  Cyber insurance is a complementary mechanism to further reduce the financial
impact on the systems after their effort in defending against cyber attacks and
implementing resilience mechanism to maintain the system-level operator even
though the attacker is already in the system. This chapter presents a review of
the quantitative cyber insurance design framework that takes into account the
incentives as well as the perceptual aspects of multiple parties. The design
framework builds on the correlation between state-of-the-art attacker vectors
and defense mechanisms. In particular, we propose the notion of residual risks
to characterize the goal of cyber insurance design. By elaborating the
insurer's observations necessary for the modeling of the cyber insurance
contract, we make comparison between the design strategies of the insurer under
scenarios with different monitoring rules. These distinct but practical
scenarios give rise to the concept of the intensity of the moral hazard issue.
Using the modern techniques in quantifying the risk preferences of individuals,
we link the economic impacts of perception manipulation with moral hazard. With
the joint design of cyber insurance design and risk perceptions, cyber
resilience can be enhanced under mild assumptions on the monitoring of
insurees' actions. Finally, we discuss possible extensions on the cyber
insurance design framework to more sophisticated settings and the regulations
to strengthen the cyber insurance markets.
