Slashdot Mirror

← Back to Stories (view on slashdot.org)

[H|Cr]acker Insurance

Posted by ryuzaki0 on from the thats-a-lotta-insurance dept.

Spellbinder writes "yahoo has an article on Hacker insurance, also known as "network risk insurance," has been on the market for about three years, but is expected to explode from a $100 million sideshow into a $2.5 billion behemoth by 2005, according to insurance industry projections."

65 of 175 comments (clear)

  1. Wow by Anonymous Coward · · Score: 5, Insightful

    If they'll pay that much for insurance, I wonder how much they'd pay for a SysAdmin that secures things properly.

    1. Re:Wow by WPIDalamar · · Score: 3, Insightful

      I bet not as much... These companies are looking for financial stability. So they make X number of dollars no matter what.

      When a company buys insurance they are 100% guarenteed to recover losses from a crack.

      When a company spends that money on an admin, the chance for being broken into goes down, but will never be 0%

      Disclaimer: This assumes the company negotiates a "good" insurance contract, and fullfills all of their requirements.

    2. Re:Wow by error0x100 · · Score: 5, Insightful

      When a company buys insurance they are 100% guarenteed to recover losses from a crack.

      When a company spends that money on an admin, the chance for being broken into goes down, but will never be 0%

      Taking out h/crack insurance, then, lowers the incentive for additionally investing in proper network security (e.g. a decent sysadmin). The companies, if the insurance leaves them feeling "financially safe" from an attack, will be even less inclined than they are now to implement proper security. In "normal" insurance, this sort of thing amounts to negligent/deliberate behaviour that in some cases will make the insurer decide not to pay. If enough people leave their networks vulnerable, and the insurers are struggling to stay afloat as a result, then they are going to start getting more strict about the conditions of the insurance vs premiums (as happens in auto insurance, more security features on a car imply general lower risk and thus lower premiums). I don't see why it should be any different here. If companies are making almost no effort whatsoever to secure their networks (as many companies do now), then the insurer either should refuse to cover them, or they should have to pay much larger premiums. (Although then it starts to look like the old "then whats the point of insurance" argument; disability insurance providers in my country routinely refuse to even consider covering people with a medical past that includes things like even very minor back problems. In other words, they will only cover people who do not represent much of a risk at all). However, in the case of 'network insurance', its deliberately irresponsible behaviour that places one in a high risk group (e.g. like smoking).

    3. Re:Wow by Tackhead · · Score: 2, Insightful
      > If they'll pay that much for insurance, I wonder how much they'd pay for a SysAdmin that secures things properly.

      These are PHBs we're talking about.

      The answer is "$35,000, and $36,000 if he has an MCSE".

    4. Re:Wow by rgmoore · · Score: 4, Insightful
      I bet not as much...

      You are most likely wrong. Insurance companies aren't stupid, and they're not going to charge everyone the same rate any more than auto insurance companies charge everyone the same rate regardless of their driving record. They'll give better rates to companies that have good security practices and good track records than ones with bad practices and records. They may even refuse to offer insurance unless the companies follow specified practices; I'd guess that hiring certified administrators would be one required practice. This is similar to the way that insurance companies won't sell you auto insurance if you don't have a driver's license, or some homeowners insurance companies won't sell burglary insurance unless you have a home security system. I'd also expect that a well run insurance company would not offer 100% coverage. They'll probably only offer 80-90% coverage, so that companies still have a strong incentive to protect themselves.

      FWIW, there was some discussin of these insurance policies on /. in the past. One article pointed out that insurance companies were charging more if a company used Windows than if it ran Linux or a Unix variant because of Windows's inferior security track record. If they're already smart enough to do that, you can bet that they'll be smart enough not to let companies slack off in their efforts to secure their computers after they've bought the insurance.

      --

      There's no point in questioning authority if you aren't going to listen to the answers.

    5. Re:Wow by patter · · Score: 3, Insightful

      The companies, if the insurance leaves them feeling "financially safe" from an attack, will be even less inclined than they are now to implement proper security

      Nope. You don't understand much about insurance if you think that :).

      I worked in that industry for 5+ years, this is a second/third career for me.

      Insurance companies are above all else cautious. They make money by not paying claims. That is not to say they do not pay legitimate ones, they do do that, contrary to popular opinion.

      The do however analyse risk, and charge money to their customers to offset the potential payout that risk represents.

      I would be willing to bet that a prerequisite for obtaining said 'crack' insurance would be passing an audit by one of their security folks, particularly when obtaining big policies with large potential payouts.

      It's no different than fire insurance, if you want a million dollars of fire insurance, they're going to come down, and make sure you're not running an explosives factory in which everyone smokes at their 'station'.

      Insurance doesn't encourage sloppiness, in fact, in North America, many of the early fire brigades were sponsored by and run by insurance companies themselves.

      Insurers don't want to pay those claims any more than you want to be put out of business by a cracker. They'll ensure you've got an adequate plan, and they'll ease the financial blow, but believe me, what they won't do is let you drop all pretense of security, just because you're insured.

      In fact, just before Y2K, the entire industry rushed to put in 'exclusions' -- i.e. they wouldn't pay a penny for Y2K related catastrophes, unless you paid HUGE dollars to them (because they hadn't had the benefit of collecting money for that specific risk).

      This is just a sign of the times, Insurance companies are getting more in tune with technology, and likely have a panel of experts they can call on for inspecting/auditing, and assessing claims against that kind of risk.

      --
      -- If at first you do succeed, try to hide your astonishment. -- Harry F. Banks
    6. Re:Wow by ChrisTaylor2904 · · Score: 2, Informative
      I'm an actuary by training, and we call this issue "moral hazard".

      One of the best ways to reduce the risk to the insurance company is to introduce "self-insurance" where the customer has claim to bear some of the cost of any claim - like the excess on your car insurance policy. For these policies, the customer's probably liable for something like the first $5 or $10 million of any claim.

      I'd also expect the insurance company to follow up any large claims with another audit, to see if any of the security controls and procedures had become lax since the time the policy was taken out, and there'll be a standard clause to reduce/invalidate the claim if anything's found in this audit.

  2. Risks... by Corporate+Troll · · Score: 2, Funny

    If running Microsoft SQL Server 2000 or IIS.... augment risk with 1000%.

    1. Re:Risks... by capt.Hij · · Score: 2, Funny

      Running Redhat without advanced server: augment risk 500% unless you upgrade more than once a year and drive your sysadmins nuts.

    2. Re:Risks... by Anonymous Coward · · Score: 2, Insightful

      *cough* he said *pretty*, not *coked-out*, that being said This looks as though it is still fairly half-baked at this stage, concidering how the article states first the client needs to pony up for an independant security probe (read bend over and take it to the tune of $50,000), and the pay outs are only about 25 to 1 .... christ I can get car liability insurance of a quarter million for just over a grand annually.... in New Jersey! and finally apparently all of that cash seems to be used for throwing into the mouth of a hungry fire considering how often certain attacks will be deemed unisurable. I repeat not yet ready for prime time.

  3. But how would they cover the debt.... by Anonymous Coward · · Score: 5, Interesting

    if everyones site went down - as it almost did with the latestVuln in MSSQL - how would anyone ever cover the losses?

    fp

    1. Re:But how would they cover the debt.... by PhxBlue · · Score: 5, Insightful

      Better yet, how do you even determine the losses? The only science I've seen of it to date is: Company A says, "We lost $x amount when we lost our connection for 2 hours because of this attack," with nothing to back up the dollar figure.

      This insurance idea could be a good one, simply because it might force businesses to justify their losses when network attacks occur. I'm not going to hold my breath, though.

      --
      !#@%*)anks for hanging up the phone, dear.
    2. Re:But how would they cover the debt.... by bleckywelcky · · Score: 2, Insightful


      Although I do agree with you that whenever someone's systems or networks go down they start throwing around random numbers indicating their losses, it would be pretty easy to calculate the loss to a relative accuracy. Just get all the numbers for the amount of business done during that period using the systems that are down and average to the time period that the systems were down. Say company XYZ does business through a phone system and a website. Say they make $730 dollars a year and that $365 of that come from the phone system and $365 of that comes from the website. Now, say the website goes down for a single normal business day (not some holiday or otherwise, just a random normal day) and that normally their website is up 24/7/365.

      Loss = ($365/year)*(1 year/365 days) = $1/day on average So, they lost $1 for that single day.

      Now, for example, let's say that this is the company Dell. From Aug 2, 2001 to Aug 2, 2002 Dell took in revenues equalling $32.054 Billion. So, they bring in ($32.054)/(365) = $0.087819 Billion per day, or $87.819 Million in one day. Now, let's approximate that %50 of that is from various computer networks (kiosks at office stores, home users online, business users online, etc) and %50 is from their phone systems (I really have no idea as I could not find any actual percentages). That means that if Dell's networks all went down for a single day, they would lose $43.910 Million in sales.

      The really hard part is estimating how network slow downs effect the business. But then again you could just see what the average expected sales for that day were and then what the actual sales for that day were and find the difference. If you have some data, statistics can handle the rest. But it sure does seem like some of these CEOs pull numbers out of their arses and throw them around to get sympathy or something. :\

    3. Re:But how would they cover the debt.... by bmajik · · Score: 2, Insightful

      Good question.

      This is what actuaries do. They determine how to make money off of policies, they determine risk exposure and how to mitigate that risk, etc etc.

      To have an actuary that could successfully do a plausible job at this, you'd need one that was a computer security and loss expert.

      My father was the youngest person to become an FSA (Fellow of the Society of Actuaries) and last year was the Computer Science chairperson for the SOA (Society of Actuaries).

      As both an accomplished actuary (to say the least) and an accomplished computerphile (are you fluent in 360 assembler ?) i feel like he's pretty well versed to speak on this matter.

      I can tell you quite confidently that the cross section of actuaries, and people who are computer security experts in the united states is roughly:

      0 persons.

      When the "hacker insurance costs more for IIS" article came out a year ago i talked it over with my dad. He said it was, "bullshit", and went into a small rant about how ridiculous and sensationalist it was.

      --
      My opinions are my own, and do not necessarily represent those of my employer.
  4. Product liability instead by azoidx · · Score: 5, Insightful

    what about product liability? automakers, drug manufacturers and every other manufacturer is liable for their products in some way. How come software companies are exempt from this?

    1. Re:Product liability instead by Anonymous Coward · · Score: 5, Insightful

      How come software companies are exempt from this?

      Because you clicked "Yes, I agree".

    2. Re:Product liability instead by phorm · · Score: 2, Informative

      Automotive: Your car crashes due to a defect, you die
      Drugs (medical): Your pharmacist doesn't check to find that the drug prescribed is something you're listed as being highly allergic to, you die.

      SQL Server crashes: You lose money, you require stress leave, but in most cases it isn't life or death.

    3. Re:Product liability instead by Anonymous Coward · · Score: 2, Insightful

      If someone steals a F-150 and runs over a person, is Ford liable? If someone takes 50 valium, can the drug company be sued? People are taking an existing product, and vandalizing it to cause damage to someone else. The person who should be sued is the perp not the oem.

    4. Re:Product liability instead by ramas · · Score: 2, Interesting

      I am just curious here and therefore my question here must be seen in that context. In the case of the slammer worm and with various other virus related incidents, the victim has almost always been shrink wrapped, standard off-the-shelf products (even if one includes operating systems in this league). So the argument could go that product liability is inappropriate because here you were given a tool if you like and its up to you to do what you wanted with it. Yes I admit that fundamental flaws should not be present but I am not sure if I am on terra firma on that ground alone.

      Anyway, now what about bespoke software of the kind that runs banking systems? Surely there is a leap of faith here. When a company commissions software from another firm, apart from contractual agreements are there any standard practices that one can quote here to say this is how the industry handles the risk arising out of product defects that could potentially knock the person out of business or worse liable for external damages too?

      --
      - ramas opines !!
    5. Re:Product liability instead by TheTomcat · · Score: 4, Insightful

      1) End-User License Agreements (EULAs)
      2) We don't REALLY want this. It's incredibly expensive to have crash-tests / drug-tests done; Open Source software would suffer greatly if it was "controlled" in this way.

      S

    6. Re:Product liability instead by jackdoodle · · Score: 2, Informative

      I completely agree...and insurance is likely one of the best ways to force this sort of responsibility. Bruce Schneier (quoted in the article) has been talking about this for a long time; his monthly newsletter addresses the subject at reasonable length, in the section "Liability and Security", from his April CryptoGram. http://www.counterpane.com/crypto-gram-0204.html

  5. duh! by MissMyNewton · · Score: 5, Insightful

    the *best* insurance is a competent admin...

    nothing else will do!

    --

    ---

    Information wants...you to shut your pie hole.

    1. Re:duh! by B3ryllium · · Score: 4, Funny

      The "best" car insurance is a Hum-Vee.

    2. Re:duh! by B3ryllium · · Score: 2, Funny

      See?

    3. Re:duh! by berzerke · · Score: 4, Interesting

      ... the *best* insurance is a competent admin...



      No, the best insurance is a competent admin and management that gives him the support he needs and listens to him (or her).



      I speak from experience. At a company I used to work for, the "business manager" decided that connecting a server (admininstered by another company, I couldn't legally touch it) with NO root password (AIX, BTW) to a modem anyone could dial into (no logging either) was a good idea. I objected, in writing, but was overruled.



      It was about a week before the hard drive suddenly went blank. The company administring it said it was a bad hard drive. I disagreed, and said someone had broken into it. Again, I was overruled, and they replaced the hard drive and restored the system from the last system backup (charging about $800 for this service). They put the modem back online.



      Exactly a month later, same thing. This time the company says it's a bad controller card (and again won't listen to me). The company claimed it would take a very sophisicated attack to do what was happening. Apparently, they never heard of cron and "rm -rf /*"! Anyway, again they restored the last system backup (not checking anything either; I watched). Another bill (unknown amount).



      Month 3, same time, same blank hard drive. Now they belived me and did an install off known good media. They refused scan the data backups for leftovers though. Fortunately, it doesn't appear like the visitor left anything there. The business manager also finally gave the ok to disconnect the modem.



      They eventually did reimburse for some of the bills for non-faulty equipment, but the billing department (it was "their" server) was down for about 7 days. I have no idea how much that cost.



      The best admin in the world can't protect squat if management ties his (or her) hands.

    4. Re:duh! by sean23007 · · Score: 2, Funny

      Well, you could have logged in and changed the root password...

      --

      Lack of eloquence does not denote lack of intelligence, though they often coincide.
  6. Hacker vs. Cracker by GuyMannDude · · Score: 5, Insightful

    I can see it now: company tries to claim a loss due to having their network compromised.

    Insurer: I'm sorry but we have rejected your claim.

    Insured: What the hell do you mean? This is why we bought hacker insurance!!

    Insurer: Yes, but you bought "hacker" insurance. If you wanted to be reimbursed for a loss like this, you should have bought our "cracker" insurance! But you're in luck! We've got a special offer now! If you buy cracker insurance and already have purchased hacker insurance from us, you will save 10%! I guess today is your lucky day after all!

    Insured: You insurance companies are vultures! Profiting off our loss! Well, okay, I don't want to think any more about it. Just sell me whatever insurance you think is best for me.

    Insurer: Just what I was hoping you'd say! Sign here, here, and here, please! No, don't bother reading that. It's just a bunch of legal jargon...

    GMD

    --
    watch this
  7. curious ... by Anonymous Coward · · Score: 2, Insightful

    Would there be a higher premium for those running a Microsoft OS vs. oBSD?

  8. Insurance HA by BJZQ8 · · Score: 3, Insightful

    Anybody that would willingly buy insurance is at least half-nuts. If you DO buy insurance and DO get broken into they will send out swarms of "adjusters" and question how this could have happened, and how lax your security must be. Then they will proceed to up your premiums to make back what they paid you for the "damage." So they will end up getting THEIR money anyway. So my advice would be to take that money you would have spent on insurance, and buy a firewall and a decent admin to run it.

  9. Do they cover your bandwidth bill too? by Stephenmg · · Score: 5, Interesting

    Do they cover your bandwidth bill when some random infected virus sends packets to your secured site even if you dont get infected?

  10. problem by io333 · · Score: 2, Funny

    [I] [T]hink [Y]ou [M]ay [H]ave [A] [C]opywright [V]iolation [I]n [T]he [F]irst [L]ine [O]f [T]he [S]tory?

  11. An analogy by thesilverbail · · Score: 5, Funny

    Thats like the story of NASA inventing this hyper-super-duper centrifugally balanced gravity boosting ballpoint pen for their astronauts and the Soviets bringing along a pencil.

    --
    I have found a truly wonderful proof of Fermat's Last Theorem, but unfortunately this sig is too small to contain it.
    1. Re:An analogy by ajakk · · Score: 4, Informative

      The important word there is story, considering this is false. Snopes

      --
      Come play Heroes of Might and Magic Mini online.
    2. Re:An analogy by treat · · Score: 3, Insightful
      Thats like the story of NASA inventing this hyper-super-duper centrifugally balanced gravity boosting ballpoint pen for their astronauts and the Soviets bringing along a pencil.

      I don't know about you, but I wouldn't want bits of (conductive) graphite floating around if *I* were in a space ship.

  12. Hartford Steam Boiler Insurance covers this by Animats · · Score: 4, Interesting
    The Hartford Steam Boiler Insurance Company offers insurance against computer breakdowns for a wide variety of reasons. Their business is insuring companies against mechanical failures. They started out with steam engines (hence the name) but the business has grown.

    Hartford Steam Boiler offers good rates, but requires intrusive inspections. Before they insure something, they inspect and provide a list of things they want fixed. Then they inspect again, after the problems are fixed. Only then will they provide insurance coverage. They then have the right to inspect at any time, and they use it.

    This works great for steam boilers (where they have great expertise) but they haven't tried to expand much out of their niche. Even though they do cover some computers, they're still mostly focused on boilers. It's good that others are now moving in that direction.

    This is the right approach. When Hartford Steam Boiler started in 1866, steam boilers blew up regularly. Within a few years, boilers insured by Hartford Steam Boiler weren't blowing up. A similar approach may eliminate computer crashes as a major problem. The day may well come when you can't buy insurance because you have an insecure OS on the premises.

  13. mitigating risk by Anonymous Coward · · Score: 4, Insightful

    This makes a whole lot of sense, because it allows companies to spread the cost of computer crime over time.

    Every company expects numerous break ins, vandalism, data theft, etc.. The problem is that it is hard to budget for this because the value of the damage is different in every case.

    Buying insurance for the attacks allows shortfalls in the data crime budget to be covered, and provides benefits for budgeting and tax purposes by increasing stability in the face of constant inevitable loss.

  14. What a great idea. I can see it now. by Kenja · · Score: 4, Funny

    Guido: Nice network you gots here, it would be a shame if something where to happen to it.
    Customer: What do you mean?
    Nunzio: You know, accidents, like your customer records being posted on slashdot. Accidents happen you know.
    Guido: But your in luck, my brother and me can, for a small fee, grantee your network wont be hacked by disreputable people like us. Think of it as "insurance".

    --

    "Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
    1. Re:What a great idea. I can see it now. by Skevin · · Score: 4, Funny

      Wouldn't their names actually be Gu1d0 and Nunzzz10?

      Solomon

      --
      "Twice half-assed makes an ass whole." --Solomon K. Chang
  15. Not a bad idea by Anonymous Coward · · Score: 5, Interesting

    Car insurance is cheaper if you have an ignition disabler, and other anti-theft features.

    If companies actually buy cracking insurance, they will want to get it at a low price.

    The insurance industry, by charging high-premiums for bad IT management, bad security, bad policy, and bad software, could force companies to improve themselves.

    How high are the premiums on MS SQL 2000?

    You could clearly point to the insurance premiums and show how much bad security is costing the company.

    1. Re:Not a bad idea by pmz · · Score: 3, Insightful

      The insurance industry, by charging high-premiums for bad IT management, bad security, bad policy, and bad software, could force companies to improve themselves.

      This is how insurance companies can actually act on behalf of the consumers. While personal injury lawyers make insurance companies out to be money-grubbing scum-sucking urine-soaked bug feces, we can't forget that those same insurance companies finance car crash testing and safety reporting for the their own and the public's benefit. We also can't forget it is the insurance companies who can actually challenge run-a-way medical costs for their own and the public's benefit. The same goes for construction (flood plains, building codes, etc.), too.

      Insurance companies could be Microsoft's worst nightmare.

      --
      Healthcare article at Kuro5hin
  16. Will this make better security? by WPIDalamar · · Score: 4, Insightful

    The article went on to talk about some "hoops" companies must go through to get insured. Some of these hoops included external audits, and assurances that security is important. Perhaps this kind of thing can actually increase security since it gets people higher up (and not the techies) thinking about it.

    If you're board of directors tries to get cracker insurance, and the insurance company fails you as being to big of a risk .... I bet that board will step up to the plate for security funding!

  17. Might actually help by AppHack · · Score: 5, Insightful

    The interesting thing is that if companies followed the requirements of the insurance company to get the hacker insurance, their security would improve tremendously. Many companies don't even perform the simple tasks the insurance companies will require. That alone would help tremendously.

    Ironically, if more companies would conduct assessments, patch vulnerable systems, setup security policies, etc. the demand for this type of insurance might actually diminish. Little chance of that. :-)

    1. Re:Might actually help by marko123 · · Score: 2, Insightful

      Excellent point. Home contents insurance is a good example of this. Minimum requirements in Australia are proper locks on doors and windows (hint, hint, MS). They expect you to deter the basic burglar attacks by doing things that you might not if you didn't care about insurance. You also get a discount with some brokers if you have an alarm system installed. This analogy applies well to networks.

      --
      http://pcblues.com - Digits and Wood
    2. Re:Might actually help by sunwukong · · Score: 2, Interesting

      Speaking of home insurance, I just received my annual assessment and the new clauses explicitly exclude any damages due to "cyber attacks", i.e., hacking or net downtime, etc.

  18. More info by jhouserizer · · Score: 3, Insightful

    Does anybody know where documentation can be found on how "risk assessment" is done for this type of insurance?

    This would be a very interesting way to gauge what software and network hardware an establishment should/should not be using.

    It would be very interesting to see where Microsoft products fall in the mix.

    1. Re:More info by Anonymous Coward · · Score: 4, Informative

      SANS Institute lists those providing such insurance, so you could contact the companies directly, but one arrangement with Lloyd's of London makes it cheaper for Counterpane Security customers, see link at the bottom. Here's the Sans info:

      http://www.sans.org/rr/casestudies/insurance.php

      Who Provides Hacker's
      Insurance

      Providing insurance for cyber loss is a new industry. Most insurance
      carriers do not have the necessary expertise or tools to adequately
      assess the needed coverage. As a result, there are currently only a few
      companies offering hacker's insurance. However, with the financial
      losses continuing to escalate, the demand for this protection will also
      increase.

      Lloyd's of London has created an insurance product that incorporates
      elements of crime coverage and property coverage, addressing specific
      exposures faced in our computer age.

      The product, Computer Information & Data Security Insurance (CIDSI),
      combines theft and malicious damage protection coupled with business
      interruption coverage. CIDSI further provides expert computer security
      surveying and loss control services to mitigate exposures and losses.
      The product is a comprehensive program that can help address significant
      exposures.

      Other vendors of computer crime insurance include:

      * Internet Security Systems (www.iss.net)
      * Counterpane
      (www.counterpane.com)
      * J.S. Wurzler Website Insurance & Security
      (www.jswum.com)
      * Axent Technologies (www.axent.com)
      * Insuretrust.com
      LLC (www.insuretrust.com)
      * Ace Ltd. (www.acelimited.com)

      Cost

      Liability is still difficult to calculate. An example of one method for
      calculations is to average a Web site's revenue over several months and
      divide for an estimate of the hourly cost of downtime. However, this
      calculation doesn't consider account traffic and potential customers
      lost as the result of service interruption.

      Insurers typically determine policy costs according to the company's
      size, the volume of business a company conducts on the Web, and the
      effectiveness of company's security policy. Some insurers offer a
      discount if you have an affiliation with certified information security
      experts.

      Policies can carry premiums starting at $7,000 all the way to $3 million
      dollars. Lloyd's of London has recently announced a policy to cover up
      to $100 million dollars but the price of the premium has to be
      negotiated specifically with Lloyd's.

      What to look for in a policy is addressed here:
      http://216.239.53.100/search?q=cache:nLr6A8 YsCgcC: practice.findlaw.com/
      worldbeat-1202.html+%22hack er+insurance%22&hl=en&i e=UTF-8

      Counterpane customers can get it cheaper through an arrangement with Lloyd's of
      London because they are their customers:

      http://www.counterpane.com/pr-lloydsqa.html

  19. Force majeure? by GQuon · · Score: 2, Insightful

    One solution could be to declare it a result of force majeure: "An act of God", an event that could never be anticipated. Somehow I don't believe that would hold up in court.
    The good thing about cracker insurance, is that the insurance companies will impose terms that the insured parties have to comply with. And they can give discounts on premiums if some measures are taken by the insured. How about a 10% discount for switching from Windows to a secure system ;-)

    --
    Irene KHAAAAAAN!
  20. How do they pro-rate it? by grub · · Score: 2, Interesting


    Would a firm get a break on their insurance if they ran 100 OpenBSD servers rather than 100 Windows servers or do they view a box as a box as a box?

    --
    Trolling is a art,
  21. There is an easier way by mao+che+minh · · Score: 2, Interesting
    Companies seem to be using this insurance option partly for peace of mind. Peace of mind, to me, would be more easily obtained (and for far less money) by simply dumping your insecure operating systems and services in favor of more flexible systems which are not commonly targeted and easier to secure.

    This reduces total overhead by removing the license fees associated with Windows, SQL, and Exchange, and eliminates the need for expensive insurance options. The money saved could be used to hire a qualified network security person in-house.

  22. Insurance? by chunkwhite86 · · Score: 3, Insightful

    I see some posts here about insurance cost of Windoze vs. oBSD. oBSD is about as secure as it gets - certainly it's several orders of magnitude stronger than the toys from Redmond. A Logical human would conclude that it should be much cheaper to insure oBSD than Windoze. Not necessarily so...

    The problem here, is that Microsoft has already admitted that their products have crap security. What's preventing M$ from opening their own (or buying out another) hacker insurance co. and giving large discounts to Windoze based corporations? Would other corporations stick with a non-M$ operating system if they had to pay double the insurance premium and/or accept reduced coverage?

    There is definite potantial for abuse here.

    --
    I'd rather be a conservative nutjob than a liberal with no nuts and no job.
    1. Re:Insurance? by WPIDalamar · · Score: 4, Informative

      well.. duh... someone has to pay the claims

      If MS offers huge discounts for windows insurance, then the would loose GOBS of money when it comes time to pay out those insurance claims. I'm guessing the profit margin on insurance generally isn't as big as it is on software! They would essentially have to pay for their own bugs.

  23. More insurance. by eniu!uine · · Score: 2, Funny

    How about slashdot insurance?

    --
    My Blog
  24. Stock-buying time. by _RidG_ · · Score: 2, Interesting

    "...but is expected to explode from a $100 million sideshow into a $2.5 billion behemoth by 2005..."

    Even taking these predictions with a rather large grain of salt, this is still fairly impressive. Might be a good time to look into putting your money into (gasp!) the stock market?

    --


    "The power of accurate observation is frequently called cynicism by those who don't have it." - G.B. Shaw
  25. How do you judge a products security. by Neophytus · · Score: 2, Interesting

    'Mainstream' servers like IIS and Apache will have their flaws documentation within days, perhaps hours, of being discovered. This will make insurance on servers like this easier to judge. What about a home-brew image server? Or an obscure small scale database from sourceforge.
    Auditing and insuring as apropriate for these applications would be a slow and tricky process (the cynic in me says it is yet another business oppertunity) as many thousands of apps would have to be tested and rated on an insurance-risk-table - if you do want to be insured from this so called 'h/cracker threat' it isn't going to come cheap.

  26. [H|Cr]acker? by cheesyfru · · Score: 4, Funny

    I know what a hacker is, but what is a "cacker" or a "racker"?

    (simple regular expression bugs in article titles explain a lot about why Slash is the way it is)

    --
    Josh Woodward
  27. *nix flavors are vulnerable too by mmuskratt · · Score: 4, Interesting

    OK M$ bashies, enough. One word, "bugtraq."

    The issue here is really interesting. Do you think that by patching systems, and by going through security testing, the premiums for this type of insurance will go down? How do you determine a financial settlement (Kevin Mittnick allegedly cost several companies billions of dollars in damage, blah blah blah)? Will this make security teams wealthy and sysadmins better?

    Furthermore, the article says that this type of insurance has been around for 3 years now, but I didn't get a hit when I typed in "network risk insurance" into Google...who is providing this?

    Sounds like a scam I'd like to be a part of...

    --
    man rtfm
  28. YES! STEP 2 IS REALIZED! by Eric_Cartman_South_P · · Score: 3, Funny
    1) Collect Insurance Policies

    2) H@x0r 127.0.0.1

    3) Profit!

  29. Bean counters can understand now! by Eric_Cartman_South_P · · Score: 3, Insightful
    When the insurance rates for Linux and BSD are less than Windows (surely this will become the case), even managers and bean counters will see which is better. This is good news.

    SURELY I would pay less insurance if I'm using all FreeBSD 5.0 boxes vs. Windows NT 4.0 SP1 boxes! Let's see what the rates turn out to be. Again... very good news!

  30. INSURANCE DENIED by Anonymous Coward · · Score: 2, Funny

    you are running M$ software so there is a pre-existing condition.

    sorry.

  31. a115tat3 by floppy+ears · · Score: 2, Funny

    Ah, maybe that explains why I keep getting hacked by some l33t dude called a115tat3.

    --

    "If I could live to be several hundred
    I could take a walk and really wander, really wonder."
  32. DDOS Flood insurance by bareman · · Score: 2, Interesting

    and don't forget to get your DDOS flood insurance coverage too.

  33. Not to be anal, but... by mikecarrmikecarr · · Score: 4, Interesting

    The article title reads [H|Cr]acker Insurance

    This regex works but I don't think it works for the reasons that the author intended. For example,

    The [H|Cr] is a character class matching the single character H, C, r or |.

    So this regex will match Hacker Insurance, and Cracker Insurance (bolding indicates what part of the word matches)... it will also match |acker Insurance

    I wouldn't normally be so anal but the title involves hackers/crackers... you'd think you'd get the logic right, no?

    I would humbly suggest the regex (H|Cr)acker Insurance

    If the author was intending some weird regex syntax where [] indicates something other than a character class then I apologize in advance,

    --

    ID-10-T is a way of life

  34. Re:First lame insurance post. by Tackhead · · Score: 3, Interesting
    > Imagine what we as a society could do with the billions and billions we piss away on vapor products like insurance if we spent it on something that benefits society in a tangible way like health care, or replacing our crumbling infrastructure.

    Imagine the billions and billions we wouldn't have to piss away on insurance if we clamped down on the trial lawyers.

    When a medical malpractice suit can cost $100M, a doctor can't afford to diagnose a common cold without malpractice insurance.

    And when that lawsuit can cost his malpractice insurance company $100M, no insurance company is going to write a policy unless your doctor pays $100K/year in premiums.

    And when your doctor's paying $100K/year in premiums, is it any wonder that he charges you $100 to diagnose a common cold?

    Gee, when it costs you $100 to get a common cold diagnosed, anyone with sprog can't afford to get medical care... without insurance. (Gee, what a coincidence :)

    We need to break the trial lawyers by putting caps on the Landshark Lottery.

  35. This Has To Be A HUGE Scam by SirCodeAlot · · Score: 2, Interesting

    I predict every claim will be turned down, under the guise of a preexisisting condition. If the admin can't secure the sytem, they certainly won't be able to prove the system was clean before purchasing insurance.

  36. My favorite part of the article is.. by z_gringo · · Score: 2, Interesting

    Where the CTO for Counterpane Internet Security says:
    "I believe that within a few years hacking insurance will be ubiquitous," Schneier said. "The notion that you must rely on prevention is just as stupid as building a brick wall around your house. That notion is just wrong."

    Uh, my house has brick walls on all sides for that very purpose..

    I guess he is saying that now we should all just forget about applying patches, and installing firewalls. We should just buy insurance for when we get hacked.

    --
    -- -- Warning. Do not stare directly at the sun.