Building up Cyber Resilience by Better Grasping Cyber Risk Via a New Algorithm for Modelling Heavy-Tailed Data

Abstract

Cyber security and resilience are major challenges in our modern economies; this is why they are top priorities on the agenda of governments, security and defense forces, management of companies and organizations. Hence, the need of a deep understanding of cyber risks to improve resilience. We propose here an analysis of the database of the cyber complaints filed at the Gendarmerie Nationale.

We perform this analysis with a new algorithm developed for non-negative asymmetric heavy-tailed data, which could become a handy tool in applied fields. This method gives a good estimation of the full distribution including the tail. Our study confirms the finiteness of the loss expectation, necessary condition for insurability. Finally, we draw the consequences of this model for risk management, compare its results to other standard EVT models, and lay the ground for a classification of attacks based on the fatness of the tail.

Keywords: Risk analysis; Cyber risk; Systemic risk; Extreme Value Theory; Statistical analysis; Probabilistic modelling; Risk management; Insurance