Cyber security risk management: public policy implications of correlated risk, imperfect ability to prove loss, and observability of self-protection