Cyber Insurance Between the Lines

Shackleford writes "Security Focus has an article that discusses insurance policies regarding 'computer attacks and cyber sabotage.' It discusses a case in which an administrator who set up back doors in the system with which he was trusted deleted files to which he could access after he was fired. His company had insurance against dishonest acts by employees, but not against 'acts of destruction.' Eventaully, the company won, but the case went to litigation. So the lesson to be learned here is that your company may have 'cyber insurance' without knowing it, but you need to be sure about it."

Comments

Re:Do Admins leave Backdoors a lot?

[James Littiebrant]

That would sound like a good idea, but it is not the best idea. I know how a hacker can get into computers (because I am one) and installing a backdoor on your server/computers is a deadly mistake. A simple scan from a hacker in theory could uncover that backdoor, then you are screwed. Instead I would recommend that you get a physical switch that resets the root password to a prespecified number or character. Where you can get these? I am sorry to say that I do not know where. I do know that they have been made bacause one of my friends has built one for his computer, with some programming and mod experiance you could build one too. I for one will never install a backdoor on MY servers.

Re:dishonest acts by employees?

[Anti Frozt]

IANAL, but I would imagine their contract would have provisions that include former employees (up to a certain time after termination) and would possibly be bound by clauses set out in NDA and employment agreement.

The fact that the insurance company nitpicked between dishonest and destructive acts doesn't surprise me in the least.

If you are about to be fired...

[hillct]

There are many sighns you are about to be fired, but most of them relate to steps your employer has taken to prevent you from doing damage to their systems in retaliation, like, say, changing the root password, deleting your personal userid, removing you from the company directory, and then there are these:

Top 41 Signs You Are About To Be Fired

The point is, do what you need to do long before you are fired so as to make your exit as painless as possible. If your employer is not competent enough to take the nessecery steps, and so requires anti-employee insurance, then that's their problem, and it probably indicates they're too stupid to deserver to have you working for them anyway. If they havn't earned the respect of their employees, again, this is the mark of a bad employer and it's time to move on anyway.

It's simple, if any of the above events have occurred, plan to move on and if your company has purchased anti-employee insurance, it's time to het the hell out anyway.

--CTH