Abstract:The interconnectivity of cyber and physical systems and Internet of things has created ubiquitous concerns of cyber threats for enterprise system managers. It is common that the asset owners and enterprise network operators need to work with cybersecurity professionals to manage the risk by remunerating them for their efforts that are not directly observable. In this paper, we use a principal–agent framework to capture the service relationships between the two parties, i.e., the asset owner (principal) and the cyber risk manager (agent). Specifically, we consider a dynamic systemic risk management problem with asymmetric information where the principal can only observe cyber risk outcomes of the enterprise network rather than directly the efforts that the manager expends on protecting the resources. Under this information pattern, the principal aims to minimize the systemic cyber risks by designing a dynamic contract that specifies the compensation flows and the anticipated efforts of the manager by taking into account his incentives and rational behaviors. We formulate a bi-level mechanism design problem for dynamic contract design within the framework of a class of stochastic differential games. We show that the principal has rational controllability of the systemic risk by designing an incentive compatible estimator of the agent's hidden efforts. We characterize the optimal solution by reformulating the problem as a stochastic optimal control program which can be solved using dynamic programming. We further investigate a benchmark scenario with complete information and identify conditions that yield zero information rent and lead to a new certainty equivalence principle for principal–agent problems. Finally, case studies over networked systems are carried out to illustrate the theoretical results obtained.

Transaction risk control by cybermediary

Mitigating Transaction Risk for Cross-Border E-Commerce Firms: A Multiagent-Based Simulation Study

Bargain Security Model Based on Mobile Agent

A Deceit-Tolerant Negotiation Model for Agent Mediated Electronic Commerce

Risk Management in Real Estate Electronic Transactions

Study on risk management and control for virtual enterprises

A Trust and Risk Framework to Enhance Reliable Interaction in E-Commerce

Optimal Cyber-Insurance Contract Design for Dynamic Risk Management and Mitigation

A Theory Analysis and Model Research on E-Commerce Credit Risk Management

Dynamic Contract Design for Systemic Cyber Risk Management of Interdependent Enterprise Networks

Trust and Risk in Online Shopping: Literature Review and Conceptual Model

Mitigating Moral Hazard in Cyber Insurance Using Risk Preference Design

An insurance theory based optimal cyber-insurance contract against moral hazard

Cyber supply chain risk management: Revolutionizing the strategic control of critical IT systems

Risk prediction and control of strategic operation of e-commerce enterprises based on economic management science

The risk management of virtual enterprise based on bilateral negotiation

Transferring and Sharing Exchange-Rate Risk in a Risk-Averse Supply Chain of a Multinational Firm

Protocol of Multi-Node Business in Electronic Commerce

Cyber Risk Propagation and Optimal Selection of Cybersecurity Controls for Complex Cyberphysical Systems

Different Roles of Control Mechanisms in Buyer-Supplier Conflict: an Empirical Study from China

Supply Chain Financial Risk Management under the Background of Wireless Multimedia Communication and Artificial Intelligence