Slashdot Mirror

← Back to Stories (view on slashdot.org)

Insurer Won't Pay Out For Security Breach Because of Lax Security

Posted by Soulskill on from the ounce-of-prevention-is-worth-a-ton-of-green dept.

chicksdaddy writes: In what may become a trend, an insurance company is denying a claim from a California healthcare provider following the leak of data on more than 32,000 patients. The insurer, Columbia Casualty, charges that Cottage Health System did an inadequate job of protecting patient data. In a complaint filed in U.S. District Court in California, Columbia alleges that the breach occurred because Cottage and a third party vendor, INSYNC Computer Solution, Inc. failed to follow "minimum required practices," as spelled out in the policy. Among other things, Cottage "stored medical records on a system that was fully accessible to the internet but failed to install encryption or take other security measures to protect patient information from becoming available to anyone who 'surfed' the Internet," the complaint alleges. Disputes like this may become more common, as insurers anxious to get into a cyber insurance market that's growing by about 40% annually use liberally written exclusions to hedge against "known unknowns" like lax IT practices, pre-existing conditions (like compromises) and so on.

119 comments

  1. Seems reasonable by Bruce66423 · · Score: 5, Insightful

    If a company cuts corners on security, then in the same way that if I leave my door unlocked and get burgled, I can't make a claim. There's going to be a good living for lawyers establishing what is the required level of security. But if this incentivises senior managers to ask the right questions, then it's probably a good development.

    1. Re:Seems reasonable by JaredOfEuropa · · Score: 4, Interesting

      The hard part is indeed establishing what the right level of security is and how to evaluate companies against that. At least over here, the exclusions for burglary are pretty clear cut: leaving your door or a window open, and for insuring more valuable stuff there are often extra provisions like requiring "x" star locks and bolt, or a class "y" safe or class "z" alarm system and so on. With IT security, it's not just about what stuff you have installed and what systems you have left open or not; IT security is about people and process, as much or more than it is about systems.

      --
      If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
    2. Re:Seems reasonable by fuzzyfuzzyfungus · · Score: 5, Insightful

      Not that real world IT systems often ascend to this level of security; but the issue is not going to be clarified by the fact that the analogy to physical security is only partially accurate: everyone accepts that (for a given purpose; bank vaults and nuclear installations get judged differently than houses) there is some level of 'reasonable security', which reflects appropriate caution on the policyholder's part; but is known to be breakable. Materials have limited strength, police have nonzero response time, sensors generate false negatives.

      With IT systems(at least at the level of software attacks, if they break in at the silicon level it's another story), there is a platonic essence of 'the secure' floating out there, though generally far, far, far, too expensive, cumbersome, and slow to build to ever see the light of day; and there really isn't the same degree of agreement about what counts as 'secure enough for X' or 'incompetent'. Gross incompetence is something you can identify, and there are various formally proven systems in existence, mostly for the constrained use cases of cost-insensitive customers; but the stuff in the middle is very much up in the air.

    3. Re:Seems reasonable by Rich0 · · Score: 2

      If a company cuts corners on security, then in the same way that if I leave my door unlocked and get burgled, I can't make a claim. There's going to be a good living for lawyers establishing what is the required level of security. But if this incentivises senior managers to ask the right questions, then it's probably a good development.

      Maybe. If you're buying an insurance policy to cover leaks of information, then almost by definition any claim is going to be the result of lax security. So, why bother buying insurance at all if the insurer can get out of it? The likely result is that those harmed won't be able to collect damages since there will be no insurance, and the company that lost the data will simply declare bankruptcy.

      I think there are better precedents. For example, my company is routinely audited by its insurers or other certification bodies. If they spot a blocked electrical panel, that has consequences for the company. The purpose of the audits is to PREVENT bad things from happening, and of course passed audits will support later claims if something bad things happen anyway.

      So, why not do the same with "cyber policies" or whatever they're calling them. The insurer states some standard that the policyholder is to be audited against. The policyholder agrees to be audited. If the audit passes, they're in the clear.

      And that is what insurance is about - elimination of risk. If you are in charge of some big company you can get the blessing of the appropriate auditors and now it isn't you're fault if something bad happens. It is a bit like having an IT team with skin in the game.

      Sure, you can hire what you think is a good IT security team, but how do you really know if you've gotten one? If you buy a cyber insurance policy you're getting that IT audit, but then if you're declared clean and you get burned anyway, that insurance company comes in and puts their money behind their words and pays for your loss. THAT is what insurance is supposed to be.

    4. Re:Seems reasonable by jbolden · · Score: 3, Interesting

      Industry handles this in other areas and for that matter security as well by having auditing firms and engaging in a "best practices" audit. "Best practices" doesn't actually mean best practice but rather not doing stupid or dangerous stuff. The audit is how that gets determined.

    5. Re:Seems reasonable by Rich0 · · Score: 4, Insightful

      everyone accepts that (for a given purpose; bank vaults and nuclear installations get judged differently than houses) there is some level of 'reasonable security', which reflects appropriate caution on the policyholder's part; but is known to be breakable.

      I agree with your post. I'll just add that a big problem with IT security is that companies cannot rely on the same level of protection from governments in preventing intrusion.

      For example, if I have a safe in my house, the means an attacker would have to penetrate it are going to be limited. Since my township has police and neighbors that wander around, they can only spend so much time there before they're likely to be detected. They can generally only carry in stuff that will fit in the doors and is man-portable, since if they have to cut a hole in the house and lower their equipment using a giant crane somebody is likely to notice. If they want to use explosives they will have to defeat numerous regulatory and border controls designed to prevent criminals from gaining access to them, and of course they will be detected quickly. Some destructive devices like nuclear weapons are theoretically possible to use to crack a safe, but in practice as so tightly controlled that no common thief will have them. If the criminal is detected at any point, the police will respond and will escalate force as necessary - it is extremely unlikely that the intruder will actually be able to defeat the police. If the criminal attempted to bring a platoon of tanks along to support their getaway the US would mobilize its considerable military and destroy them.

      On the other hand, if somebody wants to break into my computer over the internet, most likely nobody is going to be looking for their intrusion attempts but me, and if they succeed there will be no immediate response unless I beg for a response from the FBI/etc. An intruder can attack me from a foreign country without ever having to go through a customs control point. They can use the absolute latest technology to pull off their intrusion. Indeed, a foreign military might even sponsor the intrusion using the resources of a major sate and most likely the military of my own state will not do anything to resist them.

      The only reason our homes and businesses have physical security is that we have built governments that provide a reasonable assurance of physical security. Sure, we need to make small efforts like locking our doors to sufficiently deter an attacker, but these measures are very inexpensive because taxpayers are spending the necessary billions to build all the other infrastructure.

      When it comes to computer security, for various reasons that secure environment does not exist.

    6. Re:Seems reasonable by Anonymous Coward · · Score: 0

      There's nothing reasonable about it. Without an agreed-upon set of required security practices, selling insurance and then refusing to pay out for not following undeclared rules is fraudulent. Just like you can't get insurance after the fact, the insurance company can not impose limitations after the fact. Clearly the insurance company didn't calculate their risk correctly and now wants to "renegotiate". In a field where there is no universally accepted set of security practices, the insurance company needs to spell out what it requires, and in other areas these stipulations are often accompanied by audits before a contract is signed.

    7. Re: Seems reasonable by Anonymous Coward · · Score: 4, Insightful

      I'm not so sure about that. I've had the misfortune of dealing with auditors whose definition of best practices included completing non-deviation from things they obviously read out of a college textbook and do not understand at all.

      The notion of actual risk and threat analysis and applying practices to suit situations was completely alien to them.

      I've also dealt with very competent auditors. I rather miss dealing with them. I imagine the incompetent ones cost less, and that kind of thing is going to be a problem as security audits become more prevalent.

      That, and we must never forget that as much as we may applaud the insurance company in this particular story for calling out poor practices, the primary purpose of a modern insurance company is to take your money and give you nothing in return. Everybody needs to be very aware of that, and be untrusting in all your dealings with anyone in the insurance business.

    8. Re:Seems reasonable by gbjbaanb · · Score: 1

      It can be about systems - what policies you have, and have you been audited for security shortcomings. People and process are important factors, but they do not count if you have no security system in place and no way of knowing if its been configured to work.

      Hopefully this will drive more established standards for IT security, along the lines of both having a world-class 'lock' but also "you left the key under the mat" so it doesn't count.

    9. Re: Seems reasonable by jbolden · · Score: 2

      I agree there are terrible auditors that don't understand what they are doing. But in most companies you can push back against that, it is just that then the burden switches to you. You have to verify and certify that alternative approach X is better than industry standard approach Y.

      As far as the rest, the purpose of an insurance company is to pool risk. The person being insured should likely not want to have to file a claim because that means something bad happened. The company doesn't want to give nothing in return because then there is no need for their product.

    10. Re:Seems reasonable by jbolden · · Score: 1

      Centcom is interested in starting to build a government infrastructure for defense. They agree this needs more collective action and government assistance. Right now the public is pulling in the opposite direction however.

    11. Re:Seems reasonable by deathlyslow · · Score: 1

      If a company cuts corners on security, then in the same way that if I leave my door unlocked and get burgled, I can't make a claim.

      I agree with the second portion of your comment. It's an entirely different matter when it's personal property verses protected information. There is or should be a certain level of security afforded to one's private property regardless of the level of security maintained. Meaning I don't care if the door is wide open it's still wrong to have someone come in and take what isn't theirs. I know that my home-owner's and auto policies have zero stipulations on eh security levels that must be maintained. Where as there is a documented level of security that needs to be in place for the protected information. Look at HIPPA, PCI, SOX, etc. requirements. I think if you don't meet those standards it should be a criminal as well as a civil offence to allow the non-compliance. From a an admin's perspective you better have documented proof of your recommendations and when/why they were shot down or you are just as guilty as the PHB.

      --
      Don't blame me for redundant posts. I can't type very fast. Hence the user ID.
    12. Re:Seems reasonable by Anonymous Coward · · Score: 1

      Lawyers and judges have been doing this for years. Eventually a case will go to a court and it'll be argued by both sides and a judge will make a ruling. That ruling will establish precedent.

      What is the right level of security will be measured by risk, damages, cost mitigation, and legal responses, all of which will be handled by lawyers. THe technical side will be just to define the boundaries.

    13. Re:Seems reasonable by JaredOfEuropa · · Score: 1

      So the lawyers win again...

      --
      If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
    14. Re:Seems reasonable by aaarrrgggh · · Score: 1

      How many it consultants have Professional Liability Insurance? What would the premiums be--3-5%?!

      This is going to be a big problem in the industry.

    15. Re:Seems reasonable by aaarrrgggh · · Score: 1

      Technically, insurance companies never pay; they keep working down the chain of liability to get the next guy to pay.

      How do you insure against hardware failures of the shrink wrap EULA washes hands of any liability? It will be a major change in the industry.

    16. Re:Seems reasonable by runningduck · · Score: 2

      Typically a company has to undergo an assessment to qualify for the insurance and then periodically reassess annually. At least that has been the case for every information security insurance policy with which I have been involved. Where companies can veer off track is if they are not consistent in their application of the assessment. For example a new system or process goes on line and a senior manager just wants it done, NOW! The new system or process may never be considered under that annual assessment because the left hand does not know what the right hand is doing. In another example an IT manager runs everything by the seat of his/her pants and forgets to consider the insurance requirements when deploying new systems or processes, or allows staff to "fix problems" in production without evaluating the fixes against the original requirements.

      --
      -rd
    17. Re:Seems reasonable by Anonymous Coward · · Score: 1

      The hard part is indeed establishing what the right level of security is and how to evaluate companies against that.

      No, that's the easy part. The insurer in this case has already made that assessment, albeit after the fact.

      What needs to happen now is for companies to make that same assessment when taking out the policy in the first place -- get the insurer to sign off on your security practices up front, and you won't get this kind of dispute.

    18. Re: Seems reasonable by Anonymous Coward · · Score: 1

      Since there is a law that forces all Americans to buy insurance, I don't think we have much of a choice.

      You're forced to buy car (liability) insurance if you drive. Car insurance is one type of insurance. There are many types of insurance. The article is not about car insurance. The summary is not about car insurance. No one was discussing car insurance.

      How people so utterly fail to comprehend what they read and so grievously fail to understand the very most basic facts of what they decide to speak about is one of the great mysteries of our time.

    19. Re: Seems reasonable by Anonymous Coward · · Score: 0

      Uhh, you're correct. No one was talking about car insurance until you brought it up. I thought AC's comment "Since there is a law that forces all Americans to buy insurance, I don't think we have much of a choice" was directed more towards mandatory health care coverage (mandatory being that I have to pay a penalty if I don't buy it.) So no, we're not discussing car insurance which is indeed mandatory but it's not mandatory that I own a car. It is, however, required that I pay for health care insurance for no reason other than being alive.

    20. Re:Seems reasonable by Anonymous Coward · · Score: 1

      If a company cuts corners on security, then in the same way that if I leave my door unlocked and get burgled, I can't make a claim.

      To a point I can agree with that. BUT it also sounds to me like a typical weaselly insurance company squirming out of a valid claim. "We sell security breach insurance. You had a breach? By being breached you must not have taken reasonable security measures. Claim denied."

    21. Re:Seems reasonable by NatasRevol · · Score: 1

      If you haven't been paying attention, they always win. Even the losers get paid well.

      --
      There are two types of people in the world: Those who crave closure
    22. Re:Seems reasonable by luis_a_espinal · · Score: 5, Informative

      The hard part is indeed establishing what the right level of security is and how to evaluate companies against that. At least over here, the exclusions for burglary are pretty clear cut: leaving your door or a window open, and for insuring more valuable stuff there are often extra provisions like requiring "x" star locks and bolt, or a class "y" safe or class "z" alarm system and so on. With IT security, it's not just about what stuff you have installed and what systems you have left open or not; IT security is about people and process, as much or more than it is about systems.

      I would disagree with you on this (somewhat). There are well established practices on how to build secure systems, for each major development platform (JEE, .NET, RoR, etc) and also for general decision-making.

      Any organization, big or small, needs to be able to come up with scenarios and questions for things that need care, and for which it might need to provide evidence of attention. The important thing is to execute due diligence when it comes to defending your business against attacks, and to demonstrate providing evidence of such due diligence.

      If we are in e-business or are bound by PCI, HIPAA and/or SOX compliance, the following questions would come to mind (just an example):

      1. Are we addressing the top 10 risks identified by OWASP?
        1. If so, can we quickly identify how we address them?
        2. What other risks identified by OWASP do we address and how?
      3. How do we address CERT alerts and advisories?
      4. Are we on top of security patches?
      5. Are the underlying systems security patches up to date?
        1. If so, can we quickly provide evidence of this?
      7. If we are bound by HIPAA and/or SOX how do we address security concerns that might stem from these regulations?
        1. How do we quickly provide evidence (evidence of process and assurance)?
      9. Do we have a multi-tiered architecture, or do we run everything co-located?
      10. Are back-end databases on their own machines, in their own subnets outsize of a DMZ?
      11. Are "mid-tier" services on their own machines, separated from databases?
      12. Are they in a DMZ? Are they proxied by a HTTP server in different machines?
      13. Do we have firewalls? If so, do we keep an inventory of their rules?
      14. Are we up to date with patches for network assets (firewalls, SSL appliances, etc)?
      15. Are we still on SSL 3.0 or older versions of TLS?
      16. Do we specifically disable anonymous ciphers?
      17. If we use LDAP, do we disable anonymous binds?
      18. Do we use IPSec to secure all communication channels (even those internally, a requirement for banking in several countries)?
      19. If not why? How do we compensate?
      20. If we are in E-Commerce, how do we demonstrate that we are PCI-compliant?

      In my opinion and experience, these questions present the starting point for a framework to determine the right level of security in a system. More should be piled on this list obviously, but anything less would open a system to preventable vulnerabilities.

      And that is the thing. The right level of security is the one that helps you deal with preventable vulnerabilities that you, the generic you, should know well in advance, vulnerabilities that are well documented. How costly the prevention is, that is a different topic, and any business will be hard press to justify to an insurer that they forego to deal with a vulnerability because it was too expense.

      Answers to those questions and evidence of such would constitute proof that an organization followed reasonable due diligence in establishing the right level of security. Moreover, it will have a much greater chance to disarm an insurer trying to find a way to avoid covering damages.

      Notwithstanding the ongoing abuses done in the Insurance business, insurers have rights also. My general health and life insurance is not going to pay up my family if I kill myself while base jumping with blood alcohol levels up the wazoo.

    23. Re:Seems reasonable by Bengie · · Score: 1

      Follow best practices, two factor auth, only white listed executables can run, all non-system programs run in separate VMs/jails, minimum permissions, systems that store sensitive data do not have direct internet access are partitioned into a separate network with a firewall that only allows ports that are absolutely required, any program that can access the internet cannot also access sensitive data, etc etc.

    24. Re:Seems reasonable by Anonymous Coward · · Score: 1

      Pretty much. Lawyers' business is to charge you money to navigate a complex maze of legal stuff that they defined. Lawyers built in the fees and damages associated so they can charge you under those damages to make sure you're protected from the system they created. Sounds unethical? Doesn't matter. Sounds illegal, kind of like a protection racket? It's not because lawyers decide what's legal.

      Get this, during the economic down turn in 2008, pay scales in all industries went down, unemployment went up etc. Even many lawyers were out looking for work and took jobs as paralegals instead of lawyers just for the money. However law firms still raised their rates every year. Despite the labor surplus of lawyers, no lawyer was willing to do actual lawyer work at a cut rate, instead they took work typically reserved for cheaper rates like paralegal work. It's a goddamned collusion scam, except they aren't actually colluding so there's no one to sue, and even if there was, you'd have to hire them to sue themselves. And you'd lose, and you'd pay them for losing.

      I've had several very normal legal issues with my personal life and my business in the past 5 years. People complain about lawyers but most haven't dealt with ti directly. Once you are in it and see how it works, you realize it's no joke, it really feels like racketeering.

    25. Re:Seems reasonable by ArhcAngel · · Score: 1

      Best practices audit is usually code for how many corners can we cut and still be profitable if we get sued for x? Auto manufacturers are notorious for this but all industries do to some extent. A certain ignition switch case comes to mind.

      --
      "A person is smart. People are dumb, panicky dangerous animals and you know it." - K
    26. Re:Seems reasonable by jbolden · · Score: 1

      Yes that's a fair characterization. For companies below the line, i.e. those that would lose a lawsuit easily this is helpful.

    27. Re: Seems reasonable by Anonymous Coward · · Score: 0

      Not in New Hampshire. Live Free or Die.

    28. Re:Seems reasonable by mlts · · Score: 1

      One has to be more specific than "firewalls" and "encryption" as well. I can put up a Linux box, use LUKS for all partitions except the kernel, stuff a rule in nftables, and I can claim I have both "firewalls" and "encryption".

      However, does that mean an intruder from the outside is locked out. Hardly. The disk encryption means nothing when the volume is mounted and the data is being copied from remote.

      What is really needed is going beyond generalities, but having a specific set of guidelines. FISMA comes to mind on this because part of the spec by NIST are security checklists and guidelines by OS and device. With a standard like this [1], it is easier to gauge if a company or organization is in compliance, has issues, or just completely fails.

      Some guidelines also have varying levels of security, because not every machine needs to be at a "high" security level. As stated above, guidelines are not just about what settings are in an OS, but training with people, and basic physical security. Things like waving your badge at the door even though the door is open make significant security differences.

      [1]: Most of it is obvious, like putting your VMWare management NICs on an isolated network, similar with the SAN management ports... but some of it might be useful. AppLocker in Windows comes to mind.

    29. Re:Seems reasonable by Capt.Albatross · · Score: 1

      The hard part is indeed establishing what the right level of security is and how to evaluate companies against that.

      That will be an issue, but I get the impression that many organizations will have to make significant improvements before it becomes a matter of immediate practical concern.

    30. Re:Seems reasonable by greenfruitsalad · · Score: 2

      my previous employer (in the UK) wanted to be able to store credit card details of customers for automatic payment processing. unfortunately for us, a law came out that essentially meant that to get certified, we'd have to switch to MS Windows servers. that was the only platform for which there were guidelines and which could be audited. in the end we gave up and had a 3rd party process payments for us. the law pretty much caused the monopoly of sagepay in the UK.

    31. Re:Seems reasonable by Archangel+Michael · · Score: 3

      I agree with your post. I'll just add that a big problem with IT security is that companies cannot rely on the same level of protection from governments in preventing intrusion.

      I am in IT, but not in Security. However, I don't need to know security to know that a large part of the problem is that money fixes problems, and nobody wants to spend the money needed to fix the problems. Further, problems are pushed down to the people least able to fix them (consumers) more often than not.

      These security breaches are going to be even more prevalent and no amount of security will ever resolve them completely. The real fix, IMHO, is to assume that all this info is publicly traded, even when it shouldn't be, and work the problem from there. IF the systems were in place that made assumptions such as this, the problem is much easier to define, and fix.

      --
      Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
    32. Re: Seems reasonable by mlts · · Score: 1

      For a while after 2001, there were auditors and "security consultants" (described best by another /. poster as "suit wearing chatter monkeys") which would do their job by chucking existing solutions and installing Windows, saying that Linux isn't "Sarbanes Oxley compliant." Thankfully this has gone to a dull roar... but in general, it still remains that an OS with FIPS, Common Criteria, EAL 3, and other certifications is going to be a lot more auditor friendly than one that doesn't.

      I probably would say that an insurance company denying claims is likely the -only- way we (as proles) will ever see most companies start taking proper precautions [1] in keeping their barn doors closed. Regulations won't happen, lawsuits won't do much other than make lawyers rich, and even with bad PR, people will forget about it. Already, all but /. readers have pretty much forgotten about the Sony breaches, because the news media is covering the sins of the Duggar family.

      [1]: Nothing is 100% secure, but proper security precautions are not hard to implement. Disk encryption for laptops is trivially easy. If proper routers are too expensive, a PC with a bunch of NICs and PfSense can do the job for a smaller installation.

    33. Re:Seems reasonable by itsenrique · · Score: 1

      Since we're just talking anecdotes, I heard quotes for felony cases go down considerably from big brand and smaller brand lawyers in my city during and after the recession (since its really still ongoing even though they say it's the "new normal" or whatever).

    34. Re:Seems reasonable by mlts · · Score: 1

      To boot, with physical security, intruders can get shot. However, if an attacker is going after your stuff via the Internet, there isn't much one can do back to hurt them, especially if they are in a country that doesn't like your home nation. It is a purely defensive war, where a victory can't be obtained, but only mitigating or avoiding a defeat.

      However, we do have one thing on our side when it comes to computer security... the air gap. Not 100% secure (as Stuxnet showed), but it forces an attacker to put boots on the ground and deal with physical defenses. Next to the airgap are separated networks (NIPRNet/SIPRNet) that run on distinct leased lines as opposed to just going over Internet VPNs.

    35. Re: Seems reasonable by Anonymous Coward · · Score: 0

      ORLY?

    36. Re:Seems reasonable by fluffernutter · · Score: 1

      The people who know how to determine a reasonable level of security will be the ones left standing in the business in the coming years. Time to either understand various audit levels or get out. I know I won't use cloud services yet because there is no minimum agreed to level of security. This makes all of them mickey mouse in my mind.

      --
      Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
    37. Re:Seems reasonable by I+Read+Good · · Score: 1

      Their shit was being indexed by search engines. I'm willing to bet they didn't do anything right. This is more than likely a major HIPAA violation. You're right; it is about people and process. Their people and processes apparently suck.

    38. Re:Seems reasonable by Charliemopps · · Score: 1

      The hard part is indeed establishing what the right level of security is and how to evaluate companies against that. At least over here, the exclusions for burglary are pretty clear cut: leaving your door or a window open, and for insuring more valuable stuff there are often extra provisions like requiring "x" star locks and bolt, or a class "y" safe or class "z" alarm system and so on. With IT security, it's not just about what stuff you have installed and what systems you have left open or not; IT security is about people and process, as much or more than it is about systems.

      It's fairly simple and done in just about every other industry. The insurance companies will come up with standards. Then 3rd party "Security experts" will pop up offering certification. "We're Security level blackwatch plaid certified! We get a $20k discount on our policy!" etc... Microsoft finds a bug and doesn't patch it? It's hard for your local bank to sue them... but the entire insurance industry?

      This is a good thing.

    39. Re:Seems reasonable by Anonymous Coward · · Score: 1

      Like my dentist who has a Comcast provided gateway device (modem, router, firewall) and all of the patient records on a server for which every staff member knows the admin password and it hasn't been changed, ever, and on which there are three different vendor remote access programs installed. Not difficult to recognize gross negligence there at all.

    40. Re: Seems reasonable by amber_of_luxor · · Score: 1

      >If proper routers are too expensive, a PC with a bunch of NICs and PfSense can do the job for a smaller installation.

      I've come across several individuals recommending that one buy a cheap laptop, configure SmoothWall, or similar Linux distro on it, and use that as a firewall, router, DNS server. One end is connected to the pre-pwned junk from your ISP, and the other end is connected to your system.

      --
      Wind Beneath Thy Wings
    41. Re: Seems reasonable by praxis · · Score: 1

      You're forced to buy car (liability) insurance if you drive.

      In Washington State, and likely other states, you are not forced to buy car insurance if you drive. You may instead buy a liability bond or obtain a certificate of deposit to prove you could pay any liability claims yourself. There are advantages and disadvantages to all the options, but the choices are there.

    42. Re:Seems reasonable by amber_of_luxor · · Score: 1

      Those security breachers will be fixed, once courts start ordering companies whose data was breached, to pay each individual whose data was taken, a minimum US$1,000,000. IOW, 250 people affected, the payout is US$250,000,000. 10,000 people's data is removed, the payout is US$10,000,000,000.

      --
      Wind Beneath Thy Wings
    43. Re:Seems reasonable by ilsaloving · · Score: 2

      While I agree 100% with what you're saying, I think the problem lies in the fact that there is no consistent, *external* measure to indicate your security level, and that's where things fly off the rails.

      There are things like SOX compliance (in the US, anyway), but that's more for auditibility than security. What is the minimum required aspects your infrastructure has to have to be able to say that you're considered reasonably "secure"? Encryption of all data stores using an officially recognised encryption scheme? All logins for all devices managed through kerberos? All communications between devices must be wrapped by SSL?

      I don't know if there's an ISO standard or something that mandates these things, but it sounds to me that until there are some clear minimum requirements to indicate securedness, this all seems like nothing more like a license for insurance companies to print money on the backs of their clients.

      One will *always* be able to give some hindsight response whenever a breach occurs... to the point where companies would have to lock themselves tighter than Fort Knox before they *might* be able to squeeze money out of their insurance provider.

    44. Re:Seems reasonable by ilsaloving · · Score: 1

      That's why the grandparents post mentions audits that are defined by the insurance company. If the insurance companies believes that you've taken all reasonable precautions, then the buck stops there. As the insurance client, your responsibility is to meeting the insurers requirements. If something *still* goes bad, then the insurer gives you money.

      How the insurer reclaims that money is a different question altogether, and is generally irrelevant to you as the client (with the obvious exception of raising your rates).

    45. Re:Seems reasonable by Pinky's+Brain · · Score: 2

      If the insurers get together and set up a minimum requirement for the middle the costs would go down quickly. I'd say that at the minimum records should only be accessible via the intranet, with all machines able to access the intranet being company issued (BYOD is moronic). If internet access is allowed on the same machine it should only be through a virtual machine.

      For financial and medical institutions the cost of a scheme like this should be negligible. My sister works for a bank and at least they have finally started agreeing with me a little, to work at home they now all use company issued laptops with smart card based VPN. She used to do it on her own laptop ...

    46. Re: Seems reasonable by Anonymous Coward · · Score: 0

      For a SOHO or SMB, I've wondered about going one step up, having a machine configured for virtualization with something like ESXi or another hypervisor with a low attack surface. One VM runs a dedicated, hardened firewall appliance and has one NIC and a vSwitch, another is a router appliance. With a fairly decent CPU, the latency by adding 1-2 additional hops from internal traffic to the ISP's devices wouldn't be that bad, and one could easily add more functionality to the setup (DNS caching, squid caching/adblocking, etc.)

      ESXi is ideal for this, assuming a machine with no external USB drives. Just because it is extremely hard to compromise, especially if the management port is secured properly.

    47. Re: Seems reasonable by demonlapin · · Score: 1

      Not only that, all of the laws involved are state-level laws, not federal.

    48. Re:Seems reasonable by benedictaddis · · Score: 1

      Which law is that?

    49. Re: Seems reasonable by Anonymous Coward · · Score: 0

      This is a step down, not a step up. Virtualization opens a couple of other attack surfaces. ESXi has a control panel which may be attacked. Also, if someone break into a virtual machine, it may be possible to escalate into the host system. Get the host system, and you have all of those virtual machines.

    50. Re: Seems reasonable by Aserrann · · Score: 1

      http://www.nh.gov/safety/divis...

      YA RLY

    51. Re:Seems reasonable by Anonymous Coward · · Score: 0

      First question(s) to ask: What is ...and where is... your company's most critical data? What networks and systems are used to provide this data? Degree of Protection should equal Degree of Data Criticality. THEN follow-on with everything you laid out. Companies can't/won't protect everything at the same level.

    52. Re:Seems reasonable by AchilleTalon · · Score: 1

      Not much different than the right level of maintenance for an airplane, a ship, a bridge, a tower or any other complex engineered device. There will always be gray zones where a court will have to rule, however I believe you can perfectly request a certain number of things to be done in order to keep your business and IT infrastructure covered in case of a security breach.

      --
      Achille Talon
      Hop!
    53. Re:Seems reasonable by Anonymous Coward · · Score: 1

      Not a law, an industry standard. The first version 1.0/1.1 of PCI DSS, an industry nonsense standard for credit card processing, basically didn't have a linux/bsd component. Version 2.0 mandated a windows antivirus package on the linux machine performing credit processing, creating a market for non-working antivirus for linux to meet checkbox compliance. Version 3.0 has brought some sanity.

      Basically, the entire standard is a list of nonsense rules (like ISO 9000) and doesn't provide security.

    54. Re: Seems reasonable by coolmoose25 · · Score: 2

      That, and we must never forget that as much as we may applaud the insurance company in this particular story for calling out poor practices, the primary purpose of a modern insurance company is to take your money and give you nothing in return. Everybody needs to be very aware of that, and be untrusting in all your dealings with anyone in the insurance business.

      As in all industries, there are the good and the bad. I would posit that you are speaking about "bad" insurance companies, not good ones. Not every insurance company dreams of giving you "nothing in return" for your premium dollars. Quite the contrary, if insurance companies never paid any claims, there would be no need for them, and their premiums would dry up immediately. The primary purpose of an insurance is to transfer risk... in effect, pooling it and transferring the risk from one entity to several/many. Believe it or not, this enables many things. Even things like the Ansari X-Prize. The organization awarding the prize didn't have the money to pay the prize, they only had about half of it. They used that to buy an insurance policy, which paid the claim when the prize was won. Regardless, most insurance companies invest in their claim handling capabilities as it is a competitive advantage to have good claim paying history. Doubt it? Compare "The General" auto insurance claims paying vs. USAA or Amica. The latter pride themselves on claim paying. Personally, I have a policy for my house, that recently paid a claim and paid on items I never expected them to reimburse me for. Their claim handler went out of her way to make sure I got far more money than I had anticipated. The bottom line is that its easy to pick on insurance companies, but if you do your research and buy policies from reputable companies, you'll likely have a great experience with them when you have to file a claim. If you go for the cut rate, "The General" type companies, well you got what you paid for.

      --
      Brawndo: It's what plants crave!
    55. Re: Seems reasonable by Anonymous Coward · · Score: 0

      Your "ya really" pertains to auto insurance and not healthcare, which is what was being talked about.

    56. Re:Seems reasonable by luis_a_espinal · · Score: 1

      First question(s) to ask: What is ...and where is... your company's most critical data? What networks and systems are used to provide this data? Degree of Protection should equal Degree of Data Criticality. THEN follow-on with everything you laid out. Companies can't/won't protect everything at the same level.

      The questions I suggested are specific to individual systems and departments, not to be applied to the entire organization as a whole. Then the collection of the results per system or department constitute a global snapshot of how security is handled.

    57. Re: Seems reasonable by Anonymous Coward · · Score: 0

      I've dealt with auditors that stuck to the same checklist for Windows XP for over 5 years. We were expected to "extrapolate" the checklist to Windows XP x64, Windows 7, Windows 2000, Solaris, Linux, HP-UX.

      One auditor didn't like the fact that the date given by a Unix tool was the number of days since the epoch instead of a formatted number.
      We got dinged because we required administrator intervention to unlock an account instead of unlocking after an hour.

      This kind of thing happens with USDA audits too. If a salt cured prosciutto gets 1 degree above a certain temp, they make the deli throw it out. Prosciutto is made safe by its salt content. Temperature has little to do with it. They've driven most delis in NYC to stop curing their own meats. Imagine throwing out a cooler of hams (10s of thousands of $$$) because of a wrong checklist.

  2. Completely agree by zynperor · · Score: 2

    In a similar way, most home owner's insurance will also not pay out if there is no sign of forced entry. I also foresee patient litigation for allowing publicly accessible records on the internet.

    1. Re:Completely agree by delcielo · · Score: 1

      This. I'ts important to understand your policy. You can purchase a policy that covers that situation, but it will cost more.

      If you're buying insurance to cover security breaches, your most likely risk is that it happens from some level of negligence (negligence being the legal meaning), a poorly crafted firewall ruleset, or an unpatched server, etc. So it makes sense to purchase a policy that covers negligence. It will be more expensive; but a policy that doesn't cover negligence is probably not very useful.

      --
      Hot Damn! It's the Soggy Bottom Boys!
  3. Ahh..a pity. by fuzzyfuzzyfungus · · Score: 5, Interesting

    For one brief shining moment, I thought that this story was about a health insurance company being dragged into court and beaten on by their insurance company; and my heart leapt and sang with the unalloyed joy of a Norman Rockwell puppy; because that would just be so beautiful.

    Alas, 'Cottage Health' is a medical provider of some sort, so such feelings swiftly evaporated.

    That aside, this seems like a situation that is simultaneously common sense(Obviously you won't be able to buy 'cyber insurance' that covers egregious negligence, at least not for any price that doesn't reflect an essentially 100% chance of payout, plus the insurer's profit margins and transaction cost); and likely to be an endless nightmare of quibbling about what 'security' is.

    We've all seen the long, long, history of attempts to do security-by-checklist, most of which allow you to say that you 'followed industry best practices' by closing the barn door after the horse is long gone, so long as the barn door was constructed with galvanized nails of suitable gauge and is running any antivirus product, efficacy irrelevant. It's not as though 'security' is fundamentally unknowable and intersubjective, man; but it sure isn't something you'd want a lawyer or a layman attempting to boil down into a chunk of contractual language. Barring some miracle of clarity, I suspect that we'll see quite a few dustups that basically involve the insurer's expert witnesses smearing the policyholder's security measures(if they did it by the checklist, the expert witnesses will be snide grey hats who eat 'best practices' for lunch, if they deviated from the checklist, it'll be hardasses on loan from the PCI compliance auditing process, if they implemented a mathematically proven exotic microkernel it'll be somebody asking why Windows Updates weren't being applied in a timely manner); and the policyholder's expert witnesses puffing like salesmen about how strong the security was; and how it must have been an 'advanced persistent threat' to have hacked through such durable code walls.

    The fundamental question of 'did you fail to lock the door, or did somebody take a crowbar to it?' is sensible enough in the context of an insurance claim; but rigorously defining what 'locking the door' means in a complex IT operation; and where the boundary between 'incompetence' and 'unavoidable imperfection' lies, is not going to be pretty. My only hope is that if any of these go to jury, the lawyers decide to strike anyone who sounds like they might know something about computers; because it's going to be a long, boring, slugging match of a case.

    1. Re:Ahh..a pity. by AbRASiON · · Score: 3, Funny

      You think that's bad? I very briefly thought this was due to some laptop / hardware being forced open by LAX airport security staff.

    2. Re:Ahh..a pity. by Anonymous Coward · · Score: 0

      We've all seen the long, long, history of attempts to do security-by-checklist, most of which allow you to say that you 'followed industry best practices' by closing the barn door after the horse is long gone, so long as the barn door was constructed with galvanized nails of suitable gauge and is running any antivirus product, efficacy irrelevant.

      Sadly, we do still need checklists, as this case seems to illustrate. First item on that checklist: no system should be directly connected to the Internet unless its purpose is to directly send information to the public at large.

      There's a lot of people on this planet that are on the left-hand side of the proverbial bell curve, and quite a few are running IT systems. "Common sense" is not all that common.

    3. Re:Ahh..a pity. by OzPeter · · Score: 1

      Sadly, we do still need checklists, as this case seems to illustrate. First item on that checklist: no system should be directly connected to the Internet unless its purpose is to directly send information to the public at large.

      I disagree that checklists are a "sadly" item. To me they are the bare minimum. If you don't have a checklist of best practices (EG the example you gave or also at a more detailed level only storing hashed and salted passwords) how will upcoming software architects know what they should be doing? If the software industry really wants to earn the "engineering" moniker, then it is going to have to start enforcing some ground rules.

      --
      I am Slashdot. Are you Slashdot as well?
    4. Re:Ahh..a pity. by Anonymous Coward · · Score: 0

      If the software industry really wants to earn the "engineering" moniker, then it is going to have to start enforcing some ground rules.

      Exactly. If a civil engineer designs a bridge that has design defects and falls down after one year and kills a dozen motorists, that engineer will be held responsible.

      So far programmers have skirted any form of accountability or responsibility, while still collecting big salaries and calling themselves "engineers", though without any of the rigor of actual engineering. That needs to change. Only when there is actual accountability for building in flaws that allow leaks of medical and other sensitive data will we start to see a change.

      Until then? Why should anyone change, if they never have to take any responsibility?

    5. Re:Ahh..a pity. by Anonymous Coward · · Score: 0

      My company decided not to take a cyber insurance, because it seems pointless to the legal department even trough we had recently a intrusion.

      Someone smuggled a unauthorized network device, a true artwork, it connected to the network poising as authorized device out of work ours and then connected to the attacker machine to give then access to our internal network, the smuggler luckily was identified for its stupidity and now is in a criminal process thought the investigation is continuing to identify the true perpetrator.

      Basically if our company that due to the work that it does it takes security very seriously can have a security breach, after all the only computer really secured is the one powered off and without means to turn it on, can have a breach if the attacker is really interested there are no network secure.

  4. The problem is the doctors. by jellomizer · · Score: 0, Offtopic

    Health care system give too much power to the Doctors, and they get their hands into everything. They figure because they went to medical school they seem to be an expert on all thing. But because they are in such a position of power other non-clinical departments need to kiss up to them. We can get a 5 minute pitch to say why we may think it may be a bad idea (usually out of the blue as it becomes a surprise change) but if it technically can be done it will end up having to be implemented. And they want it now with no patients for testing, and way too cheap to setup a good testing environment.
    Then we have issues because we were forced to implement a bad design, then it is a case those IT guys screwed up again! Even the fact it mostly worked is a near miracle that it even works.

    We can have better and safer health care IT if the doctors shut up and take what we make for them. They can state there problems on the high level, but they will nitpick into a crap system.

    --
    If something is so important that you feel the need to post it on the internet... It probably isn't that important.
    1. Re: The problem is the doctors. by Gooba42 · · Score: 1

      Doctors are terrible businesspeople. I work in the patient refunds department for a very large insurer and it's absolutely out of control. I've seen 12 year old refunds of simple duplicate payments. It often takes them 4 years to notice a payment which wasn't even for them. The most basic of "does this account balance" is beyond them.

      It's bad when they do their own books but it's still bad when you let them hire their own office staff. They need to be firewalled away from the business side of their practice in a big way.

      --
      I just found out there's no such thing as the real world. It's just a lie you've got to rise above. - John Mayer
    2. Re: The problem is the doctors. by jimbolauski · · Score: 1

      All the doctors I have been to have an accounts person or people that handle the claims and billing. It may be the case that the person they hired is not qualified to manage healthcare claims and billing as the process has changed a great deal over the last 10 years, but I would not stick this on the doctors.

      --
      Knowledge = Power
      P= W/t
      t=Money
      Money = Work/Knowledge so the less you know the more you make
    3. Re:The problem is the doctors. by Anonymous Coward · · Score: 0

      Health care system give too much power to the Doctors, and they get their hands into everything.

      Whereas every doctor I know complains about how the businesses people are always trying to make decisions for them, how management gives them no power or authority, and anything that management wants, will have to be done, if it saves money in the short term, with no consideration for patients and way too dishonest to admit to not even thinking about care.

  5. Frighten them with this story by Bruce66423 · · Score: 1

    This may offer a useful weapon in such debates; doctors - having been sued for everything - have developed a respect for the impact of law suits. Beyond that: making sure that your concerns are logged in an email to your supervisor gives you significant protection - and looking for another job may be the only answer after that...

  6. Perfect Security is Easy... by Anarrandir · · Score: 1

    All you need to do is take some scissors to your Ethernet cable and put your server in a locked room. You now have unhackable data. There are absolutely lax security practices out there, but being connected inherently carries risk. Our job is to minimize that risk as much as possible through best practices, but nothing is absolutely bulletproof. Security isn't a destination either, it's an investment that never goes away. The day a business stops making that investment is the day their risk goes up.

    1. Re:Perfect Security is Easy... by Anonymous Coward · · Score: 0

      All you need to do is take some scissors to your Ethernet cable and put your server in a locked room. You now have unhackable data.

      Ooh, wrong, turns out the system had a WiFi setup.

      Security isn't a destination either, it's an investment that never goes away. The day a business stops making that investment is the day their risk goes up.

      Actually, it's the day they start thinking about stopping that the risk goes up.

    2. Re:Perfect Security is Easy... by Aristos+Mazer · · Score: 2

      Stuxnet got onto Iranian centrifuges disconnected from the Internet and in locked and secured facilities. The problem is that at some point, someone has to communicate with these systems, so perfect security isn't possible... even just talking to them runs into the "little Bobby tables" problem.

    3. Re:Perfect Security is Easy... by jbolden · · Score: 1

      A server not connected to a network in a physically secure location was the situation for the computer that Bradley Manning stole from.

    4. Re: Perfect Security is Easy... by Anarrandir · · Score: 1

      I was being facetious - all systems have to be accessed in order to be useful. Cord-cutting is meant to illustrate the point that they are rendered effectively useless in the pursuit of obtaining absolute security. Some people think jokes are less funny when they are taken literally, over analyzed, and explained in explicit terms. Even that can be entertaining in its own way, thanks.

    5. Re: Perfect Security is Easy... by Anarrandir · · Score: 1

      And here I thought the humor would sail over people's heads. ;)

  7. Commercial software quality assurance? by nickweller · · Score: 1

    Licensed application end user license agreement

    Microsoft End User License Agreement

  8. One possible way forward... by fuzzyfuzzyfungus · · Score: 2

    In thinking about it, and how much of a clusterfuck this is likely to be; it struck me that there might actually be a way to restructure the incentives to provide some kind of hope:

    Historically, 'retail' insurance, for individuals and little stuff, was mostly statistical with a side of adversarial: Aside from a few token offers of a free fitbit or whatever, the insurer basically calculates your expected cost as best they can based on your demographics and history and charges you accordingly, and tries to weasel out of anything too unexpectedly expensive.

    However, for larger endeavors, (the ones I'm most familiar with are utility and public works projects, there may well be others), sometimes a more collaborative model reigned: the insurer would agree to pay out in the event of accidents, jobsite deaths, and so on, as usual, and the client would pay them for that; but the insurer would also provide guidance to the project, best practices, risk management, specialist expertise on how to minimize the number of expensive fuckups on a given type of project, expertise that the customer might not have, or have at the same level. This was mutually beneficial, since the customer didn't want accidents, the insurer didn't want to pay for accidents, and everyone was happiest if the project went smoothly.

    In a case like this; the incentives might align better if the contractor were were delivering both the security and the breach insurance: this would immediately resolve the argument over whether the policyholder was negligent or the insurer needs to pay up: if the IT contractor got the systems hacked through neligence, that's their fault; and if they secured the systems; but a hack was still pulled off, that's where the insurance policy comes in.

    This scheme would run the risk of encouraging the vendor to attempt to hide breaches small enough to sweep under the rug; but it would otherwise align incentives reasonably neatly: an IT management/insurance hybrid entity would internalize the cost of the level of security it manages to provide(more secure presumably means greater expenditures on good IT people; but more secure also means lower effective cost of providing insurance, since you can expect fewer, smaller, breaches; and fewer, smaller, claims). If the equilibrium turns out to be 'slack off, pay the claims', that suggests that the fines for shoddy data protection need to be larger; but the arrangement would induce the vendor to keep investing in security until the marginal cost of extra work on IT was higher than the marginal gain from lower expected costs in claims; so the knob to turn to get better security is relatively accessible.

    1. Re:One possible way forward... by aaarrrgggh · · Score: 2

      Both levels need insurance, but I think you are right that the consultant needs the E&O coverage. One failure in the parallel though is time; if a bridge is built, the claim period lasts about 5-10% of its life. Same goes for most nonresidential buildings. What happens when a consultant is replaced on an account? Where does the new consultant assume liability for existing changes? Software bugs? Unpatched systems?

    2. Re:One possible way forward... by BVis · · Score: 2

      if the IT contractor got the systems hacked through neligence, that's their fault; and if they secured the systems; but a hack was still pulled off, that's where the insurance policy comes in.

      The IT contractor can't stay on-site 24/7 and monitor all the employees. The biggest security problems come from inside the organization; from idiots writing down their passwords to double-clicking on every single attachment that they get, users will never stop creating new and interesting ways to be complete fucking idiots.

      If I'm an IT consultant and suddenly have to take on the responsibility for all security breaches, I'm going to find another line of work. I'd spend all my time defending lawsuits from my clients who had a security breach due to nothing that I've done (or didn't do), but instead due to some moron ignoring the written AUP that I left with the client. Since as an IT consultant everything that happens on that network is my fault, I get either dragged into court by my client or my insurer refuses to pay and drops me, leaving me holding the bag for something that wasn't my fault. By the time I get done proving that what happened was not my responsibility, I've spent so much time getting the legal system to understand what happened and why it wasn't my fault that I haven't been able to create billable work for my other clients (if I have any after one of my clients gets broken into).

      The only way to avoid that would be to have a voluminous contract that covered as many "if your worker does X I'm not responsible" cases as could be described, and to have a network so locked down that people would barely be able to log into their computers. No client is going to put up with that, despite the fact that that's what they desperately need: to be protected from themselves. (And no client is going to sign that contract, because then it looks like you're trying to avoid responsibility for your work.) Plus you have the problem of your client refusing to implement a security precaution they desperately need because they refuse to change any of their processes, since "we've always done it that way". (Case in point: I used to work somewhere where we were storing complete CC information, including CVV codes, which is a BIG TIME PCI no-no. I put a stop to the CVV storage, but our back-office accounting system would not accept anything other than a complete CC number and expiration date for reconciliation later. I pointed out that we had no compelling business case to store that information, and got back "we've always done it this way". They refused to believe that we could have avoided storage and handled back-orders and refunds through tokenization supported by most major credit card vendors. So then they had a breach that cost them $200,000. They didn't change any of their processes.)

      No, the clients are the ones who need to be held responsible for data breaches. Make them expensive enough and they'll start paying attention, hopefully. Make them prove that they followed all the best practices required by the insurer AND all instructions given by the consultant, or don't pay. Only when companies start going out of business because their security was shit will people finally wake up. (Maybe the CEO goes to jail, too. A man can dream...)

      --
      Never underestimate the power of stupid people in large groups.
  9. Gotta love it by JRV31 · · Score: 1, Offtopic

    An insurance company trying to screw an insurance company. Gotta love it.

    1. Re:Gotta love it by Anonymous Coward · · Score: 0

      Cottage Health System isn't an insurance company, it's a healthcare provider (hospitals, clinics, etc).

  10. Unamerican by Anonymous Coward · · Score: 1

    This insurer should be jailed. The nerve.

    1. Re:Unamerican by fluffernutter · · Score: 1

      Since when is it unamerican to screw people over in the name of keeping profits for yourself? I've come to know that as the very definition of American.

      --
      Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
  11. Showing once again how worthless insurance is by smooth+wombat · · Score: 0, Troll

    Insurance is the biggest scam ever perpetrated in the history of mankind. You pay and pay and pay some more, then, when you need to use it you're given every excuse possible why the coverage you've been paying for doesn't apply.

    When one takes into consideration the thousands of dollars each year the average person pours down the drain for insurance, it's no wonder people are going broke. That money could be used for more productive endeavors such as food, housing, education or transportation.

    Instead, the money is lost in the ether, used only to enrich a few while the many bleed from a thousand cuts.

    --
    We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
    1. Re:Showing once again how worthless insurance is by linuxgurugamer · · Score: 1

      I'll listen to your complaint after you have collected $40,000 to replace that car you just totaled. Doesn't matter whose fault it was, you will still collect. I'll agree that it seems like they are trying to screw everyone, but in the majority of cases they do pay up. Maybe not as much as you think you should get, but they do. Same for health insurance. I'm going to be donating a kidney in a few weeks to someone who needs it. The total cost of both operations (the one to take it from me and the one to implant it in the recipient) will be over $100,000. Guess what? Insurance is paying.

    2. Re:Showing once again how worthless insurance is by smooth+wombat · · Score: 0

      A) Insurance NEVER pays to replace a car, even if it is totaled. They give you 80% of the current value.

      B) I have 40K to replace MY car which the other guy totaled but which HIS insurance won't pay anything near what it costs me. I could sue him in court for damages to recover the rest of the money but insurance companies have seen to it that you really can't sue in court any more because they would have to do what people are paying them to do.

      C) Your donation of a kidney is your choice. That is completely different than someone plowing into me which has happened with every car I have every owned. Mainly as I'm the last guy in line.

      --
      We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
    3. Re:Showing once again how worthless insurance is by Anonymous Coward · · Score: 1

      I had a baby that required NICU care for 7 days. His lungs weren't fully matured and he was having difficulty breathing, so he had to be placed on C-PAP and eventually a tiny little ventilator. The cost for the life saving care that he needed totaled well over $200,000, of which I paid 0. So tell me again how the couple hundred dollars a month I pay in health insurance isn't worth it?

  12. affordable insurance act by Anonymous Coward · · Score: 0

    so now the insurers can be denied coverage because of a pre-existing condition, how does it feel guys?

  13. Good ... by gstoddart · · Score: 2

    because Cottage and a third party vendor, INSYNC Computer Solution, Inc. failed to follow "minimum required practices," as spelled out in the policy. Among other things, Cottage "stored medical records on a system that was fully accessible to the internet but failed to install encryption or take other security measures to protect patient information from becoming available to anyone who 'surfed' the Internet," the complaint alleges

    And now what we need is criminal/financial penalties for companies who are so blindingly inept at security.

    If your business model involves confidential personal information, and you are this incompetent, you have no business being in the business you're in.

    This just screams someone was lazy, stupid, indifferent, or cheap ... possibly all of these things.

    I can completely see insurance companies saying "hell no we're not paying".

    When companies start having actual liability for being that terrible at security, they'll do something. Right now, they can mostly just say "wow, we wish we were sorry".

    --
    Lost at C:>. Found at C.
    1. Re:Good ... by Anonymous Coward · · Score: 0

      They were banking on building a system for as cheap as possible while making the most money they could charge and getting out before the security breach occurred. They failed.

  14. Since when do insrurers pay for stuff? by Anonymous Coward · · Score: 0

    Thats not how you make profits!

  15. I've worked directly with doctors by sjbe · · Score: 0

    Doctors are terrible businesspeople.

    Really? I know quite a few and am married to one and many of them are quite good at business. Many are terrible and/or disinterested but your brush is a little to broad. If doctors in general were terrible at business in general then they would lose money and there is very little evidence of that occurring on a widespread basis.

    I work in the patient refunds department for a very large insurer and it's absolutely out of control.

    Ahh, so you only see the problem cases but lack the larger perspective of seeing all the things that happen correctly.

    It often takes them 4 years to notice a payment which wasn't even for them.

    Ahh, I see you are confusing what the doctor does (administer medicine and oversee the business) with what their accounting staff does. Doctors typically have a large staff to administer a rather ludicrously large paperwork burden. The fact that some payments get lost between the cracks should surprise no one. I'm an accountant (among other things) and I can assure you that it is not terrible difficult in a busy organization for a payment to get mishandled. I also have worked in healthcare systems and doctors offices and have a pretty good appreciation for what goes on there. It's not nearly as easy as you seem to think it is.

    It's bad when they do their own books but it's still bad when you let them hire their own office staff.

    Sounds like you have never tried to run a business yourself. Might give it a go before you start throwing stones at others.

  16. Thats fine by Anonymous Coward · · Score: 0

    If you dont believe they have tight enough security... then REFUSE TO SELL THEM INSURANCE.

    To come back after years of insurance payments & say "oh im sorry your security sucks, not our problem" is unmitigated bullshit.

    But they'll get away with it because insurance fraud is legal... so long as youre an insurance company.

    1. Re:Thats fine by Anonymous Coward · · Score: 0

      Both parties signed a contract. The insurance company said "If you put these basic measures into place, and you still get hit, we'll pay out." They didn't put those measures into place, so the insurance company doesn't have to pay. That's not insurance fraud.

  17. Well thats news to me by Anonymous Coward · · Score: 0

    I've been paying auto insurance for 20 years.... never had them pay for a single thing.

    Mostly because i dont get into accidents.

    Well except for that one time State Farm invented an accident i never had just so they could jack up my rates. That fraudulent invented accident apparently paid $5k out to someone... i was never able to find out who though.

    Then there was the dental plan i got through my company health plan. When i went in for a cleaning, i was told it didnt pay for cleanings, only oral surgery. However 2 weeks later when i needed oral surgery the -very same policy- didnt pay for oral surgeries, only cleanings.

    Then there was the time i got food poisoning. I only found out -after- the hospital stay that the policy that -said- it covered emergency hospital care didnt actually do that & i had to pay 100% out of pocket.

    In my book, insurance is a synonym for fraud.

  18. Audit before issuing policy by ITRambo · · Score: 1

    An insurance company that wants to start insuring new things should understand what they are insuring. They need to run tests beforehand to determine if the level of security is acceptable prior to issuing said policy. This would be similar to my getting a physical before obtaining a large dollar amount life insurance policy. The company wants to be fairly certain that my health is at an acceptable level and I am not expected to die soon from natural causes. Issuing policies solely as a means to profit, without proper due diligence, and then refusing to pay a claim seems unethical. Let the courts sort this one out.

    1. Re:Audit before issuing policy by Anonymous Coward · · Score: 0

      No, if they ran tests beforehand, they couldn't collect money for something they wouldn't have to pay out. Where's the incentive for the insurance company? This way, they have close to zero liability, and collect premiums until the lawsuit is settled.

    2. Re:Audit before issuing policy by SecurityGuy · · Score: 1

      The claim is that the insured made a bunch of medical records available to the public on the internet, presumably by accident. Unless that happened before the policy was in place, due diligence wouldn't have revealed a mistake that was going to be made later.

      There does seem to be a valid business need for "my employee screwed up" insurance. Companies that want that kind of coverage should probably make sure that's what they're buying.

  19. Prob'ly gonna start a fight by SpeedBump0619 · · Score: 1

    Don't really wanna make it tough
    I just wanna tell you that I had enough
    Might sound crazy,
    But it ain't no lie,
    Bye, bye, bye

  20. Password Policy? by Greyfox · · Score: 1

    I'm guessing they made their employees change their passwords every 2-3 months.That's pretty much all the precaution any company I've ever worked for has taken.

    --

    I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

    1. Re:Password Policy? by Anonymous Coward · · Score: 0

      I'm guessing they made their employees change their passwords every 2-3 months.That's pretty much all the precaution any company I've ever worked for has taken.

      And that makes for less secure systems. People who are forced to change passwords regularly, have to pick something they can remember easily. So they have easy passwords. People allowed to have one good password forever, can remember a really tricky one.

  21. Finally Lawsuit for Incompetance by Anonymous Coward · · Score: 1

    Let's see them apply this to IT support outsourced Overseas.

    Let's see

    Outsourcing = $.002 per call

    Insurance for outsourcing $ 200000.00 per call

    Nope the numbers don't add up

  22. Checklist is the right answer by Slashdot+Parent · · Score: 1

    Actually, security by checklist is the way to go for writing an insurance policy. An underwriter should be able to work out actuarial tables for companies that follow which security best practices, and then price policies accordingly. For instance, if you pass a PCI scan and have virus scanners installed and don't give your users admin rights, and have websense installed, and you have data of $X value, you have an Y% chance of getting jacked, so your policy costs $Z.

    I'm not saying that the checklist should be the company's only security practice. That would be madness. I'm just saying that the insurance underwriter should be able to use a checklist to quote an insurance policy.

    --
    They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock
  23. I know nobody Rs TFAs, but really... by SecurityGuy · · Score: 1

    They weren't hacked. They accidentally put a bunch of medical records online according to http://www.noozhawk.com/articl... (linked from the article). If they bought an insurance policy that only pays out if they follow "minimum required practices", and they didn't, then of course it shouldn't pay out.

  24. Brutal Irony by Lorigo · · Score: 1

    Ah, the brutal irony of these medical insurers not being covered by THEIR insurance. It harkens back to the days when the medical insurance industry claimed that patients’ pre-existing conditions disqualified them from coverage. I guess a pre-existing condition is now considered a compromise or malware infestations. Unfortunately their deep pockets will be able to cover their losses while individuals often times couldn’t cover the medical care or went bankrupt because of the exorbitant costs.

  25. finally a sane response. by markhahn · · Score: 1

    Finally the security offenders are forced to pay. It's weird how coverage gets all hung up about finding and punishing the perps.

    It's also weird how we're very comfortable with self-regulating systems like The Market or Evolution, but don't seem to think that these systems require feedback. How many security breaches would be avoided if there was consistent (negative) feedback?

  26. Would never happen for me by Anonymous Coward · · Score: 0

    they'd find some way out of it.

    They do every time.

  27. Really bad Law by JimSadler · · Score: 1

    I am at the point of saying that almost all insurance should in itself be illegal. Often employees fail to do as they are asked in a business. sometimes the people at the top of the chain of command must simply accept employees statements that work is properly completed. I have been in a situation in which the president of a substantial company went a bit senile as he was past 80 years of age. Frankly many things could slide by the old guy without him understanding that something was wrong. So even if an insurance company claims that something was seriously wrong with a companies security i really have trouble blaming a company unless the entire situation is known and really it never is. On the other hand I see car insurance as a joke and a bit of theft hoisted upon the public. Auto insurance simply never has high enough limits to actually properly pay a seriously injured person. Requiring people to carry insurance on each other bodies eliminates responsibility as pay outs larger than in the policy are almost unheard of in my state. So if you come out of a wreck and lose both eyes and both legs most peoples' auto insurance will not even cover a helicopter to rush you to a trauma center and all of your medical bills will fall upon you despite the other guy clearly being 100% at fault. And medical insurance allows doctors to bill at absurd rates. In short insurance really needs to be banned.

  28. No insurance against stupidity and ignorance by Anonymous Coward · · Score: 0

    I don't know any insurance that offers a payout in the event that *I* screw up. I don't see how companies can purchase any insurance against their own negligence. If such a thing did exist then you can be damn sure I'll buy the insurance just so I don't have to work hard.

    If you can, disclaim liability. If you can't, insure against it. If you really can't, cover it up and hope no-one notices.

  29. Excellent by gweihir · · Score: 1

    This is the only thing that will get us better enterprise IT security. Insurances actually care about not paying, and hence they care about actual risk. They do not care about "compliance" unless it actually decreases their risk.

    (Side note: Anything you cannot get insured, like a nuclear reactor, is a very bad idea in the first place.)

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  30. So what's the point of the insurance? by guruevi · · Score: 1

    The insurance would only kick in where the insured doesn't do their job securing the data. There is no in-between in computer security, you either implement security and it works or you don't and you take an insurance for when the inevitable happens.

    --
    Custom electronics and digital signage for your business: www.evcircuits.com
  31. Working from home is irrestible by Bruce66423 · · Score: 1

    People want to work from home and companies recognise that this is desirable, so I think you're hoping for too much in trying to ban it. However making it safer - and getting insurance companies to impose the right constraints - may be the best way forward. 'If your system is hacked because an unauthorised laptop was attached to it, we don't pay out' should be a standard insurance clause. Similarly trying to separate the email system from the rest of system to sandbox spear fishing attacks should be required.

    The point of course is that risks always exist; the challenge is to identify them and manage them. At the moment those risks are not being recognised, and the insurance companies are beginning to take exception to taking the fall for things going wrong.