insurable or not based on Berliner's criteria. Results suggest that cyber risk owns some peculiarities that undermine its insurability, such as its evolving nature, the lack of actuarial data and reinsurance, the severe information asymmetries, the limited coverage and caps, and the high deductibles and premiums for small and medium enterprises.

Wheatley et al. [START_REF] Wheatley | The extreme risk of personal data breaches and the erosion of privacy[END_REF] statistically modeled a 15-year cyber-breach dataset to show that the size of an organization is strongly coupled with the frequency and severity of breaches, and the number of information leaked during such events is expected to double within five years from two to four billion items. The handling and response costs of two data breach events are at the center of the study by Layton et al. [START_REF] Layton | A methodology for estimating the tangible cost of data breaches[END_REF]. Counterintuitively, the authors show that none of the two incidents negatively affected the company stock price and economic growth, secondary and intangible losses have negligible importance with respect to direct losses, and policy and procedure for handling the event have a large effect on the overall cost. On the contrary, in [START_REF] Yayla | The impact of information security events on the stock value of firms: The effect of contingency factors[END_REF] security breaches are found to negatively impacting stock quotation of the victims, especially in the case of e-commerce firms and DoS attacks.

E. From risk assessment to risk prediction

So far, a considerable amount of studies, frameworks, and methodologies have focused on assessing the risk of cyber attacks by explicitly defining their underlying causes and triggers. In fact, as we show in Table I, the first column of each row specifies either the particular action, the vulnerability or the exploit that makes the risk materialize. While this assessment technique is well established in other domains (e.g., industrial and financial), its effectiveness is still unclear in a cyber scenario. Indeed, if the whole evaluation is based on the current knowledge of vulnerabilities present in the system and tools, and on the exploits available to the attackers, it quickly becomes clear that the final measurement has limited lifespan, as new ones are respectively discovered and released on a daily basis. Moreover, when major cyber incidents occur, its root causes and enabling factors are almost always unknown to the community, greatly complicating the assessment of the associated risk.

The goal of prediction is to overcome this assumption and carry out the risk estimation by leveraging a combination of risk indicators, measurable factors that have been empirically proven to reflect the risk across a number of experiments. For instance, back to Table I, lower age, frequent use of untrusted internet connections, and longer browsing sessions at night have been found to be good signs for predicting which users are more at risk of malware infections [START_REF] Yen | An epidemiological study of malware encounters in a large enterprise[END_REF]. And this is done by mentioning none of their actions or incautious behaviors -e.g., the user clicked on a malicious banner or installed malicious software. In a similar way, companies with misconfigured DNS services and expired certificates more frequently show signs of botnet activities, otherwise less likely to be observed in other entities where those are correctly set up [START_REF] Liu | Cloudy with a chance of breach: Forecasting cyber security incidents[END_REF].

These measurable indicators are merely correlated and not the cause itself of the risk, the same way as the driver age is not the cause of car accidents. But by measuring these signs, experts can make predictions of the likelihood of future events.

Over the past two decades, few scattered studies have focused explicitly on the problem of predicting security-related events. In 2001, Browne et al. proposed a simple formula to predict the amount of security incidents, as a function of time, related to a known vulnerability [START_REF] Browne | A trend analysis of exploitations[END_REF]. Bozorgi [START_REF] Bozorgi | Beyond heuristics: learning to classify vulnerabilities and predict exploits[END_REF] used instead publicly available vulnerability databases to predict which, and how soon, a vulnerability is likely to be exploited in the future. In 2005, Schechter [START_REF] Schechter | Toward econometric models of the security risk from remote attack[END_REF] looked at the challenges of predicting cyber attacks. He discovers that experts had a much better understanding and success in modeling traditional crimes, such as home burglary [START_REF] Hakim | Knowing your odds: Home burglary and the odds ratio[END_REF] while "attempts to bring the quantitative approaches of insurance and risk management to the measurement of [computer] security risk have failed". The author concluded that this is due to the fact that we still lack techniques to measure the security strength of a piece of software (we will get back to this idea of predicting risk through measuring security in Section V).

Another traditional way to predict future events is to adapt software reliability growth models (SRG) commonly used by the reliability community to describe (typically through a non-homogeneous Poisson process) and predict the evolution of defects in a software artifact. For instance, Condon et al. [START_REF] Condon | Applying software reliability models on security incidents[END_REF] show that specific classes of computer incidents (such as those that depend on particular vulnerabilities) can be modeled with an SRG, while the total aggregated incident rate can be better approximated by using time series [START_REF] Condon | Analysis of computer security incident data using time series models[END_REF].

In 2016, Edwards [START_REF] Edwards | Hype and heavy tails: A closer look at data breaches[END_REF] found that the daily frequency of data breaches can be described by using a negative binomial distribution and used this model to estimate the likelihood of similar incidents in the future. Maillart [142] found instead that the theft of personal information follows a power-tail distribution that is robust independently of the sector and size of the targeted organization.

On a different but related topic, a large corpus of works aimed at predicting the occurrence of new vulnerabilities in software products [START_REF] Zimmermann | Searching for a needle in a haystack: Predicting security vulnerabilities for windows vista[END_REF]- [START_REF] Alhazmi | Measuring, analyzing and predicting security vulnerabilities in software systems[END_REF]. However, as we will discuss in Section V, it is still unclear how this information can translate to a prediction or the likelihood of being attacked or compromised in the future.

In recent years, prediction techniques have been at the center of few works for the purpose of assessing the risk in different circumstances. In 2009, Bossler et at. [START_REF] Bossler | On-line activities, guardianship, and malware infection: An examination of routine activities theory[END_REF] investigated the influence of different factors in predicting data losses from malware infections by conducting a survey over 788 college students. More recently, Liu et al. [START_REF] Liu | Cloudy with a chance of breach: Forecasting cyber security incidents[END_REF], by using a set of external observable features, attempted to predict the likelihood of an organization to suffer a cyber incident in the future. The authors achieved, overall, a 90% accuracy with 10% of false predictions. Cyber incidents are considered also by Thonnard et al. [START_REF] Thonnard | Are you at risk? profiling organizations and individuals subject to targeted attacks[END_REF], who discussed organizationand individual-level features that are correlated with the risk of experiencing spearphishing attacks. In a similar way, Sarabi et al. [START_REF] Sarabi | Prioritizing security spending: A quantitative analysis of risk distributions for different business profiles[END_REF] build a predictor for cyber incidents using a set of industry, business, and web visibility/population information. RiskTeller [START_REF] Bilge | Riskteller: Predicting the risk of cyber incidents[END_REF] is a prediction tool that leverages internal telemetry data to predict which machines are at risk of being infected by a broad spectrum of different malware. Its prediction accuracy reaches 95%, showing that such tool could be used to prioritize security spending towards machines at higher risk of infection. The same conclusion is reached by Yen et al. [START_REF] Yen | An epidemiological study of malware encounters in a large enterprise[END_REF], who use logs from an antivirus software to infer the risk for hosts in a large enterprise to encounter malware. On the consumer side, Canali et al. [START_REF] Canali | On the effectiveness of risk prediction based on users browsing behavior[END_REF], assess to what extent the risk class of a given user can be predicted based only on his web browsing behavior. The authors show how certain types of user actions considerably affect their risk exposure. In a similar way, Sharif et al. [START_REF] Sharif | Predicting impending exposure to malicious content from user behavior[END_REF] use mobile users' browsing patterns complemented with selfreported data to predict whether the users will encounter malicious pages on a long and short period of time. In the latter case, on-the-fly predictions within a browsing session could be useful to proactively prevent malicious-content exposures. All these prediction efforts are summarized in Table II, alongside the type of predicted events, the source of ground truth information, the adopted features, and the data from which they are extracted. The table also shows if the ground truth and the predictive features are extracted from internal sensors (Int) or are measured from public external information (Ext). We will return on the importance of this aspect in Section VI.

Finally, few studies have focused on predicting the cost of cyber incidents and data breaches. In this area, Jacobs [START_REF] Jacobs | Analyzing ponemon cost of data breach[END_REF] proposed a regression model based solely on the number of user records compromised. Romanosky [START_REF] Romanosky | Examining the costs and causes of cyber incidents[END_REF] introduced more variables (including the revenue and company type) and found that a 10% increase in firm revenues is correlated with a 1.3% increase in the cost of an incident. The author also noted that the price is ultimately related to the size of the company and the size of the breach, and not to the malicious nature of the incident or its outcome.

F. Discussion

Nowadays, cyber risk management methodologies, results of game theoretical studies, and scenario-based simulations are key components for the development of the cyber-insurance market. In the first case, companies and individuals that want to adopt cyber insurance can take advantage from the existence of these frameworks and guidelines, despite the fact that they were not designed with the insurance market as ultimate goal: indeed, risk management plays a very important role to estimate attack probabilities and possible damages, allowing, in turn, individuals and companies to reason on their needs for a cyber policy. Insurance carriers as well use these tools during contract underwriting for assigning a value to a certain entity's risk and compute premiums for cyber-insurance policies [START_REF] Romanosky | Content analysis of cyber insurance policies: How do carriers write policies and price cyber risk?[END_REF].

Unfortunately, all available solutions discussed above have a qualitative foundation and base their analysis, assessments, and consequently their results on metrics based on experts knowledge and previous experience, missing a feedback from real-world experiments and measurable quantities. Existing methodologies rely on checklists, worksheets, knowledge basis, catalogues, tables, and what-if reasoning for identifying threats and hazards. The value of this type of analysis largely depends upon the quality of the used documents and the experience of the experts who brainstorm about undesired events and their effects. In the same way, the use of tools to capture dependencies among threats such as fault trees or the outcome of HAZOP and FMEA studies also assumes that who carries the analysis has detailed knowledge about the areas, operations, and processes that may be exposed to hazardous events and conditions.

The absence of objective measures and the qualitative nature of these methodologies make it also harder to obtain an actual value for the likelihood of a given threat in a cyber scenario: threat probability is, in fact, a key component for assessing risks and, although simulations can approximate the frequency of popular attacks found in the wild, the limitations discussed in the actuarial paragraph of Section II exacerbate the quantification of such quantity.

Finally, since a sheer number of risk assessment methodologies exists, it is still unclear which one fits best the cyber domain and provides the most precise way to compute the likelihood of cyber incidents. This aspect is further exacerbated by the ever-growing adoption of IoT devices, for which new risk metrics and specific risk evaluation methods are still missing [START_REF] Radanliev | Economic impact of iot cyber risk-analysing past and present to predict the future developments in iot risk analysis and iot cyber insurance[END_REF]. Very similar considerations apply to simulations based on scenarios, as their creation, refinement, and precision to capture the intricate relationships among different entities depends completely on qualitative opinions of expert users and C-suite members.

As risk management methodologies and scenario-based tests, game theory applied to cyber insurance can provide important practical insights. Nevertheless, all conclusions obtained from these studies are purely based on mathematical modeling, with all the limitations that this implies. First of all, the finiteness of modeling can lead to a huge difference between the actors considered and their actual number. Moreover, when using game theory to simulate the behaviors of clients and carriers, players can undertake a limited set of actions and interact with each other only in pre-defined ways, defined by assumptions respectively on the market type and network topology. Unfortunately, there is no measurement or comparison with real-world data that confirms the validity of models and veracity of game theory results.

IV. FROM THEORY TO PRACTICE As we described in the previous section, research in the cyberinsurance domain has mostly focused on theoretical studies (from a mathematical viewpoint) and on the analysis of the costs/benefits tradeoff (from an economics viewpoint). At the same time, the system security community has instead been largely ignoring this emerging area. This could be simply the consequence of the lack of interesting problems that require novel and practical solutions, or it could be due to the lack of awareness from our community towards these problems. As we believe the latter to be true, we now focus on some of the areas where researchers' experience with system and network security can play a fundamental role to help the development of the cyber-insurance domain. The contribution of system security researchers can help the development of quantitative, data-driven methodologies, and it can bring automation and support tools to replace questionnaires and qualitative estimations.

In particular, we selected four classes of problems, one for each of the insurance phases: actuarial, underwriting, portfolio management, and claim validation. For each class, we underline the limitations in the current approaches, discuss the challenges of proposing new solutions, and outline a number of open research directions for researchers in the security field. To ease their identification, we tried to mark the main open problems we discuss in the text as Rn .

V. AREA 1: RISK PREDICTION "They could tell you exactly the chance of an office building burning down in Midtown Manhattan, but there isn't anyone on this planet who could tell you the probability of a large U.S. retailer being hacked tomorrow" -Graeme Newman, Director at CFC Underwriting [152] Cyber-insurance providers employ underwriting tools to collect the information required to differentiate the risk across all the applicants [START_REF] Romanosky | Content analysis of cyber insurance policies: How do carriers write policies and price cyber risk?[END_REF]. Today, underwriting questionnaires ask a number of questions which insurance companies believe to be relevant to classify the risk of a potential customer. However, as we discussed in Section III-E, researchers still have to identify reproducible ways to estimate risk based on a number of observable features that had been proven to be meaningful predictors across a number of experiments. The experiments conducted to date were often inconclusive and difficult to compare as they were all conducted on different datasets and none of them was ever repeated or validated by other studies. As a result, as a community we still lack an understanding of which security events can even be predicted in the first place, and which features are most useful for such prediction. This opens several research directions to explore different methodologies to capture and aggregate risk factors.

Measure the security posture of the target. One of the first ideas that comes to mind to understand the risk of cyber incidents is to look at the overall security of a given target. In fact, the security posture of an organization may provide good insights on the level of risk -if we assume that a better security hygiene can lower the risk of future attacks. Indeed, at least intuitively, the higher is the security of a system, the lower should be the probability of a security incident affecting that system. If we accept this assumption, risk prediction can be re-formulated as a problem of measuring security.

While the fact that security countermeasures could result in a reduced amount of computer abuse was first assessed in 1990 by the seminal work of Straub et al. [START_REF] Straub | Effective is security: An empirical study[END_REF], the link between security posture and cyber risk is not so straightforward and it is still poorly understood today. Security measures can certainly raise the bar for the attackers, but risk also depends on the number of attacks a target may receive-which could be higher for large and popular organizations. Moreover, relevant targets may attract more sophisticated and motivated adversaries, which can make prediction more complicated. But even if we accept this premise to be correct, there are still two serious obstacles to this approach.

First, despite almost four decades of attempts, it is still unclear whether a way to quantify security even exists [START_REF] Verendel | Quantified security is a weak hypothesis: a critical survey of results and assumptions[END_REF]. For instance, in 2009 Verende et al. [START_REF] Verendel | Quantified security is a weak hypothesis: a critical survey of results and assumptions[END_REF] surveyed many techniques taken from the economics, the computer science, and the reliability community, but still found unclear the validity of the existing results. Second, even if we had a scale to precisely measure security, it is still unknown what is the exact relationship between the level of security and the probability of incidents R1 . Simply saying that more security equals less risk is too vague to be practical. Does doubling security reduces the risk by half or by a factor of four? Does the curve reach a plateau, after which adding more security does not provide a tangible reduction in terms of risk?

Measure the behavior of the target. The fact that the behavior of the target can considerably affect its overall risk is another aspect which is often taken for granted. The idea is that, regardless of its security posture, the risk of being compromised of a given entity increases simply because of the actions it performs. For instance, if a user spends a considerable amount of her time browsing dubious and less reputable web sites, it seems reasonable that she would incur higher chances of being infected by malware than a user who only browses corporate and popular sites. Unfortunately, even if this may seem a logical conclusion, researchers have struggled to measure this simple relationship R2 . For instance, in 2013 Levesque et al. [START_REF] Levesque | A clinical study of risk factors related to malware infections[END_REF] found that the number of illegal and questionable websites visited by a user is less related to the risk of malware infection than the number of sport or computer sites. Similarly, Bossler et al. [START_REF] Bossler | On-line activities, guardianship, and malware infection: An examination of routine activities theory[END_REF] found that the time spent performing illegitimate computer activities was NOT a good predictor of malware infections. Strangely, the authors found that even higher computer skills and the adoption of careful password management failed to reduce this risk.

Many independent studies [START_REF] Canali | On the effectiveness of risk prediction based on users browsing behavior[END_REF], [START_REF] Sharif | Predicting impending exposure to malicious content from user behavior[END_REF], [START_REF] Levesque | A clinical study of risk factors related to malware infections[END_REF] found instead evidence that the volume of performed actions (e.g., the number of software installed or the number of websites visited, independently from their category) was always correlated to a higher risk. If confirmed, this finding seems to suggest that there is a systematic risk of performing common actions -such as browsing the web or installing software -and the final risk would mainly depend on how many times these simple tasks are repeated by an individual or an organization. In other words, a possible direction is to try to model the risk of a compromise by using a frequency-based approach R3 , which is already a common solution to describe safety risks.

Measure the attack surface. In a given cyber environment, the attack surface is defined as the set of different points where an attacker can try to break into the system or exfiltrate information. As a direct consequence, reducing the attack surface by removing unnecessary services or limiting the access to parts of the infrastructure represents a way to increase the security by reducing the number of components that an attacker can target. The rationale behind this concept is that the likelihood of suffering from a security issue will raise according to the number and diversity of software, services, and systems used. While this is simple mathematics (and approached have been proposed to measure the attack surface of a system [START_REF] Manadhata | An attack surface metric[END_REF], [START_REF] Howard | Measuring relative attack surfaces[END_REF]), the exact relationship that these variables have with cyber risk is still unknown and more experiments are needed to measure how risk actually reduces with the reduction of the attack surface R4 .

Influence of business sector, reputation, and assets of an organization. As we already mentioned above, non-technical characteristics of the target can influence the number, type, and sophistication of the adversaries it needs to face. Today it is widely accepted the hypothesis that, given enough time and resources, motivated attackers can always find a way to compromise a target. Large state-sponsored cyber attacks have shown this to be the case also for the most secure government organizations [158], [159]. Therefore, the type of business, the sector, the reputation, and the assets owned by an organization may influence the risk of compromise more than other technical indicators, as they allow to capture the characteristics of the attackers (incentives, risks, and resources as proposed by [START_REF] Schechter | Toward econometric models of the security risk from remote attack[END_REF]) instead of those of the defender. This assumption has already been shown to be valid to characterize both the number and the type of attacks, respectively by Sarabi et al. [START_REF] Sarabi | Prioritizing security spending: A quantitative analysis of risk distributions for different business profiles[END_REF] and Thonnard et al. [START_REF] Thonnard | Are you at risk? profiling organizations and individuals subject to targeted attacks[END_REF]. Moreover, this approach could also cover the risk of targeted attacks, whose ad-hoc natures does not allow them to be easily described by a frequency-based model [START_REF] Pieters | Reconciling malicious and accidental risk in cyber security[END_REF].

Predict future events based on historical data. Historical data about claims and incidents are routinely used to estimate the risk in other insurance sectors. However, as already stated in section III, the use of previously collected data to predict future cyber events faces several challenges. First of all, data on cyber incidents are scant and often biased towards those events whose disclosure is mandatory because regulated by law [START_REF]Security breach notification laws[END_REF], [START_REF]An overview of the main changes under gpdr and how they differ from the previous directive[END_REF]. A second challenge in this approach is to shed light on the so-called repeat players. Although previous studies found a systematic difference between costs incurred by companies that experience single or multiple incidents [START_REF] Romanosky | Examining the costs and causes of cyber incidents[END_REF] (the so-called repeat players), it is still not clear whether having already been compromised is a good indicator of being again compromised in the future R5 . Finally, an additional complication is represented by the fact that attack techniques evolve very rapidly over time, making obsolete results obtained from the observation of old data. For instance, if a known vulnerability associated with a high-risk factor were to be patched, past records about events occurred because of its presence would probably not provide any contribution to capture the risk associated to new attacks.

Measure the risk that propagates through third-party relations. Outsourcing many critical business operations became a norm in the last decade. It is very typical to store and process data owned by companies on third-party cloud services and even common services such as DNS and emails are now outsourced to the cloud. This largely complicates the picture for cyber insurances as it is harder to draw a clear line of the boundaries of a company. As common sense suggests, a company that is in relation to other risky entities should have higher risk itself. While constructing sufficiently accurate service-dependency graphs of businesses is a challenging research topic by itself [START_REF] Dell'amico | Lean on me: Mining internet service dependencies from large-scale dns data[END_REF], measuring the amount of risk that propagates through this graph is an open research problem that needs attention from the community. We will come back to discuss this problem in more details in Section VII.

User's weaknesses and social engineering. One of the most common techniques used today to gain access to a network or system is social engineering: indeed, while one can think that the most successful breaches are the result of technical flaws or zero-day vulnerabilities exploitations, almost 97% of them is achieved by tricking users to reveal sensitive information using a social engineering scheme [162]. Unfortunately, while social engineering attacks can pose a tremendous threat to organizations, current approaches to IT security and risk management tend to underestimate or completely ignore the human factor in risk assessment models, tools and processes [START_REF] Puricelli | The underestimated social engineering threat in it security governance and management[END_REF]. Extending existing schemes by modeling users and their behavior could largely increase their prediction accuracy R6 .

Risk aggregation. All the factors we previously mentioned are likely to somehow affect (to a different and still unknown extent) the risk of cyber incidents. But even if researchers would be able to precisely identify a number of good and stable risk indicators, we would still have known very little about the aggregation procedure required to combine the different scores. This problem is exacerbated by the fact that, for practical reasons, each study looks at a single factor in isolation. But different factors are probably not independent and they can have very complex consequences and side-effects on other indicators. For instance, a good security posture may mitigate a larger attack surface, but it can be completely undermined by untrained users. Therefore, if distinct studies respectively find good predictors of risk, a constructive combination of them would still require a considerable amount of research R7 . A classic insurance solution could be to evaluate all risk indicators separately and then rely on actuarial data about past incidents to combine them in a single risk class, but as we already said this data may be very hard to put together and may become obsolete very fast. Finally, a major obstacle to risk aggregation is the different granularity of the risk computed by different approaches. Some can predict the risk of compromise of a given software artifact, other of a user, or of an individual machine. How to aggregate these values, for example, at a company level is still an open research problem R8 .

A. Horizontal Issues

So far, we discussed different open problems and research questions and their relevance for cyber insurance. However, we believe it is important to also highlight three important aspects about cyber risk itself that apply to all previously mentioned approaches:

1) Cyber risk vs cyber-insurance risk: as briefly shown in section III-B, almost all the existing literature focuses on cyber risk assessment or prediction. Although these are important for the purpose of diverting security spendings towards most relevant threats, such evaluation could be misleading for cyberinsurance risk assessment. Indeed, a quantification of the first does not necessarily reflect the second, that after all is the actual value insurances are interested in: for instance, a class of events could have a high risk to harm one entity but lead to claim submissions with a very low probability. In other words, it is also important to study and measure how cyber risks translate to insurance claims in the real world R9 . 2) Consumers vs corporations: since cyber-insurance products are recently made available also for the consumers market [164], it is possible that a different approach and/or set of features should be considered depending on the entity under investigation. Indeed, consumers are less active with respect to big corporations, operate in a different scenario, and may become an appealing target of cyber attacks for different reasons compared to large enterprises. However, no study exists to date to compare the risk and threats encountered by consumer vs enterprise users R10 . 3) Risk variety: risk assessment or prediction procedures need to be targeted towards specific categories of risk. Indeed in an insurance context, addressing cyber risk as a single-unit problem may be too generic and may not lead to meaningful results. For instance, the authors of [START_REF] Bilge | Riskteller: Predicting the risk of cyber incidents[END_REF], [START_REF] Yen | An epidemiological study of malware encounters in a large enterprise[END_REF] predict machines and users at risk of malware infections, without providing any finegrained categorization (after all, malware is a very generic term). In the same way, Liu et al. [START_REF] Liu | Cloudy with a chance of breach: Forecasting cyber security incidents[END_REF] attempt to forecast generic cyber incidents specifying no type or effect. However, as shown by Eling et al. by using actuarial data [START_REF] Eling | Data breaches: Goodness of fit, pricing, and risk measurement[END_REF], different types of data breaches need to be modeled as distinct risk categories. A more fine-grained classification is needed R11 to also highlight particular categories of threats strongly coupled to the subject we are evaluating the risk for: for instance, malware targeted against banking systems are probably not very relevant for those enterprises in other business sectors.

VI. AREA 2: AUTOMATED DATA COLLECTION "If you're writing policies for personal automobile or personal homeowners insurance you definitely have a lot of really good data. The worst data is probably in cyber insurance"

-Nick Economidis, Cyber liability underwriter at Beazley PLC [START_REF] Wolff | Cyberinsurance tackles the wildly unpredictable world of hacks[END_REF] The importance of data collection for cyber-insurance carriers does not only relate to the actuarial domain, whose issues have already been discussed in section II. Data collection about prospective clients is indeed the first crucial task of policy underwriting, as it allows insurance firms to elicit a reasonable approximation of the overall security posture of the applicants, measure their level of risk, and subsequently compute premiums. The most common way to achieve this goal is to furnish organizations wishing to buy a cyber-insurance policy with security questionnaires. In a recent study, Romanosky et al. [START_REF] Romanosky | Content analysis of cyber insurance policies: How do carriers write policies and price cyber risk?[END_REF] analyze 44 of these questionnaires filed across the states of California, Pennsylvania, and New York, and point out commonalities that allow to group the questions into four macro categories.

The first set of questions aims at defining some general organizational details of the company, like its business sector and annual revenues, the kind of sensitive information stored and handled, how relationships with third-party service providers are managed, the nature and amount of IT security investments and, if any, its cyber-incident history. The second category focuses on technical aspects, often covering questions on security and access control measures adopted by the company and, less frequently, on its information technology and computing infrastructure. The existence of policies and procedures for data management is investigated in a third set of questions, in which insurance firms investigate whether data processing, retention and destruction practices are compliant with current regulation laws and procedures to maintain and strengthen information security. Finally on the legal side, questionnaires verify how well a variety of laws and regulations, enacted to protect consumers from the consequences of cyber incidents and data breaches, are implemented and adhered.

The information collected is then used for premium computation: while some carriers use flat-rate pricing for each first-and thirdparty coverage (with no differentiation by firm or industry), others incorporate more features (such as firm's sector and revenue) as factors to be multiplied in a base rate pricing. In more sophisticated policies, also the soundness and completeness of security controls and practices have a weight in the final result.

Although these questionnaires are widely adopted by cyber-insurance firms, the measure of their accuracy as a standalone tool for defining the security posture -and as a step further the risk -of an organization is still questionable. A recent work examines 24 application forms to determine whether the collection of security checks referred by technical questions corresponds to the controls defined in two well-known standards of security best practices [START_REF] Woods | Mapping the coverage of security controls in cyber insurance proposal forms[END_REF]. As result, existing forms are found to be predominantly focused on a small range of controls and the authors suggest how to extend them to be in alignment with the two information security frameworks. Nevertheless, the extent to which security standards compliance reflect the level of risk a company faces has not been yet understood R12 .

As suggested by modern approaches for data collection about cyber-insurance applicants [START_REF] Caglar | A new approach to risk assessment for cyber insurance[END_REF], cyber questionnaires should be only one of many tools employed by insurance firms. For instance, instead of relying on self-assessment, the security posture of an organization can be automatically refined using two types of data sources: (i) internal data, provided by monitoring and telemetry tools installed inside the subject under investigation; and (ii) external data, collected from publicly available databases or by scanning Internet-facing services.

Although recent works show the feasibility of both ap-proaches [START_REF] Liu | Cloudy with a chance of breach: Forecasting cyber security incidents[END_REF], [START_REF] Bilge | Riskteller: Predicting the risk of cyber incidents[END_REF], open questions still exist on both sides. Intuitively, internal data (if available) should provide a better accuracy to understand the cybersecurity risks of an organization. However, organizations do not exist in the void and the outcomes of internal telemetry analysis could be insufficient when assessing the security posture of an entity that maintains relationships or dependencies with external subjects -thus requiring a combination of the two approaches to cover unavailable information about these third parties.

On the other hand, in a cyber-insurance scenario, internal data could be unavailable to the insurer, who needs to base his evaluation on external data only. In this respect, the effectiveness of methods based on such sources only is not known, neither conditions and circumstances in which they can be used to achieve a good accuracy. As already depicted in Table II, studies that use external indicators to predict risk also validate their findings based on externally available ground truth. This is a big limitation, as cyber incidents are insufficiently reported and records, even if available, are often published too late and miss details and key elements. Moreover, the different precision and granularity of the ground truth make impossible to compare the results with those obtained with internal indicators. More research is therefore needed to compare the accuracy and relationship of externals indicators and internal telemetry information on the same dataset R13 . In particular, no previous work has provided insights on a combined use of both sources, trying to answer the question whether internal data can serve as ground truth for refining the power of external indicators R14 .

VII. AREA 3: CATASTROPHE MODELING

"One key challenge is accumulation. [. . . ] We know we can write earthquake exposures in both Japan and California with the confidence that the same event will not impact all these exposures at once. We know to be wary of writing two industrial risks along the same river basin, and the role flood defenses play in mitigating loss. With cyber risks, the contours of systemic accumulation are not as clear" -Hemant Shah, Risk Management Solutions [START_REF]Managing cyber insurance accumulation risk[END_REF].

For an insurance company, catastrophe modeling (or simply cat modeling) is a way to estimate the likelihood or frequency at which catastrophes can occur and to what extent they can impact the insurance. To decrease the likelihood of cyber catastrophes, a typical solution that is widely adopted is client diversification. The assumption here is that if the clients of the insurance company have diverse attack surfaces and diverse characteristics, a potential new zero-day vulnerability will not exist in all of them, leaving only a percentage of insureds affected by a possible cyber attack. While this may seem a reasonable conclusion, a recent unpublished work from Eling and Schnell [START_REF] Eling | Extreme cyber risks and the non-diversification trap[END_REF] suggested that, when modeling losses with specific distributions, diversification may not be a good idea because of the heavy-tailed distribution nature of cyber risks. This would be an important and counter-intuitive finding, that needs to be confirmed by further measurements R15 .

At its core, cat modeling boils down to capturing and modeling dependencies among different entities. This, in turn, translates into the identification of the dependencies that come from the software, hardware, and services used by a company. However, obtaining such detailed and comprehensive information about a large enterprise is a very challenging task. Moreover, because of the cyber-insurance context and the transitive nature of these dependencies, this task would need to be performed by using publicly available datasets. This makes the problem even more complex and hence, we believe, it opens new directions for researchers to explore and contribute.

In an ideal scenario where all companies reveal the software, hardware, and services they use and share with the community, building the service dependency graph, identifying the nodes in this graph that might cause catastrophic events, and calculating the indirect risk that comes from these dependencies would be a simple task. However, even in such a perfect world, the dynamicity of the graph would require to continuously report and recalculate the risk and likelihood of the existing catastrophes and the identification of new catastrophe scenarios. In other domains, if two risks are not connected (such as a fire hazard on two areas tens of thousands of miles apart) this fact is not likely to change in the near future. But in the cyber-insurance domain, the relationships among two different companies are often very ephemeral -as services providers and software libraries may change very often. But as of now, there is no existing work that studied how the dynamicity of the ecosystem could influence the whole cat modeling topic and whether (and how often) the portfolios defined by the insurance companies should also be updated R16 .

Moreover, the reality is far from this ideal scenario and even the topic of building adequately accurate service dependency graphs and modeling the catastrophes with sparse and incomplete data are research topics that need more attention from the community R17 . Altogether, this can lead to a supply chain risk analysis that would provide a principled foundation for catastrophe modeling.

However, the identification of all services used by a company, especially without its cooperation, is often infeasible. For instance, the presence of backup or redundancy services can remain undetected, as those only come into play when the primary provider fails. As a full and precise view of all the dependencies of a company may be impossible to obtain, then a modeling algorithm should be able to work with incomplete information, potentially inferring the missing connections from settings and relations observed elsewhere R18 . Although not done particularly for the cyber-insurance domain, there exist two works [START_REF] Dell'amico | Lean on me: Mining internet service dependencies from large-scale dns data[END_REF], [167] that aimed at building dependency graphs of popular companies by using public datasets such RIPE atlas, passive DNS records, and web crawling data. In 2017, Dell'amico et al [START_REF] Dell'amico | Lean on me: Mining internet service dependencies from large-scale dns data[END_REF] performed a large-scale study to identify the dependencies between websites and Internet services. The findings of the study confirm the monopoly problem in the current service ecosystem. To make matters worst, over time the Internet appears to be loosing its decentralized nature and the popularity of the few dominant providers is steadily increasing. In the same year, Simeonovski et. al [167] built a service dependency graph to explore what percentage of the Internet would be effected when a popular provider is attacked. The study found that by only targeting a handful of service providers it would be possible to take down 23% of the websites.

Another challenge that affects cat modeling is the lack of a mapping procedure to reliably associate measurements and public data to organizations. Network scans, web crawlers, service monitoring systems, public blacklist, and other techniques that can be used to identify the software and technologies adopted by a company typically work at the level of domain names or IP addresses. On the contrary, incident reports and risk prediction operate at a company granularity. Sadly, the connection between the two is not always straightforward and new techniques are needed to link the two information R19 . For instance, Liu et al. [START_REF] Liu | Cloudy with a chance of breach: Forecasting cyber security incidents[END_REF] explain their attempt to perform a manual mapping and all the difficulties and caveats encountered in the process, making it evident the necessity of a clearer and automated procedure. VIII. AREA 4: FORENSIC ANALYSIS "I often think of the 1990s as the decade of prevention, the 2000 as the decade of detection, and this is the decade of incident response. "

-Bruce Schneier, Security Specialist After the detection of a cyber incident, the response phase requires the intervention of computer security experts to analyze and understand the detail of the event. However, computer security skills are not only required for helping the company to recover from the incident but also, from an insurer's perspective, to verify the claim, assess the damage, and confirm whether it is covered by the subscriber's policy. Indeed, forensic investigations are the norm to assess if, and to which extent, the insurance is liable for the event.

Computer forensics is a broad research field that covers the collection, analysis, and preservation of digital evidence. It is a highly developed science with its own language, modus operandi, and standardized procedures [START_REF] Casey | Digital evidence and computer crime: Forensic science, computers, and the internet[END_REF]. However, while the other research topics discussed in this paper have all been recently contextualized (in terms of specific problems and new challenges) to the cyber-insurance domain, no study has looked at the problem of computer forensics from a cyber-insurance perspective.

For instance, one aspect that may require special attention is information forgery. In traditional insurance sectors, fake accidents cost over 30 billion dollars per year, with several insurers reporting these frauds to account for up to 20% of claims costs [START_REF] Bailey | Fake accidents cost insurance industry billions each year, experts say[END_REF]. However, while set-up wrecks and burning houses are sadly common practice for fraudsters to cash the insurance coverages, there is almost no mention to date about similar frauds in the cyber domain.

Current forensic approaches are mainly concerned with the possibility that an attacker can hide undetected or that important evidence and artifacts can be deleted or manipulated. In other words, the focus on evasion and not on forgery. The lack of motivation can explain why planting fake evidence in a computer system is not yet very common, but forged incidents are extremely easy to set up for anyone with average programming skills [START_REF] Gelernter | Cross-site framing attacks[END_REF]. The vast majority of the indicator of compromise used today rely on the simple existence of filesystem and registry artifacts -without any knowledge of how (and by whom) the data was created in the first place. In this setting, it is not hard to mimic a malware infection or even a targeted attack against an organization. However, with cyber insurances becoming more and more common, forged digital evidence may become a major problem in the future.

In particular, digital evidence forgery could help businesses to overcome one of the cyber-insurance most-common pitfalls: the fact that technicalities can invalidate coverage allowing insurance carriers to deny indemnity payments [171]. For instance, cyber insurance does not normally cover when employee errors (e.g., falling for phishing attacks) are the cause of a malware infection (e.g., ransomware) [172]. Since these events are instead covered under other clauses (e.g., malware installed by an external attacker), forging digital evidence would allow to "fake" a botnet infection to fall within the scenario covered by the insurance policy, thus allowing the victim to cash the indemnity.

Since today staging fake security incidents requires very little effort, researchers should not only study how to collect hidden signs of compromise, but also how to double-check and validate their authenticity R20 .

IX. CONCLUSIONS

In this paper we discussed the unique challenges that affect the cyber-insurance sector. We focus on a pure technical perspective, highlighting the limitations of current approaches, evaluating the feasibility of new solutions, and proposing research areas in which system and network security experts can play a fundamental role for the development of cyber insurance. Differently from legacy frameworks based on qualitative approaches for risk assessment and data collection, we endorse the relevance of prediction techniques based on objective measures and automatic feature gathering.

Fig. 1 :

 1 Fig. 1: Classic insurance process workflow extended in a cyber scenario (• Portfolio Management • Underwriting • Post binding • Claiming)

TABLE I :

 I Risk register: qualitative assessment examples for inherent and residual risk

	Description	Cause	Effect		Inherent Impact	Inherent Likelihood	Inherent Risk	Residual Impact	Residual Likelihood	Residual Risk
	Third person gains access to sensitive customer credentials information via stolen	Employee inadvertently within the source code inputs access credentials	1 million customers at risk of identity theft privacy preserving policy significant criticism for its Company receives	Catastrophic	Possible	High	Catastrophic	Remote	Medium
	Sensitive customer data exposed to unauthorised parties	Employee personal financial gain deliberately copied full customers records motivated by	1 million customers at risk of financial theft	Catastrophic	Remote	Medium	Catastrophic	Extremely Remote	Low
			1 million customer data at
	Remote code execution on webserver by unauthorised parties	Zero-day authentication exploited in third-party vulnerability library used for customer	risk of theft Business-continuity Online platform available to customers	not	Catastrophic	Possible	High	Catastrophic	Possible	High
			interruption

TABLE II :

 II Works on prediction

	Year & Paper	Predicted event	Ground truth		Features	Feature datasets
	2015 [20]	Cyber incidents	Incident reports	Ext	Mismanagement signs Malicious activities	Scanning tools Public scan data	Ext
					Website statistics
					Industry sector
	2015 [21]	Cyber incidents	Incident reports	Ext	Size	Information services	Ext
					Region
					Popularity
	2001 [23]	Vulnerability incidents	Incident reports	Ext	Exploit release timing	Vulnerability database	Ext
	2010 [24]	Vulnerability exploitation	Vulnerability reports	Ext	Vulnerability features	Vulnerability reports	Ext
					Industry sector	Industry classification
	2015 [22]	Targeted attacks	Mail scanning service	Int	Size	Linkedin	Int + Ext
					Employees features	Int telemetry
	2017 [25]	Malware encounters	AV Telemetry	Int	Binary file appearance	Int telemetry	Int
					Demographic
	2014 [26]	Malware encounters	AV Telemetry	Int	VPN logs	Int telemetry	Int
					Network logs
	2007 [27]	Malicious website encounters	AV Telemetry	Int	Browsing behaviors	Int anti-virus service	Int
	2018 [28]	Malicious website encounters	Website Blacklist	Ext	Browsing behaviors Self-reported data	Mobile ISP tracking data User questionnaires	Int
					Routine Activities
	2009 [29]	Losses from malware infection	User questionnaires	Int	Deviant Behavior	User questionnaires	Int
					Guardianship

ACKNOWLEDGMENT This project was supported by the European Research Council (ERC) under the European Unions Horizon 2020 research and innovation programme (grant agreement No 771844 BitCrumbs) and by the European Unions Horizon 2020 research and innovation programme under grant agreement No. 786669 (ReAct).