Slashdot Mirror
Lawsuit Against Sony Highlights Cyber Insurance Shortcomings
CWmike writes "A brewing legal dispute between Sony and one of its insurers over data breach liability claims highlights the challenges that companies can sometimes face in getting insurance providers to cover expenses arising from cybersecurity incidents. Zurich American Insurance Co. asked the court last week to absolve it of any responsibility for defending or indemnifying Sony against claims arising from the recent data breaches at the company. The data breaches at Sony's PlayStation Network, Sony Entertainment Online and Sony Pictures resulted in account data on close to 100 million individuals becoming exposed and over 12 million credit and debit cards being compromised. The breaches have so far resulted in at least 55 putative class-action lawsuits being filed against Sony in the U.S and another three lawsuits filed against it in Canada. Sony expects to spend close to $180 million in the next year alone on breach-related costs. But analysts say insurance might not have even been worth it in Sony's case: 'There aren't many success stories where cyber insurance [has played] a significant role in reducing the cost of incidents,' said Gartner analyst John Pescatore. Um, better security as an insurance policy maybe?"
That's a nice network you got there. Be a shame if anything happened to it.
So this is just the same thing that happens everyday to regular people, just scaled up to the corporate level. Insurance companies will absolve themselves of all responsibility to pay a claim whenever they possibly can. Why would it be any different when it's a corporation trying to make the claim?
Maybe they should just throw in the towel and hire LulzSec to handle their online security.
XML is like violence. If it doesn't solve your problem, you're not using enough of it. --AC
hmmm, on one side, an insurance company.
on the other side, sony.
hey, why does it have to be one or the other, though? can't they both lose? please?
(for great justice. and a plate of shrimp, to go.)
--
"It is now safe to switch off your computer."
When I hear about things like this, I think back to why insurance was created, namely to protect you in case of a loss that you cannot afford. Think about what you insure, your home, your liability in a car accident or your life (and income potential therein). It appears that in this case, Sony can afford this failure, they're just trying to use insurance as a cost offset. Given what would seem to me like the relative ease of the insurance company denying coverage ("Were you fully patched and protected in every reasonably manner against breach? Prove it"), why would you bother with insurance in this case? Is there possibly some fiduciary responsibility to shareholders that is the cause?
The whole point of insurance is to make a variable cost into a fixed cost. Even if better security substantially reduces your average cost over an infinte time horizon, it does not make the associated costs predictable. It's like saying, don't get homeowners insurance in case your house burns down, just remember to turn off the iron when you leave home.
Not that bad things are happening to Sony, who deserves it; but that even giant bloodsucking multinationals with legions of attack lawyers can't keep insurance companies in line(arguably, if you count CDOs, neither can nation states. Why don't we shoot these people again?). Makes me feel a whole lot better about the inevitable hassles that will arise from my next claim form...
At this point, it almost looks as if Sony's security team isn't just incompetent. That's pretty obvious. By this point, I'm almost wondering if some of them weren't/ aren't deliberately sabotaging Sony's security (well, those who actually know enough to do sabotage, which is looking like the minority at this point.) No patches/ firewall on their servers? Not using random numbers in the signature on firmware for the PS3 (thus revealing the master private key. Including that for Bluray.)? This? These aren't just huge, gaping flaws. Flaws require effort to exploit. These are just... not security. At all. Its like having theft insurance on a car, then leaving that car unlocked in a bad neighborhood. After removing the locks. Then putting a sign on it that says "plz dont steal." Then wanting the insurance money to cover the car after it gets stolen. Its simply not going to happen, at least if the court is anywhere near competent (or unless there is some weird clause in the contract).
Sony should be forced to pay, and probably have some punitive costs added as well, so that they learn to hire competent security designers. And pay them well. This whole episode is simply mind-boggling. Didn't know a company could be this incompetent and still exist.
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
Um, better security as an insurance policy maybe?
Yes. Every insurance policy you could possibly buy will require you to exercise the normal and accepted level of diligence with regard to security. No policy in the world will cover you if you're negligent, because insurers are sane; they're not going to accept that level of risk. They're only going to take on the risk that you do things reasonably well, and still get breached by some sophisticated and not-reasonably-expected attack.
So a company is running unpatched servers with no firewall. Even if they do get insurance against cyber incidents, they are guaranteed to get absolutely nothing from this insurance, because they don't have any protection set up. Isn't insurance in this case essentially unjust enrichment for the insurance company?
The actual court filing by the insurance companies says:
Notwithstanding, the claims set forth in the Class Action Complaints filed against SCEA and the other Sony Defendants, as well as the miscellaneous claims, arising out of the cyber attacks on the PSN and SOE Network and the unauthorized access to and theft of the named plaintiffs and putative class members' personal identification and financial information, do not assert claims for "bodily injury," "property damage" or "personal and advertising injury" so as to entitle SCEA to defense and/or indemnity under the ZAIC Primary Policy.
In other words, Sony didn't buy coverage against a liability of this type. They were covered if the product actually injured someone or damaged their property (shocked someone or caught on fire, for example) but not for an indirect financial loss.
What they needed was an "errors and omissions policy". This covers financial screwups. Banks, accountants, tax advisors, and brokers usually carry such policies, because they handle other people's money. What Sony's people didn't realize is that, by handling so many credit card numbers (and, apparently, improperly holding more credit card info than they should have), they had the exposure of a financial institution.
Any merchant who holds onto credit card info for recurring transactions needs that coverage. Merchants who just pass credit card data to the bank for a single transaction, but don't keep it on file, are less at risk.
competent security designers where lay offed and they where not given the tools / funds to do there job.
How does this illustrate the shortcoming of cyber-liability insurance?? The whole point of the article is that they *didn't* have it, only general liability.
"According to Zurich Insurance, the commercial general liability insurance policy it has with Sony Computer Entertainment America does not cover damages arising from cyber incidents. The policy only covers "bodily injury" and "property damage" caused by occurrences other than the kind of cyberattacks Sony experienced."
As much as I hate insurance companies I don't think that Zurich American Insurance Co. is as bad as some and is probably reasonable in trying to avoid paying in this case. From my understanding Sony didn't do due diligence in securing their network or even follow what would have been reasonable precautions that a rational actor would take. It is interesting that the insurance company is going to court which probably means they feel they have a strong case since usually they will just deny the claim.
There is no way they are as bad as my parents insurance company who told them their house didn't have hail damage even though my untrained eye could see broken shingles and dented siding. Their insurance company claimed that even though every house for about 2 miles in every direction had substantial hail damage theirs didn't because "hail is funny like that". Unfortunately my parents didn't take the to court because it really was an open and shut case. This is the same company that I fought and won when my car was totaled because they didn't want to pay the fair market value.
Time to offend someone
Meanwhile, /.'s command of the English language deteriorates to new lows.
don't confuse insurance with the word assure or even ensure.
insure simply means to play legal gambling on statistical odds... ...and then they get to keep your money and you get to die.
--
"It is now safe to switch off your computer."
Slashdot fail English? That's unpossible!
Welcome to the Panopticon. Used to be a prison, now it's your home.
Indeed, many automotive policies do not cover you in cases such as:
a) You have been drinking/driving and get into an accident
b) Your car is stolen when you leave the keys in the ignition (or leave it running, etc)
Depends on what's in Sony's policy, but I wouldn't be surprised if they had an anti-negligence clause.
Hasn't this already been confirmed as complete bullshit? I seem to remember you could get a google cache of the server information at the time which pretty much refuted all of the 'evidence' that Sony was running an insanely out of date server config? Why does this crap keep getting posted?
I know Sony is making a $Billion every second of every minute of every hour of every day, but that nearly $180M sounds like a lot of money to me. Is Sony still coming out ahead after all of this? Seems like it's possible -- there was a story here recently talking about PS3 overtaking the Xbox360... (though my guess is the Xbox360 market is saturated and in order to get something new, they finally got a PS3 too)
Whatever the case, I see the attacks on Sony not as a mere attack and security breech, but massive consumer backlash against Sony. I may not have had anything to do with the attacks, but I was certainly enjoying the news stories and headlines and I feel that Sony deserves every bit of it and more... more especially if those arrogant bastards don't change the way they behave.
I have a feeling that once the courts and everything is done with the issue, a new batch of attacks will occur.
Welcome Sony, to the world the little guys live in. The one where you need insurance insurance for when your insurer finds a way to weasel out of a perfectly legitimate claim even though they faithfully cashed your check every month since forever.
Of course, since the only place you could get insurance insurance from is one of the weasels that looked even less reliable than where you bought your insurance from, good luck with that.
Sony's hack is barely a drop in the massive hacking spree that followed.
This. This is why I got out of corporate, because it got to the point one was given impossible problems with NO budget and more often than not if you managed to pull it off they would just fire half the guys and expect YOU to take up the slack.
I'd say the problem is what I call "failing upwards" in that they get rewarded for fucking IT because you "Saved X on the company budget" by firing everyone that knew WTF they were doing, or cutting their budget to the bone, and then when the shit hits the bladed cooling device they have moved up either through promotion or using their "track record" to get a job at another corp thus they NEVER get the blame.
Having competent IT staff costs money that the PHBs never want to spend, so they end up firing everyone with a brain (if they ever hired them in the first place) or giving each guy the workload of 5 until they all burn out or jump ship, but gutting IT looks good on the quarterly earnings so nobody gives a fuck until the shit blows up in your face but by then the geniuses that thought gutting IT was a swell idea have taken their bonuses and moved on. It is a real problem with corps here and I frankly don't see it getting any better despite LULSec spanking so many companies.
ACs don't waste your time replying, your posts are never seen by me.