Slashdot Mirror
Cyber Insurance Industry Expected To Boom
An anonymous reader writes "The high profile hacks to Sony's systems this year were quite costly — Sony estimated losses at around $200 million. Their insurance company was quick to point out that they don't own a cyber insurance policy, so the losses won't be mitigated at all. Because of that and all the other notable hacking incidents recently, analysts expect the cyber insurance industry to take off in the coming year. 'Last October, the S.E.C. issued a new guidance requiring that companies disclose "material" cyber attacks and their costs to shareholders. The guidance specifically requires companies to disclose a "description of relevant insurance coverage." That one S.E.C. bullet point could be a boon to the cyber insurance industry. Cyber insurance has been around since the Clinton administration, but most companies tended to "self insure" against cyber attacks.'"
More insurance policies ....
that produces absolutely nothing
As if the "IT security industry" wasn't already full of snake oil in the name of "due dilligence", and filling swiss cheese with easy cheez for easy laughs and prolonging the problem.
I'm certainly not on the inside at Sony or their insurer, and I haven't reviewed any documentation on actual insurance policies in force at Sony, but isn't this the sort of situation that errors and omissions insurance is supposed to cover?
The data needed to make actuarial tables isn't good enough (so you can't assess risk rates that well), and the amount of self inflicted harm (e.g. Sony) is staggering. What will happen is insurance companies will attempt to do this, claims will be filed, and denied on various grounds (some legitimate, like you did have a password on the admin account, and some less legitimate) but payout rates will be low to zero. Companies will realize that attempts to financially offset the impact of the risk isn't working (you pay the premiums but never win any claims) and eventually stop buying cyber insurance.
Maybe we will get realistic numbers from these "hacking" events, now we will get what the insurance companies will actually cover which may be in line with actual losses rather than the exaggerated loss propaganda we usually hear about.
"If any question why we died, Tell them because our fathers lied."
So will moving funds to cyber insurance policy help fix??
Look at sony they cut down there Security staff right be for they got hit by the big hack and maybe if they did not make that cut then maybe the hack would not been so big.
Lack of funds to update Security software / hardware?
Lack of man power to have good Security?
Lack of basic IT man power?
some times this leads to poor Security as people / departments don't have the time to wait for IT so they some times bypass IT to get work done / have IT lower security with out doing in a way that still keeps some security in place aka we need are our own department sever and we are paying for it and managing it and we just need it to be open to us / maybe have a out side IP vs having IT run and manage that sever.
lack of funds to update older software and hardware that has security bugs aka still having IE6 and lacking the funds to update in house apps that don't work with newer ie's / firefox.
Lack of staff so people are pulling 60-80 hour weeks and make more errors / miss stuff.
also poor password rules lead to the passwords being on post it notes.
Maybe this will introduce standards for coding that the insurance industry can live with.
UL listed code?
Insurance companies are notorious for avoiding risky customers, if not outright persecuting them (cf. "undisclosed prior conditions" in health insurance). If a company wants to get (or keep) cyber-insurance, it's a fair bet that the insurance company will have conditions of contract which will ensure better (not necessarily best) practices for things like interfaces, coding, intrusion detection, etc. that will minimize THEIR losses in event of a breach. The overall effect will be to make good security/coding/etc. practices actually cheaper than the amateurish "self-insurance" companies like Sony have practiced.
Hi. I'm Bob, and I'll be your Code Review Actuary. If you pass, your premiums will drop by about ten percent.
Security requires experts with experience in the field. Security is not something you buy, it needs to be adapted to the particular needs of an organization, and it is often counter-intuitive. Worse still, after paying a lot for an expert who tells you to do things that seem weird and not what you were expecting, you have no way to tell whether or not the security policy accomplished anything at all. Insurance is cheaper, and it is something your investors and board members can understand.
Palm trees and 8
Or the policy will only cover a certain maximum amount of loss, certain kinds of security breaches, etc. Why spend the money auditing when you can just not spend money and not pay out when a company is attacked?
Palm trees and 8
ugh. Next up: iInsurance? (for your iDevice) Cloud Insurance? (for ... whatever) Social Insurance? (keep your ins. co up to date by posting about you and your friends' latest transgressions via their app) NanoInsurance? (in case of grey goo) Buzzword Insurance? (pays out everytime I am subjected to a /. summary with more than one occurance of a buzzword)
There is precedent for companies contractually requiring better security from other companies. That's what PCI DSS is, for example. I'm no fan of "check the box" security, but it has a use in preventing obvious stupidity.
The insurance industry seems to be treating ISO 27001 as the standard to use.
Insurance companies typically force the insured company to be proactive, i.e. start thinking about cyber-security (or fire safety, or employee driver training, etc.) *before* something catastrophic happens. Like think of how your home fire insurance rates are lower if you install an automatic sprinkler system... same idea here with cyber-security. I have no doubt that the big insurance companies will be looking closely at companies' security policies before writing them a $200-million policy.
Karma: pi (Mostly due to circular reasoning in posts).
Insurance companies are good at managing risk. They know how to estimate it, how to mitigate it, and how to charge for taking it on so that they don't lose money.
Businesses are good at managing costs, so when it comes to risks like security breaches which aren't well-understood, their tendency is to accept risk in order to cut costs. Forcing them to disclose what they're doing with respect to computer security risks will prompt a lot of concern from investors who want to see the risks mitigated, which will force businesses to get insurance. That will create a booming market for the insurance industry, but it will also prompt a lot of risk mitigation -- i.e. companies starting to do what they should have been doing to begin with -- in order to keep their insurance premiums down.
I wouldn't be surprised if there's another effect of widespread information security insurance policies: more financial liability for breaches. The combination of better-established best practices for security and the availability of deep-pockets insurance companies to sue will likely enable and motivate bigger awards. If so, more liability will further increase the attention paid to security risks. That's a good thing.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Any of these said companies publicly traded? You know, just for reference...?
Often obtrusive "security" conflicts with the prime mission of the organization, sapping morale, efficiency and innovation. e.g. TSA. Good unobtrusive security is a rare jewel.
Insurance companies usually demand some risk mitigation (such as building codes or safe driving records). This could force companies to tighten up their security to lower their insurance premiums. Tightening up security to limit losses is something too immeasurable to put on the balance sheet.
on the road to higher priced software.... as soon as Insurance and lawyers get involved we're screwed
"...Last October, the S.E.C. issued a new guidance requiring that companies disclose "material" cyber attacks and their costs to shareholders. The guidance specifically requires companies to disclose a "description of relevant insurance coverage." That one S.E.C. bullet point could be a boon to the cyber insurance industry."
Er, could be a boon? Ah, smells more like "you grease this palm, and I'll make you billions" type of "guidance". Give me a break. It really can't get much more blatant than this, pulling yet another form of pointless "mandatory" insurance out of your ass.
And yes, it will likely be pointless by the time you get to the fine print on paying out a half-billion dollar cyberinsurance claim.
Your Cyber Insurance Claim has been denied due to not conducting Internal and 3rd Party External Audits since we have not received on time your Audit reports for the past 5 years.
So are there any other ways to wiggle out of paying the claims?
Just what the world needs. More insurance policies ....
On the other hand the insurance policies may require some reasonable IT practices. Perhaps a manager who is not so responsive to the argument "these practices are standard and recommended" will be more responsive to "failure to meet these practices will get our insurance policy canceled".
My first thought was that this could be "easy money" for any company that buys such an insurance.
You want me to break something else? http://www.youtube.com/watch?v=vkkM9YAJ-Ts
tomorrow who's gonna fuss
so that the works can tell management that no your plan will not work / will not pass the security plan. Also they will cover IT's ass when the CEO or other higher up's brakes the rules and there is a security leak.
Also maybe they can say that makeing people put in 80 hours weeks is bad for good code that will pass the security plan.
in where each pice of software must have a software update plan.
They're starting to do this now anyway despite no insurance - bad publicity is the kick in the ass they need, and keeps them in check, since customers can easily drop internet services and substitute them for others. With the insurance, they will only take enough measures to meet the bare minimum of standards and figure the insurance will cover their ass, and pass the cost on to the customer.
The real intrusions are very hard to prove, the hacks that get discovered are the ones that couldn't manage to be subtle enough. Even if there are signs, unless it is a lulzsec-like troIl group doing it publicly the insurance company will refuse to pay. IT security insurance will just make companies overconfident and worrying even less about security, and when they get hacked they will find that the insurance company isn't paying for the huge losses as they can't be proven.
To show what a scam cyber insurance really is.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
More post industrial hot air. Insurance typically sucks in 2-4x the actual loss claims paid (then think of precious high interest rate capital for years ahead), not a source of competitive growth or information, and will stifle the growth of new competitive edges. The US is toast, an economy running on empty promises and bs.
Just like the 'Green Jobs / Economy,' right boys? Admittedly, this might be slightly more tangible than the previous 'opportunity,' but I have my doubts.
On a side note, what happened to investing in actual technological innovation? A little-less pie-in-the-sky, a little more our scientists have confirmed this is doable, and our engineers desperately want to build a new fab to we can retire in style in 5 years?
Does anyone understand what I am attempting to convey here? We've gone from the poker table to the slot machine. Poker requires more skill, and will take more time to see if you win the pot, but the odds are better than the slot machine, which just takes your money. And the payoff is more significant, if / when it happens.
Does anyone do risk / analysis anymore? I feel I need some confirmation that we still do that.
I am John Hurt.
>Home and Car locks have been stagnant technology for 50+ years
What? 50 years ago you could hot-wire a car. Today we have immobilizers that won't let the engine start without cryptographic authentication.
Not to say there isn't room for some sort of cyber-insurance, but the whole issue with Sony was their lack of competent programmers and admins.
Of course they go the way of wanting insurance instead of fixing the root of the problem.
They go the route of 1lb of cure is better than 1oz of prevention, probably because it's easier to measure the effectiveness of a cure than prevention.