Assessing and Insuring Cybersecurity Risk