個案總覽

Rarely does a day seem to go by without another front page story about a firm being breached by cyber-attackers. Even experts in the field are far from immune from the unsustainable status quo. For example, Jim Lewis of the Center for Strategic and International Studies has said: "We have a faith-based approach [to cybersecurity], in that we pray every night nothing bad will happen." This is a difficult starting point to consider an appropriate end game. Still, it is something that firms must do since infinite investment cannot breed infinite security. This article takes lessons from the burgeoning field of cyber peace studies and applies them to private sector cyber risk mitigation strategies. With members of the C-Suite on down to mailroom clerks worrying about the next attack and looking over their shoulder after a breach occurs, who wouldn't welcome some peace of mind?

Firms have increasingly been turning to cyber risk insurance in order to better manage cyber threats and any resulting legal liability from data breaches. But how useful is this tactic? Herein, I analyze the impact of cyber attacks on firms, some of the applicable U.S. law shaping private sector responses to data breaches, and the extent to which cyber risk insurance helps mitigate the cyber threat. Ultimately, I argue that firms must take a proactive stance toward managing cyber attacks-not only for their wellbeing, but also to enhance overall cybersecurity and help secure critical national infrastructure.