A Practical Non-Intrusive Cyber Security Vulnerability Assessment Method for Cyber-Insurance
Junzheng Yang, Lulu Liang, Jiayin Qi · 2023
Cybersecurity insurance is one of the important means of cybersecurity risk management and the development of cyber insurance is inseparable from the support of cyber risk assessment technology. Cyber risk assessment can not only help governments and organizations to better protect themselves from related risks, but also serve as a basis for cybersecurity insurance underwriting, pricing, and formulating policy content. Aiming at the problem that cybersecurity insurance companies cannot conduct cybersecurity vulnerability assessment on policyholders before the policy is signed without the authorization of the policyholder or in legal, combining with the need that cybersecurity insurance companies want to obtain network security vulnerability risk profiles of policyholders conveniently, quickly and at low cost before the policy signing, this study proposed a practicial non-intrusive cyber security vulnerability risk assessment method. Our model uses only open source intelligence and publicly available network information data, employing an ensemble machine learning approach to assess the cyber vulnerability risk of an organization, achieving a precision of 75.6% compared to a rating based on comprehensive information by cybersecurity experts.