[H|Cr]acker Insurance

Spellbinder writes "yahoo has an article on Hacker insurance, also known as "network risk insurance," has been on the market for about three years, but is expected to explode from a $100 million sideshow into a $2.5 billion behemoth by 2005, according to insurance industry projections."

Comments

Wow

[Anonymous Coward]

If they'll pay that much for insurance, I wonder how much they'd pay for a SysAdmin that secures things properly.

Re:Wow

[error0x100]

When a company buys insurance they are 100% guarenteed to recover losses from a crack.

When a company spends that money on an admin, the chance for being broken into goes down, but will never be 0%

Taking out h/crack insurance, then, lowers the incentive for additionally investing in proper network security (e.g. a decent sysadmin). The companies, if the insurance leaves them feeling "financially safe" from an attack, will be even less inclined than they are now to implement proper security. In "normal" insurance, this sort of thing amounts to negligent/deliberate behaviour that in some cases will make the insurer decide not to pay. If enough people leave their networks vulnerable, and the insurers are struggling to stay afloat as a result, then they are going to start getting more strict about the conditions of the insurance vs premiums (as happens in auto insurance, more security features on a car imply general lower risk and thus lower premiums). I don't see why it should be any different here. If companies are making almost no effort whatsoever to secure their networks (as many companies do now), then the insurer either should refuse to cover them, or they should have to pay much larger premiums. (Although then it starts to look like the old "then whats the point of insurance" argument; disability insurance providers in my country routinely refuse to even consider covering people with a medical past that includes things like even very minor back problems. In other words, they will only cover people who do not represent much of a risk at all). However, in the case of 'network insurance', its deliberately irresponsible behaviour that places one in a high risk group (e.g. like smoking).

Re:Wow

[rgmoore]

I bet not as much...

You are most likely wrong. Insurance companies aren't stupid, and they're not going to charge everyone the same rate any more than auto insurance companies charge everyone the same rate regardless of their driving record. They'll give better rates to companies that have good security practices and good track records than ones with bad practices and records. They may even refuse to offer insurance unless the companies follow specified practices; I'd guess that hiring certified administrators would be one required practice. This is similar to the way that insurance companies won't sell you auto insurance if you don't have a driver's license, or some homeowners insurance companies won't sell burglary insurance unless you have a home security system. I'd also expect that a well run insurance company would not offer 100% coverage. They'll probably only offer 80-90% coverage, so that companies still have a strong incentive to protect themselves.

FWIW, there was some discussin of these insurance policies on /. in the past. One article pointed out that insurance companies were charging more if a company used Windows than if it ran Linux or a Unix variant because of Windows's inferior security track record. If they're already smart enough to do that, you can bet that they'll be smart enough not to let companies slack off in their efforts to secure their computers after they've bought the insurance.

Product liability instead

[azoidx]

what about product liability? automakers, drug manufacturers and every other manufacturer is liable for their products in some way. How come software companies are exempt from this?

Re:Product liability instead

[Anonymous Coward]

How come software companies are exempt from this?

Because you clicked "Yes, I agree".

Re:Product liability instead

[TheTomcat]

1) End-User License Agreements (EULAs)
2) We don't REALLY want this. It's incredibly expensive to have crash-tests / drug-tests done; Open Source software would suffer greatly if it was "controlled" in this way.

S

duh!

[MissMyNewton]

the *best* insurance is a competent admin...

nothing else will do!

Hacker vs. Cracker

[GuyMannDude]

I can see it now: company tries to claim a loss due to having their network compromised.

Insurer: I'm sorry but we have rejected your claim.

Insured: What the hell do you mean? This is why we bought hacker insurance!!

Insurer: Yes, but you bought "hacker" insurance. If you wanted to be reimbursed for a loss like this, you should have bought our "cracker" insurance! But you're in luck! We've got a special offer now! If you buy cracker insurance and already have purchased hacker insurance from us, you will save 10%! I guess today is your lucky day after all!

Insured: You insurance companies are vultures! Profiting off our loss! Well, okay, I don't want to think any more about it. Just sell me whatever insurance you think is best for me.

Insurer: Just what I was hoping you'd say! Sign here, here, and here, please! No, don't bother reading that. It's just a bunch of legal jargon...

GMD

mitigating risk

[Anonymous Coward]

This makes a whole lot of sense, because it allows companies to spread the cost of computer crime over time.

Every company expects numerous break ins, vandalism, data theft, etc.. The problem is that it is hard to budget for this because the value of the damage is different in every case.

Buying insurance for the attacks allows shortfalls in the data crime budget to be covered, and provides benefits for budgeting and tax purposes by increasing stability in the face of constant inevitable loss.

Will this make better security?

[WPIDalamar]

The article went on to talk about some "hoops" companies must go through to get insured. Some of these hoops included external audits, and assurances that security is important. Perhaps this kind of thing can actually increase security since it gets people higher up (and not the techies) thinking about it.

If you're board of directors tries to get cracker insurance, and the insurance company fails you as being to big of a risk .... I bet that board will step up to the plate for security funding!

Might actually help

[AppHack]

The interesting thing is that if companies followed the requirements of the insurance company to get the hacker insurance, their security would improve tremendously. Many companies don't even perform the simple tasks the insurance companies will require. That alone would help tremendously.

Ironically, if more companies would conduct assessments, patch vulnerable systems, setup security policies, etc. the demand for this type of insurance might actually diminish. Little chance of that. :-)

Re:But how would they cover the debt....

[PhxBlue]

Better yet, how do you even determine the losses? The only science I've seen of it to date is: Company A says, "We lost $x amount when we lost our connection for 2 hours because of this attack," with nothing to back up the dollar figure.

This insurance idea could be a good one, simply because it might force businesses to justify their losses when network attacks occur. I'm not going to hold my breath, though.