Three essays on cyber risk management