Slashdot Mirror
[H|Cr]acker Insurance
Spellbinder writes "yahoo has an article on
Hacker insurance, also known as "network risk insurance," has been on the market for about three years, but is expected to explode from a $100 million sideshow into a $2.5 billion behemoth by 2005, according to insurance industry projections."
If they'll pay that much for insurance, I wonder how much they'd pay for a SysAdmin that secures things properly.
If running Microsoft SQL Server 2000 or IIS.... augment risk with 1000%.
How about claiming millions of dollars in damage just because the ceo got a virus? Sounds like a good business model to me.
if everyones site went down - as it almost did with the latestVuln in MSSQL - how would anyone ever cover the losses?
fp
what about product liability? automakers, drug manufacturers and every other manufacturer is liable for their products in some way. How come software companies are exempt from this?
the *best* insurance is a competent admin...
nothing else will do!
---
Information wants...you to shut your pie hole.
I can see it now: company tries to claim a loss due to having their network compromised.
Insurer: I'm sorry but we have rejected your claim.
Insured: What the hell do you mean? This is why we bought hacker insurance!!
Insurer: Yes, but you bought "hacker" insurance. If you wanted to be reimbursed for a loss like this, you should have bought our "cracker" insurance! But you're in luck! We've got a special offer now! If you buy cracker insurance and already have purchased hacker insurance from us, you will save 10%! I guess today is your lucky day after all!
Insured: You insurance companies are vultures! Profiting off our loss! Well, okay, I don't want to think any more about it. Just sell me whatever insurance you think is best for me.
Insurer: Just what I was hoping you'd say! Sign here, here, and here, please! No, don't bother reading that. It's just a bunch of legal jargon...
GMD
watch this
Would there be a higher premium for those running a Microsoft OS vs. oBSD?
Anybody that would willingly buy insurance is at least half-nuts. If you DO buy insurance and DO get broken into they will send out swarms of "adjusters" and question how this could have happened, and how lax your security must be. Then they will proceed to up your premiums to make back what they paid you for the "damage." So they will end up getting THEIR money anyway. So my advice would be to take that money you would have spent on insurance, and buy a firewall and a decent admin to run it.
Do they cover your bandwidth bill when some random infected virus sends packets to your secured site even if you dont get infected?
What's the cracker equivalent of negroes and fried chicken?
[I] [T]hink [Y]ou [M]ay [H]ave [A] [C]opywright [V]iolation [I]n [T]he [F]irst [L]ine [O]f [T]he [S]tory?
1: Sign a Hacker Insurance contract.
2: Install insecure systems (eg Windows) company-wide
3: Put some "0wn3d by" or other h4x0r-style files randomly in the filesystems.
4: Wait the first data loss.
5: Jump around like a chimp screaming Hackers! Hackers! Hackers!
6: Profit!
Thats like the story of NASA inventing this hyper-super-duper centrifugally balanced gravity boosting ballpoint pen for their astronauts and the Soviets bringing along a pencil.
I have found a truly wonderful proof of Fermat's Last Theorem, but unfortunately this sig is too small to contain it.
Sure companies need insurance against hrackers but many hackers spend so much time on the websites they cracl that they should get insurance too.
Call up Greenspan and crank up the printing press - we've got an insurance bailout on our hands!
Karma: Bad (mostly affected by being such an asshole)
Hartford Steam Boiler offers good rates, but requires intrusive inspections. Before they insure something, they inspect and provide a list of things they want fixed. Then they inspect again, after the problems are fixed. Only then will they provide insurance coverage. They then have the right to inspect at any time, and they use it.
This works great for steam boilers (where they have great expertise) but they haven't tried to expand much out of their niche. Even though they do cover some computers, they're still mostly focused on boilers. It's good that others are now moving in that direction.
This is the right approach. When Hartford Steam Boiler started in 1866, steam boilers blew up regularly. Within a few years, boilers insured by Hartford Steam Boiler weren't blowing up. A similar approach may eliminate computer crashes as a major problem. The day may well come when you can't buy insurance because you have an insecure OS on the premises.
This makes a whole lot of sense, because it allows companies to spread the cost of computer crime over time.
Every company expects numerous break ins, vandalism, data theft, etc.. The problem is that it is hard to budget for this because the value of the damage is different in every case.
Buying insurance for the attacks allows shortfalls in the data crime budget to be covered, and provides benefits for budgeting and tax purposes by increasing stability in the face of constant inevitable loss.
If it's an insurance against network risks, shouldn't it be dubbed a "Microsoft Insurance?"
I can see the conversation now, "Oooh, you're running MS Servers? Your premiums just went way up..."
Guido: Nice network you gots here, it would be a shame if something where to happen to it.
Customer: What do you mean?
Nunzio: You know, accidents, like your customer records being posted on slashdot. Accidents happen you know.
Guido: But your in luck, my brother and me can, for a small fee, grantee your network wont be hacked by disreputable people like us. Think of it as "insurance".
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Car insurance is cheaper if you have an ignition disabler, and other anti-theft features.
If companies actually buy cracking insurance, they will want to get it at a low price.
The insurance industry, by charging high-premiums for bad IT management, bad security, bad policy, and bad software, could force companies to improve themselves.
How high are the premiums on MS SQL 2000?
You could clearly point to the insurance premiums and show how much bad security is costing the company.
The article went on to talk about some "hoops" companies must go through to get insured. Some of these hoops included external audits, and assurances that security is important. Perhaps this kind of thing can actually increase security since it gets people higher up (and not the techies) thinking about it.
.... I bet that board will step up to the plate for security funding!
If you're board of directors tries to get cracker insurance, and the insurance company fails you as being to big of a risk
The interesting thing is that if companies followed the requirements of the insurance company to get the hacker insurance, their security would improve tremendously. Many companies don't even perform the simple tasks the insurance companies will require. That alone would help tremendously.
:-)
Ironically, if more companies would conduct assessments, patch vulnerable systems, setup security policies, etc. the demand for this type of insurance might actually diminish. Little chance of that.
Does anybody know where documentation can be found on how "risk assessment" is done for this type of insurance?
This would be a very interesting way to gauge what software and network hardware an establishment should/should not be using.
It would be very interesting to see where Microsoft products fall in the mix.
Insurance companies are largely responsible for your loss of rights while driving. They'll do the same for the internet. They'll lobby hard for wiretaps and whatever else it takes to create a closer 'relationship' between computer users and police agencies.
and the main investor in these insurance companies would be...
Microsoft perhaps?
One solution could be to declare it a result of force majeure: "An act of God", an event that could never be anticipated. Somehow I don't believe that would hold up in court. ;-)
The good thing about cracker insurance, is that the insurance companies will impose terms that the insured parties have to comply with. And they can give discounts on premiums if some measures are taken by the insured. How about a 10% discount for switching from Windows to a secure system
Irene KHAAAAAAN!
Would a firm get a break on their insurance if they ran 100 OpenBSD servers rather than 100 Windows servers or do they view a box as a box as a box?
Trolling is a art,
This reduces total overhead by removing the license fees associated with Windows, SQL, and Exchange, and eliminates the need for expensive insurance options. The money saved could be used to hire a qualified network security person in-house.
I see some posts here about insurance cost of Windoze vs. oBSD. oBSD is about as secure as it gets - certainly it's several orders of magnitude stronger than the toys from Redmond. A Logical human would conclude that it should be much cheaper to insure oBSD than Windoze. Not necessarily so...
The problem here, is that Microsoft has already admitted that their products have crap security. What's preventing M$ from opening their own (or buying out another) hacker insurance co. and giving large discounts to Windoze based corporations? Would other corporations stick with a non-M$ operating system if they had to pay double the insurance premium and/or accept reduced coverage?
There is definite potantial for abuse here.
I'd rather be a conservative nutjob than a liberal with no nuts and no job.
How about slashdot insurance?
My Blog
"...but is expected to explode from a $100 million sideshow into a $2.5 billion behemoth by 2005..."
Even taking these predictions with a rather large grain of salt, this is still fairly impressive. Might be a good time to look into putting your money into (gasp!) the stock market?
"The power of accurate observation is frequently called cynicism by those who don't have it." - G.B. Shaw
'Mainstream' servers like IIS and Apache will have their flaws documentation within days, perhaps hours, of being discovered. This will make insurance on servers like this easier to judge. What about a home-brew image server? Or an obscure small scale database from sourceforge.
Auditing and insuring as apropriate for these applications would be a slow and tricky process (the cynic in me says it is yet another business oppertunity) as many thousands of apps would have to be tested and rated on an insurance-risk-table - if you do want to be insured from this so called 'h/cracker threat' it isn't going to come cheap.
I know what a hacker is, but what is a "cacker" or a "racker"?
(simple regular expression bugs in article titles explain a lot about why Slash is the way it is)
Josh Woodward
OK M$ bashies, enough. One word, "bugtraq."
The issue here is really interesting. Do you think that by patching systems, and by going through security testing, the premiums for this type of insurance will go down? How do you determine a financial settlement (Kevin Mittnick allegedly cost several companies billions of dollars in damage, blah blah blah)? Will this make security teams wealthy and sysadmins better?
Furthermore, the article says that this type of insurance has been around for 3 years now, but I didn't get a hit when I typed in "network risk insurance" into Google...who is providing this?
Sounds like a scam I'd like to be a part of...
man rtfm
Microsoft can make their software bugs profitable. More bugs: more risks: is higher insurance costs. Just imagine what deals they could make with those insurance companies. B.G.:"I'll give you tree MS SQL bugs for 100.000 a year, or else we will release a patch for it" Insurance:"Sounds like a good deal, but i want one which can be remotely exploited annymously to insure results" B.G.:"off course".
And the more bugs get exploited the more poeple will get these policies instead of hiring a good admin that will secure their computers and is up-to-date with bug announcements. Spending money on "what could be" isn't the solution to a faulty network/system.
I thought the "$2.5 billion by 200[0,2,4,6]" claims went out with Aeron chairs and the Segway. Does anyone take that shit seriously?
sulli
RTFJ.
of the world's biggest evil empire - the insurance industry. WTF is wrong with people? Hacker insurance? How the hell do people expect to be able to prove they were hacked when most companies dont even know how to check to logs on their "firewall"? More money wasted that should be creating actual jobs for people who need them. /rant
Sapere Aude - Homer
2) H@x0r 127.0.0.1
3) Profit!
Mitnick is back on the scene, after all...
SURELY I would pay less insurance if I'm using all FreeBSD 5.0 boxes vs. Windows NT 4.0 SP1 boxes! Let's see what the rates turn out to be. Again... very good news!
has been on the market for about three years, but is expected to explode from a $100 million sideshow into a $2.5 billion behemoth by 2005
odd this would coincide with Kevin M finally free
-uglyman
you are running M$ software so there is a pre-existing condition.
sorry.
Ah, maybe that explains why I keep getting hacked by some l33t dude called a115tat3.
"If I could live to be several hundred
I could take a walk and really wander, really wonder."
and don't forget to get your DDOS flood insurance coverage too.
Oh that's just fucking perfect.. we went from "Big Tobacco" to "Big Oil" to "Big Fast-food", and now we're at "Big Insurance"?!
feh, you psychosocialists are really starting to piss me off
The article title reads [H|Cr]acker Insurance
This regex works but I don't think it works for the reasons that the author intended. For example,
The [H|Cr] is a character class matching the single character H, C, r or |.
So this regex will match Hacker Insurance, and Cracker Insurance (bolding indicates what part of the word matches)... it will also match |acker Insurance
I wouldn't normally be so anal but the title involves hackers/crackers... you'd think you'd get the logic right, no?
I would humbly suggest the regex (H|Cr)acker Insurance
If the author was intending some weird regex syntax where [] indicates something other than a character class then I apologize in advance,
ID-10-T is a way of life
I am sure that does much more damage than some little ol' virus.
Sdelat' Ameriku velikoy Snova!
is expected to explode from a $100 million sideshow into a $2.5 billion behemoth by 2005, according to insurance industry projections.
So, do the companies buy insurance to guard against the chance that their predictions are wrong?
I couldn't tell if you were experimenting with poor-man's cryogenics or looking for the orange sherbet.
here is an excerpt from an old press article: "one of the first companies to offer hacker insurance, has begun charging its clients 5 percent to 15 percent more if they use Microsoft's Windows NT software ...
has been selling hacker insurance since 1998, based his decision on more than 400 security analyses
[ ... ]
system administrators working on open source systems tend to be better trained and stay with their employers longer than those at firms using Windows"
read on: short (long)
Problem is, the clients that need software insurance the most run sofware that forbids you to checkout code, and the software that lets you checkout the code doesn't need insurance.
This fact may prevent the kind of scenario your post describes to occur in the computer industry.
Sdelat' Ameriku velikoy Snova!
foreach (hack_attempt)
rates+=(rates*0.1)
if(provider==$Microsoft)
rates=(rates*1000)
else
rates=normalRate
I predict every claim will be turned down, under the guise of a preexisisting condition. If the admin can't secure the sytem, they certainly won't be able to prove the system was clean before purchasing insurance.
He's not following regex rules! If he wanted a regex it'd use parenthesis instead of brackets. He's following the formatting conventions you often see in gnu utils when you execute them with --help.
..
So [H|Cr] is correct.
For instance,part of man --help is
man [-c|-f|-k|-w|-tZT device]
If it were a regex it'd look like H|(Cr)acker. But we're not doing pattern matching, substitution, or even transliteration; we're defining options.
Did I just spend 2 minutes writing this? I have no life.
Photos.
Where the CTO for Counterpane Internet Security says:
"I believe that within a few years hacking insurance will be ubiquitous," Schneier said. "The notion that you must rely on prevention is just as stupid as building a brick wall around your house. That notion is just wrong."
Uh, my house has brick walls on all sides for that very purpose..
I guess he is saying that now we should all just forget about applying patches, and installing firewalls. We should just buy insurance for when we get hacked.
-- -- Warning. Do not stare directly at the sun.
Don't you mean (H|Cr)acker?
You know where you are? You're in the $PATH, baby. You're gonna get executed!
Thou art wise.
J. S. Wurzler charged more for Windows NT users, compared with Linux or Unix. This from the CNET news article:
t ml?legacy=c net
0 1-11.html
Okemos, Mich.-based J.S. Wurzler Underwriting Managers, one of the
earliest agencies to offer hacker insurance, has begun charging its
clients anywhere from 5 to 15 percent more if they use Microsoft's
Windows NT software instead of Unix or Linux for their Internet
operations.
"We have always felt that there is a high risk with the Windows NT
system," said Walter Kopf, senior vice president of underwriting at
Wurzler. "We have found out that the possibility for loss is greater
using the NT system. Where there is a greater loss, there tends to be
an
increase in the premium."
http://news.com.com/2100-1001-258392.h
And here's an article on whether your company could be sued for
unwittingly sending on viruses:
http://www.gigalaw.com/articles/2001/hollander-20
I've just taken to abandoning both Hackers and Crackers and using Attackers. It works just fine in everyday conversation and nobody misunderstands you. "NAT can prevent attackers from breaking into your network, by removing global incoming addressability." "The web site was attacked, but survived." "Somebody is attacking my server."
Say what you mean, mean what you say.
--Dan
I just called my insurance company:
me: g1bb0r m3 h4x0r 1n5ur4nc3.
insurance co.: Pardon me?
me: g1bb0r... m3... h4x0r... 1n5ur4nc3...
insurance co.: Sir, this is an insurance company.
m3: 3y3 gn0 j00 l4m3x0r! G1BB0R M3 H4X0R 1N5UR4NC3!
-- click --
Some people have no sense of humour.
Trolling is a art,
Instead of having Vito and Tony torch the warehouse, you just give the kid down the street the passwords to the router and the server farm :)
Compare your average internet connected server to a more real world scenario, and compare your "cracker" to your "thief".
Imagine a theif wants to steal my TV set and no law or threat of force is going to stop him. If I were to "store" my TV set out on the sidewalk in front of my house, it WILL disappear. It's only a matter of time. Likewise, if I keep an insecure server wide open on the internet, with known exploits, it WILL get cracked, it's only a matter of time.
Now consider that I store my TV set inside my house, like most people do, and keep the doors locked, like most people do. The cracker still knows where the TV is, but he'll first need to get inside to take it. However, if he is undeterred, he can break a window and get in. This compares to your average insecure system behind a firewall. Good protection, to be sure, but if there is a flaw in the system, and an insecure system behind a firewall is still a major flaw, someone can still get in. The options are just limited.
Now say I bolt down the TV set. Removing it will require an extensive amount of time. A dedicated thief can still get it if he wants to, but there's almost a 100% chance that he'll get caught in the process. A well patched, up to date system with no known vulnerabilities is safe. Certainly, some blackhat might have a way in that nobody has ever heard of before, but it's highly unlikely. And likewise, they can track down the physical location of the machine, and hit it manually, but by that time you have bigger problems.
How does this relate to insurance? Imagine an insurance company willing to insure a TV set you store on your sidewalk. It's not going to happen.
So will an insurance company choose to cover a network that has any known vulnerabilities on it? Or are they going to do a risk assessment based on a company's ability to keep their machines secured? And do they plan to keep track of these things? Simple fact is, a well secured network probably won't need the insurance. And good administrators will know this.
This means, that anyone who really needs the insurance will have to pay a TON of money for it, otherwise the insurance companies will go broke handling all the claims, for if someone is well insured, they're likely to be more sloppy. This means the insurance company is going to have to take a somewhat proactive stance to insure (no pun intended) that the customer's network is secured.
And just think of the possibilities for fraud...
-Restil
Play with my webcams and lights here
If you are a bad driver and get into a car crash that was your fault, the automaker is definately not responsible. If you overdose on medicine, the drug company is not responsible.
If you are inept and don't keep your system up to date, the software company is not liable.
I'm a firm believer in the philosophy of a ruling class. Especially since I rule. -Randal, Clerks
Cyber-risk insurance is a neat idea. There is one major problem with treating it like other sorts of risk that insurance companies write policies for -- the constant and easy loss aggregation potential.
Loss aggregation is the insurance industry's term for the ability of of a single incident to cause multiple claims across their policy book. The Sept 11 attacks are one example of the type of loss aggregation problem that really frightens them.
Cyber-risk policies present similar situations. As long as computer security is driven by the absence or presence of vulnerabilities, individual exploits can result in thousands of claims.
I spent some time discussing this in my session on preventative security for vulnerable software at LinuxWorld last week. As I said then, the insurance companies will be our strongest ally in the security space, but only if we can make computer security a solvable problem.
Don't be fooled into thinking that security problems will go away if only we can get patches for vulnerabilities applied just as soon as they are available. The recent Saphire/Slammer mess should be sufficient to indicate that businesses aren't ever going to be consistently up-to-date with the latest patches. Thinking otherwise is just silly. Security this way is the functional equivalent of taking care of a 3 month old child: feed, burp, change diaper, repeat. Worse, it's a 3 month old that never grows up.
Anyway, back to work.
-- Intrusion prevention for Linux servers. www.cylant.com
$ whois
www.hollywoodreporter.com
No match for "WWW.HOLLYWOODREPORTER.COM".
Wayback machine
Some quick notes: www.hollywoodreporter.com recently posted an article about RIAA web site being hacked and then suddenly it disappeared from Internet DNS.
Yet Another Form of Windows Tax.
All other things being equal, you pay less car insurance when you have airbags vs. none. Or when you have an alarm vs. none. It's a slight reduction on the comprehensive part of the insurance. I think running BSD instead of Windoze is a big enough difference that there, on whatever level large or small, should be a change in premiums paid. It should be interesting!
One of the tricks used by Israeli nationals in the US is to have "students" running around doing stuff that skirts on the illegal -- and then sending them back to Israel when things get hot. I wonder how many H-1Bs from, say, India you can have in a software shop before the carrier starts to jack up the insurance rates. There's always more where they came from you know ... lots more than Israelis.
Seastead this.
Two years ago I heard Bruce Schneier at DefCon saying that "intrusion detection is more important than intrusion prevention". And now he's touting the purchase of insurance over focusing on attack prevention. While Schneier knows more about cryptography than most people on this planet, he doesn't know sh*t about real-world corporate security. I've been doing InfoSec for over 13 years, and I would much rather put my resources into hardening my systems/databases/applications than into monitoring and reacting to intrusions. I've seen a couple prior responses here that seem to be along the same lines.
Also, being that Schneier's company is partnered with Lloyds of London (who provides such insurance) and can provide the necessary assessment services, perhaps his "expert opinions" on the subject show just how far his professional integrity goes. Hmmmm!!!!
Vic
Fortunately, the responsibility for providing evidence is on the part of
the person making the claim, not the critic. It is not the responsibility
of UFO skeptics to prove that a UFO has never existed, nor is it the
responsibility of paranormal-health-claims skeptics to prove that crystals
or colored lights never healed anyone. The skeptic's role is to point out
claims that are not adequately supported by acceptable evidcence and to
provide plausible alternative explanations that are more in keeping with
the accepted body of scientific evidence.
-- Thomas L. Creed, The Skeptical Inquirer, Vol. XII,
No. 2, pg. 215
- this post brought to you by the Automated Last Post Generator...