[H|Cr]acker Insurance

Wow by Anonymous Coward · 2003-01-28 05:19 · Score: 5, Insightful

If they'll pay that much for insurance, I wonder how much they'd pay for a SysAdmin that secures things properly.

Re:Wow by WPIDalamar · 2003-01-28 06:10 · Score: 3, Insightful

I bet not as much... These companies are looking for financial stability. So they make X number of dollars no matter what.

When a company buys insurance they are 100% guarenteed to recover losses from a crack.

When a company spends that money on an admin, the chance for being broken into goes down, but will never be 0%

Disclaimer: This assumes the company negotiates a "good" insurance contract, and fullfills all of their requirements.
Re:Wow by error0x100 · 2003-01-28 06:40 · Score: 5, Insightful

When a company buys insurance they are 100% guarenteed to recover losses from a crack.
When a company spends that money on an admin, the chance for being broken into goes down, but will never be 0%
Taking out h/crack insurance, then, lowers the incentive for additionally investing in proper network security (e.g. a decent sysadmin). The companies, if the insurance leaves them feeling "financially safe" from an attack, will be even less inclined than they are now to implement proper security. In "normal" insurance, this sort of thing amounts to negligent/deliberate behaviour that in some cases will make the insurer decide not to pay. If enough people leave their networks vulnerable, and the insurers are struggling to stay afloat as a result, then they are going to start getting more strict about the conditions of the insurance vs premiums (as happens in auto insurance, more security features on a car imply general lower risk and thus lower premiums). I don't see why it should be any different here. If companies are making almost no effort whatsoever to secure their networks (as many companies do now), then the insurer either should refuse to cover them, or they should have to pay much larger premiums. (Although then it starts to look like the old "then whats the point of insurance" argument; disability insurance providers in my country routinely refuse to even consider covering people with a medical past that includes things like even very minor back problems. In other words, they will only cover people who do not represent much of a risk at all). However, in the case of 'network insurance', its deliberately irresponsible behaviour that places one in a high risk group (e.g. like smoking).
Re:Wow by rgmoore · 2003-01-28 08:04 · Score: 4, Insightful

I bet not as much...

You are most likely wrong. Insurance companies aren't stupid, and they're not going to charge everyone the same rate any more than auto insurance companies charge everyone the same rate regardless of their driving record. They'll give better rates to companies that have good security practices and good track records than ones with bad practices and records. They may even refuse to offer insurance unless the companies follow specified practices; I'd guess that hiring certified administrators would be one required practice. This is similar to the way that insurance companies won't sell you auto insurance if you don't have a driver's license, or some homeowners insurance companies won't sell burglary insurance unless you have a home security system. I'd also expect that a well run insurance company would not offer 100% coverage. They'll probably only offer 80-90% coverage, so that companies still have a strong incentive to protect themselves.
FWIW, there was some discussin of these insurance policies on /. in the past. One article pointed out that insurance companies were charging more if a company used Windows than if it ran Linux or a Unix variant because of Windows's inferior security track record. If they're already smart enough to do that, you can bet that they'll be smart enough not to let companies slack off in their efforts to secure their computers after they've bought the insurance.

--
There's no point in questioning authority if you aren't going to listen to the answers.
Re:Wow by patter · 2003-01-28 09:09 · Score: 3, Insightful

The companies, if the insurance leaves them feeling "financially safe" from an attack, will be even less inclined than they are now to implement proper security

Nope. You don't understand much about insurance if you think that :).

I worked in that industry for 5+ years, this is a second/third career for me.

Insurance companies are above all else cautious. They make money by not paying claims. That is not to say they do not pay legitimate ones, they do do that, contrary to popular opinion.

The do however analyse risk, and charge money to their customers to offset the potential payout that risk represents.

I would be willing to bet that a prerequisite for obtaining said 'crack' insurance would be passing an audit by one of their security folks, particularly when obtaining big policies with large potential payouts.

It's no different than fire insurance, if you want a million dollars of fire insurance, they're going to come down, and make sure you're not running an explosives factory in which everyone smokes at their 'station'.

Insurance doesn't encourage sloppiness, in fact, in North America, many of the early fire brigades were sponsored by and run by insurance companies themselves.

Insurers don't want to pay those claims any more than you want to be put out of business by a cracker. They'll ensure you've got an adequate plan, and they'll ease the financial blow, but believe me, what they won't do is let you drop all pretense of security, just because you're insured.

In fact, just before Y2K, the entire industry rushed to put in 'exclusions' -- i.e. they wouldn't pay a penny for Y2K related catastrophes, unless you paid HUGE dollars to them (because they hadn't had the benefit of collecting money for that specific risk).

This is just a sign of the times, Insurance companies are getting more in tune with technology, and likely have a panel of experts they can call on for inspecting/auditing, and assessing claims against that kind of risk.

--
-- If at first you do succeed, try to hide your astonishment. -- Harry F. Banks

Product liability instead by azoidx · 2003-01-28 05:26 · Score: 5, Insightful

what about product liability? automakers, drug manufacturers and every other manufacturer is liable for their products in some way. How come software companies are exempt from this?

Re:Product liability instead by Anonymous Coward · 2003-01-28 05:38 · Score: 5, Insightful

How come software companies are exempt from this?

Because you clicked "Yes, I agree".
Re:Product liability instead by TheTomcat · 2003-01-28 05:43 · Score: 4, Insightful

1) End-User License Agreements (EULAs)
2) We don't REALLY want this. It's incredibly expensive to have crash-tests / drug-tests done; Open Source software would suffer greatly if it was "controlled" in this way.

S

duh! by MissMyNewton · 2003-01-28 05:27 · Score: 5, Insightful

the *best* insurance is a competent admin...

nothing else will do!

--

---

Information wants...you to shut your pie hole.

Hacker vs. Cracker by GuyMannDude · 2003-01-28 05:27 · Score: 5, Insightful

I can see it now: company tries to claim a loss due to having their network compromised.

Insurer: I'm sorry but we have rejected your claim.

Insured: What the hell do you mean? This is why we bought hacker insurance!!

Insurer: Yes, but you bought "hacker" insurance. If you wanted to be reimbursed for a loss like this, you should have bought our "cracker" insurance! But you're in luck! We've got a special offer now! If you buy cracker insurance and already have purchased hacker insurance from us, you will save 10%! I guess today is your lucky day after all!

Insured: You insurance companies are vultures! Profiting off our loss! Well, okay, I don't want to think any more about it. Just sell me whatever insurance you think is best for me.

Insurer: Just what I was hoping you'd say! Sign here, here, and here, please! No, don't bother reading that. It's just a bunch of legal jargon...

GMD

--
watch this

Insurance HA by BJZQ8 · 2003-01-28 05:30 · Score: 3, Insightful

Anybody that would willingly buy insurance is at least half-nuts. If you DO buy insurance and DO get broken into they will send out swarms of "adjusters" and question how this could have happened, and how lax your security must be. Then they will proceed to up your premiums to make back what they paid you for the "damage." So they will end up getting THEIR money anyway. So my advice would be to take that money you would have spent on insurance, and buy a firewall and a decent admin to run it.

mitigating risk by Anonymous Coward · 2003-01-28 05:36 · Score: 4, Insightful

This makes a whole lot of sense, because it allows companies to spread the cost of computer crime over time.

Every company expects numerous break ins, vandalism, data theft, etc.. The problem is that it is hard to budget for this because the value of the damage is different in every case.

Buying insurance for the attacks allows shortfalls in the data crime budget to be covered, and provides benefits for budgeting and tax purposes by increasing stability in the face of constant inevitable loss.

Will this make better security? by WPIDalamar · 2003-01-28 05:37 · Score: 4, Insightful

The article went on to talk about some "hoops" companies must go through to get insured. Some of these hoops included external audits, and assurances that security is important. Perhaps this kind of thing can actually increase security since it gets people higher up (and not the techies) thinking about it.

If you're board of directors tries to get cracker insurance, and the insurance company fails you as being to big of a risk .... I bet that board will step up to the plate for security funding!

Might actually help by AppHack · 2003-01-28 05:38 · Score: 5, Insightful

The interesting thing is that if companies followed the requirements of the insurance company to get the hacker insurance, their security would improve tremendously. Many companies don't even perform the simple tasks the insurance companies will require. That alone would help tremendously.

Ironically, if more companies would conduct assessments, patch vulnerable systems, setup security policies, etc. the demand for this type of insurance might actually diminish. Little chance of that. :-)

More info by jhouserizer · 2003-01-28 05:40 · Score: 3, Insightful

Does anybody know where documentation can be found on how "risk assessment" is done for this type of insurance?

This would be a very interesting way to gauge what software and network hardware an establishment should/should not be using.

It would be very interesting to see where Microsoft products fall in the mix.

Re:But how would they cover the debt.... by PhxBlue · 2003-01-28 05:41 · Score: 5, Insightful

Better yet, how do you even determine the losses? The only science I've seen of it to date is: Company A says, "We lost $x amount when we lost our connection for 2 hours because of this attack," with nothing to back up the dollar figure.

This insurance idea could be a good one, simply because it might force businesses to justify their losses when network attacks occur. I'm not going to hold my breath, though.

--
!#@%*)anks for hanging up the phone, dear.

Insurance? by chunkwhite86 · 2003-01-28 05:46 · Score: 3, Insightful

I see some posts here about insurance cost of Windoze vs. oBSD. oBSD is about as secure as it gets - certainly it's several orders of magnitude stronger than the toys from Redmond. A Logical human would conclude that it should be much cheaper to insure oBSD than Windoze. Not necessarily so...

The problem here, is that Microsoft has already admitted that their products have crap security. What's preventing M$ from opening their own (or buying out another) hacker insurance co. and giving large discounts to Windoze based corporations? Would other corporations stick with a non-M$ operating system if they had to pay double the insurance premium and/or accept reduced coverage?

There is definite potantial for abuse here.

--
I'd rather be a conservative nutjob than a liberal with no nuts and no job.

Re:An analogy by treat · 2003-01-28 06:11 · Score: 3, Insightful

Thats like the story of NASA inventing this hyper-super-duper centrifugally balanced gravity boosting ballpoint pen for their astronauts and the Soviets bringing along a pencil.

I don't know about you, but I wouldn't want bits of (conductive) graphite floating around if *I* were in a space ship.

Bean counters can understand now! by Eric_Cartman_South_P · 2003-01-28 06:12 · Score: 3, Insightful

When the insurance rates for Linux and BSD are less than Windows (surely this will become the case), even managers and bean counters will see which is better. This is good news.

SURELY I would pay less insurance if I'm using all FreeBSD 5.0 boxes vs. Windows NT 4.0 SP1 boxes! Let's see what the rates turn out to be. Again... very good news!

Re:Not a bad idea by pmz · 2003-01-28 07:24 · Score: 3, Insightful

The insurance industry, by charging high-premiums for bad IT management, bad security, bad policy, and bad software, could force companies to improve themselves.

This is how insurance companies can actually act on behalf of the consumers. While personal injury lawyers make insurance companies out to be money-grubbing scum-sucking urine-soaked bug feces, we can't forget that those same insurance companies finance car crash testing and safety reporting for the their own and the public's benefit. We also can't forget it is the insurance companies who can actually challenge run-a-way medical costs for their own and the public's benefit. The same goes for construction (flood plains, building codes, etc.), too.

Insurance companies could be Microsoft's worst nightmare.

--
Healthcare article at Kuro5hin

20 of 175 comments (clear)