DP13324 Some Principles for Regulating Cyber Risk
|Author(s):||Anil K Kashyap, Anne Wetherilt|
|Publication Date:||November 2018|
|Keyword(s):||cyber risk, macroprudential regulation, stress test|
|JEL(s):||G18, G28, L51, O33|
|Programme Areas:||Financial Economics|
|Link to this Page:||cepr.org/active/publications/discussion_papers/dp.php?dpno=13324|
We explain why cyber risk differs from other operational risks in the financial sector. The form of cyber shocks differs because of their intent, probability of success, possibility of a hidden phase and evolving form of the risks. The impact differs because problems can spread quickly and because uncertainty over the possibility of a hidden phase can impact responses. We explain why private incentives to attend to these risks may differ from societies' preferences and develop six (micro- and macroprudential) regulatory principles to deal with cyber risk.