Modelling maximum cyber incident losses of German organisations: an empirical study and modified extreme value distribution approach
Autor(en): | von Skarczinski, Bennet Raschke, Mathias Teuteberg, Frank |
Stichwörter: | Business & Economics; Business, Finance; COSTS; Cyber incident losses; Data breach; Extreme value distribution; Information security management; Loss size distribution; PARETO; Tapered distribution | Erscheinungsdatum: | 2023 | Herausgeber: | PALGRAVE MACMILLAN LTD | Enthalten in: | GENEVA PAPERS ON RISK AND INSURANCE-ISSUES AND PRACTICE | Band: | 48 | Ausgabe: | 2, SI | Startseite: | 463 | Seitenende: | 501 | Zusammenfassung: | Cyber incidents are among the most critical business risks for organisations and can lead to large financial losses. However, previous research on loss modelling is based on unassured data sources because the representativeness and completeness of op-risk databases cannot be assured. Moreover, there is a lack of modelling approaches that focus on the tail behaviour and adequately account for extreme losses. In this paper, we introduce a novel `tempered' generalised extreme value (GEV) approach. Based on a stratified random sample of 5000 interviewed German organisations, we model different loss distributions and compare them to our empirical data using graphical analysis and goodness-of-fit tests. We differentiate various subsamples (industry, size, attack type, loss type) and find our modified GEV outperforms other distributions, such as the lognormal and Weibull distributions. Finally, we calculate losses for the German economy, present application examples, derive implications as well as discuss the comparison of loss estimates in the literature. |
ISSN: | 1018-5895 | DOI: | 10.1057/s41288-023-00293-x |
Zur Langanzeige
Seitenaufrufe
1
Letzte Woche
1
1
Letzter Monat
1
1
geprüft am 06.06.2024