J. Attride-stirling, Thematic networks: an analytic tool for qualitative research, Qualitative Research, vol.2, issue.4, pp.385-405, 2001.
DOI : 10.4324/9780203413081_chapter_9

W. S. Baer and A. Parkinson, Cyberinsurance in IT Security Management, IEEE Security & Privacy Magazine, vol.5, issue.3, pp.50-56, 2007.
DOI : 10.1109/MSP.2007.57

T. Bandyopadhyay and S. Shidore, Towards a managerial decision framework for utilization of cyber insurance instruments in IT security, AMCIS 2011 Proceedings -All Submissions, 2011.

T. Bandyopadhyay, V. S. Mookerjee, and R. C. Rao, Why IT managers don't go for cyber-insurance products, Communications of the ACM, vol.52, issue.11, pp.68-73, 2009.
DOI : 10.1145/1592761.1592780

I. Ben-gal, Bayesian networks. Encyclopedia of statistics in quality and reliability, 2007.

K. Bernsmed and I. A. Tøndel, Forewarned is Forearmed: Indicators for Evaluating Information Security Incident Management, 2013 Seventh International Conference on IT Security Incident Management and IT Forensics, pp.3-14, 2013.
DOI : 10.1109/IMF.2013.14

C. Biener, M. Eling, and J. H. Wirfs, Insurability of cyber risk: An empirical analysis. The Geneva Papers on Risk and Insurance-Issues and Practice, pp.131-158, 2015.
DOI : 10.1057/gpp.2014.19

R. Böhme and G. Schwartz, Modeling cyber-insurance: Towards a unifying framework, Workshop on the Economics in Information Security (WEIS), 2012.

B. Cashell, W. D. Jackson, M. Jickling, and B. Webel, The economic impact of cyberattacks, Tech. rep., CRS Report for Congress, 2004.

E. Chickowski, 10 things IT probably doesn't know about cyber insurance, 2014.

S. Fenz and A. Ekelhart, Verification, Validation, and Evaluation in Information Security Risk Management, IEEE Security & Privacy Magazine, vol.9, issue.2, pp.58-65, 2010.
DOI : 10.1109/MSP.2010.117

L. A. Gordon, M. P. Loeb, and T. Sohail, A framework for using insurance for cyber-risk management, Communications of the ACM, vol.46, issue.3, pp.81-85, 2003.
DOI : 10.1145/636772.636774

D. S. Herrmann, Complete Guide to Security and Privacy Metrics, 2007.
DOI : 10.1201/9781420013283

H. Government, U. , and M. Ltd, UK cyber security: The role of insurance in managing and mitigating the risk), https://www.gov.uk/ government/publications/uk-cyber-security-the-role-of-insurance 19, 1990.

. Lloyd-'s, Cambridge Centre for Risk Studies: Business blackout -the insurance implications of a cyber attack on the us power grid, 2015.

M. S. Lund, B. Solhaug, and K. Stølen, Model-driven risk analysis: the CORAS approach, 2010.
DOI : 10.1007/978-3-642-12323-8

A. Marotta, F. Martinelli, S. Nanni, and A. Yautsiukhin, A survey on cyberinsurance, 2015.

P. H. Meland, I. A. Tøndel, and B. Solhaug, Mitigating Risk with Cyberinsurance, IEEE Security & Privacy, vol.13, issue.6, pp.38-43, 2015.
DOI : 10.1109/MSP.2015.137

. Netdilgence, Netdiligence cyber claims study 2014, Tech. rep. NetDilligence, 2014.

D. S. Nielsen, The cause/consequence diagram method as a basis for quantitative accident analysis, Tech. rep., Danish Atomic Energy Commission, Risoe. Research Establishment, 1971.

K. Øien, S. Massaiu, R. Tinmannsvik, and F. Strseth, Development of early warning indicators based on resilience engineering, PSAM10, International Probabilistic Safety Assessment and Management Conference, pp.7-11

R. Oppliger, Quantitative Risk Analysis in Information Security Management: A Modern Fairy Tale, IEEE Security & Privacy, vol.13, issue.6, pp.18-21, 2015.
DOI : 10.1109/MSP.2015.118

R. Pal and P. Hui, On differentiating cyber-insurance contracts a topological perspective, 2013 IFIP/IEEE International Symposium on, pp.836-839, 2013.

N. Perlroth and E. A. Harris, Cyberattack insurance a challenge for business, 2014.

B. Schneier, Attack Trees, Dr. Dobbs journal, vol.24, issue.12, pp.21-29, 1999.
DOI : 10.1002/9781119183631.ch21

S. M. Sulaman, K. Weyns, and M. Höst, A review of research on risk analysis methods for IT systems, Proceedings of the 17th International Conference on Evaluation and Assessment in Software Engineering, EASE '13, pp.86-96, 2013.
DOI : 10.1145/2460999.2461013

I. A. Tøndel, P. H. Meland, A. Omerovic, E. A. Gjaere, and B. Solhaug, Using cyberinsurance as a risk management strategy: Knowledge gaps and recommendations for further research, 2015.

C. Toregas and N. Zahn, Insurance for cyber attacks: The issue of setting premiums in context, 2014.

D. D. Woods, Essential characteristics of resilience. Resilience engineering: concepts and precepts, pp.21-34, 2006.