Slashdot Mirror
Cyber Insurance Industry Expected To Boom
An anonymous reader writes "The high profile hacks to Sony's systems this year were quite costly — Sony estimated losses at around $200 million. Their insurance company was quick to point out that they don't own a cyber insurance policy, so the losses won't be mitigated at all. Because of that and all the other notable hacking incidents recently, analysts expect the cyber insurance industry to take off in the coming year. 'Last October, the S.E.C. issued a new guidance requiring that companies disclose "material" cyber attacks and their costs to shareholders. The guidance specifically requires companies to disclose a "description of relevant insurance coverage." That one S.E.C. bullet point could be a boon to the cyber insurance industry. Cyber insurance has been around since the Clinton administration, but most companies tended to "self insure" against cyber attacks.'"
More insurance policies ....
that produces absolutely nothing
I'm certainly not on the inside at Sony or their insurer, and I haven't reviewed any documentation on actual insurance policies in force at Sony, but isn't this the sort of situation that errors and omissions insurance is supposed to cover?
The data needed to make actuarial tables isn't good enough (so you can't assess risk rates that well), and the amount of self inflicted harm (e.g. Sony) is staggering. What will happen is insurance companies will attempt to do this, claims will be filed, and denied on various grounds (some legitimate, like you did have a password on the admin account, and some less legitimate) but payout rates will be low to zero. Companies will realize that attempts to financially offset the impact of the risk isn't working (you pay the premiums but never win any claims) and eventually stop buying cyber insurance.
Insurance companies are notorious for avoiding risky customers, if not outright persecuting them (cf. "undisclosed prior conditions" in health insurance). If a company wants to get (or keep) cyber-insurance, it's a fair bet that the insurance company will have conditions of contract which will ensure better (not necessarily best) practices for things like interfaces, coding, intrusion detection, etc. that will minimize THEIR losses in event of a breach. The overall effect will be to make good security/coding/etc. practices actually cheaper than the amateurish "self-insurance" companies like Sony have practiced.
Hi. I'm Bob, and I'll be your Code Review Actuary. If you pass, your premiums will drop by about ten percent.
There is precedent for companies contractually requiring better security from other companies. That's what PCI DSS is, for example. I'm no fan of "check the box" security, but it has a use in preventing obvious stupidity.
The insurance industry seems to be treating ISO 27001 as the standard to use.
Insurance companies are good at managing risk. They know how to estimate it, how to mitigate it, and how to charge for taking it on so that they don't lose money.
Businesses are good at managing costs, so when it comes to risks like security breaches which aren't well-understood, their tendency is to accept risk in order to cut costs. Forcing them to disclose what they're doing with respect to computer security risks will prompt a lot of concern from investors who want to see the risks mitigated, which will force businesses to get insurance. That will create a booming market for the insurance industry, but it will also prompt a lot of risk mitigation -- i.e. companies starting to do what they should have been doing to begin with -- in order to keep their insurance premiums down.
I wouldn't be surprised if there's another effect of widespread information security insurance policies: more financial liability for breaches. The combination of better-established best practices for security and the availability of deep-pockets insurance companies to sue will likely enable and motivate bigger awards. If so, more liability will further increase the attention paid to security risks. That's a good thing.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Often obtrusive "security" conflicts with the prime mission of the organization, sapping morale, efficiency and innovation. e.g. TSA. Good unobtrusive security is a rare jewel.
Insurance companies typically force the insured company to be proactive, i.e. start thinking about cyber-security (or fire safety, or employee driver training, etc.) *before* something catastrophic happens.
Yes. The company famous for that is The Hartford Steam Boiler Inspection and Insurance Company. Back when steam engines were high-tech, and blew up frequently, Hartford Steam Boiler was established in 1866 to insure them. More than half the company's staff is boiler inspectors. They inspect before they issue the policy, and the policy gives them the right to inspect whenever they want to, which they do regularly. Very, very seldom does a boiler insured by Hartford Steam Boiler blow up.
Many companies don't like that level of intrusiveness by an insurance company. On the other hand, it's been decades since a boiler insured by Hartford Steam Boiler blew up. It's time for computing to grow up and get that level of hard-ass attitude.
>Home and Car locks have been stagnant technology for 50+ years
What? 50 years ago you could hot-wire a car. Today we have immobilizers that won't let the engine start without cryptographic authentication.