Slashdot Mirror
Cyber Insurance Between the Lines
Shackleford writes "Security Focus has an article that discusses insurance policies regarding 'computer attacks and cyber sabotage.' It discusses a case in which an administrator who set up back doors in the system with which he was trusted deleted files to which he could access after he was fired. His company had insurance against dishonest acts by employees, but not against 'acts of destruction.' Eventaully, the company won, but the case went to litigation. So the lesson to be learned here is that your company may have 'cyber insurance' without knowing it, but you need to be sure about it."
If you're the system god, would this violate the insurance policy?
If you can't trust a bloodsucking insurance company who can you trust...
Gibble: Descriptive of an emotional state in which one's mind is scrabbling for some purchase on reality
It discusses a case in which an administrator who set up back doors in the system with which he was trusted deleted files to which he could access after he was fired.
What is that sentence supposed to mean? Use a freaking comma!
Yeesh.
------
Where are the slash-groupies? I distinctly remember being promised slash-groupies!
Always wanted to know this. I am a sysadmin for a College (i'm a student there), and I always leave a backdoor or two in case of emergencies. like someome else chaniging the root passwords etc. Does anyone else do this, or is it just me?
Fantastic. And with litigation costs to boot.
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
Obligatory link to The Bastard Operator from Hell page.
It's better to secure the system to prevent unauthorized root password changes than to add security vulnerabilities in case.
Don't leave backdoors in the system, burn the place down. It's harder to trace back..
Trolling is a art,
I'm sure this is an over simplification, but if the insurance was for dishonest acts by employees, how could the company win? This act was comitted by someone who was no longer an employee...
Insurance is one of the biggest vains the U.S. is facing today. You name it, car insurance, workman's comp, homeowners, cyber, etc.
Beside's it being legalized gambling, whenever something does happen, these companies try to get out of paying and point fingers at fraud.
There has to be a better way.
P.S. Is it this bad in other parts of the world, or are there "better systems" in place?
Or, after changing his somewhat peculiar syntax: It discusses a case in which an administrator, who had set up back doors in the system with which he was trusted, deleted files after he was fired.
Hey, the imprtant thing is no its/it's errors...
What I'm listening to now on Pandora...
It's simple, if any of the above events have occurred, plan to move on and if your company has purchased anti-employee insurance, it's time to het the hell out anyway.
--CTH
--Got Lists? | Top 95 Star Wars Line
Hey.. you behind da keyboard. You need protection.. Things happen. Hard disks crash, software breaks, monitors get shot.. err.. dey break too.
Trolling is a art,
1. Start a shell company that does computer consulting /. hackers
2. Buy computer equipment
3. Buy lots of computer sabotage insurance
4. Hire a lot of
5. Sit back and wait to collect.
It sounded like a good idea at the time, all except for the orange pajama part.
Use your head, can't you, use your head,
You're on earth, there's no cure for that - S. Beckett
I guess the lesson here is to read the fine print. The important thing to look for here is when the "dishonest employee" commits their dishonesty. From a logical standpoint, any malicious acts committed through the back-door should be covered by the insurance, merely because the back-door only existed because of dishonesty. But I'm sure the insurance company tried to argue, and support with the fine print, that the actual exploitation was the dishonest act, and occurred only after the employee was fired.
Here's something to make you think: what would happen if the dishonest employee created the backdoor, quit, and someone else from outside the company exploited the back door? Then who would have won? I'd love to examine the actual insurance policy to find out.
Here is an earlier article on this exact subject
"Cyber-insurance comes into its own
His company had insurance against dishonest acts by employees
They should have bought insurance against dishonest acts by the insurance company.
-- Repeat with me: "There is no right to profits".
a world in progress...
I wouldn't be surprised if this kind of thing happens a lot over the next little while, until insurance companies (and in particular, the actuaries) can get their heads around the liability associated with network security.
As a developer in the security industry, I look on this as great news. I've been saying for a long time that what data security companies really need is for the insurance companies to start tying premiums to security infrastructure. When that happens there will be a clear ROI on security investment, and companies will learn quickly how to cover their asses better from these kinds of vulnerabilities.
Situations like this motivate the insurance companies to start assessing risk, and when they start assessing risk they start charging their customers for it, and when the customers are getting charged for it they start mitigating that risk. Right now, that just isn't happening.
Since when is the article summary off-topic?
Besides the fact that gambling hasn't been illegal in many places for decades, this comparison really irks.
Insurance is about the *spread of risk*. If one in every 100 houses burns down every year, then everyone pays 1/100 of the cost of a new house annually. No single homeowner is burdened with the cost of a new house, but everyone pays a little to protect their investment.
Insurance, simply, is putting in something small on the off chance something bad happens that would otherwise cost you money. Gambling, on the other hand, is putting in something small, on the slight chance that you may come out of it with more than you put in. Yes, there is a difference. Mainly, in that insurance is not, and never has been, intended as a way to make money - only to help you not lose it.
As for insurance companies trying to 'get out of paying', you should know that by far, most claims get paid without question, once reasonable proof of loss is put forth by the insured (in Canada we're at something over 90% of all claims are not challenged). Fraud statistics, on the other hand, show anywhere from 10-50% (depends on who you ask) of all insurance claims are either bogus or inflated. Personally, I'm very happy that my insurance company investigates suspicious claims - it keeps my premiums down for when I actually DO need to use it.
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
It's worth asking your insurance company whether they'll pay for losses from destruction of data. The bits on the media are almost certainly more valuable than the physical media. "Computers and media" coverage might not necessarily cover data erasures or alterations. A restore from backup could cost serious money even with no physical damage.
Bah! This is just money and some gibberish files. Accounting lies, marketing hype, and that all so useful "boss memo" action. Who cares? What you NEVAR want to do is to whizz off or fire the admin who can leave the electric fences turned off in your monster island Jurrasic Park and YOU can't turn them back on. Now THAT is a dangerous "back door". I hate when that happens!
HINT:-Its price sensitive
If you have a really good cyber insurance policy, and you do the minimum required to not be found negelgent, is it enough to buy insurance and not "Secure" your computer assets? This assumes your insurance covers lost profits or reputitioon damadge and all taht other stuff that happens? Is it cheaper?
I tried for 5 years to come up with a clever sig...only to realize that I am not clever.
I'm frankly surprised that the insurance company actually agreed to pay. Keep in mind that the whole idea of an insurance company is NOT to pay.
Just like they did after 9/11, companies will probably start writing exclusions for this type of loss into their policies. If they don't, the price of the insurance will go sky high to the point that companies will simply go bare as the insurance costs more than the asset it's protecting.
Should we have to pay for cyber insurance? Is protection from cyber fraud a right or a privelage? I'd like to say that it is owed to every internet user, but thats probably a little unrealistic....