[H|Cr]acker Insurance 175
Spellbinder writes "yahoo has an article on
Hacker insurance, also known as "network risk insurance," has been on the market for about three years, but is expected to explode from a $100 million sideshow into a $2.5 billion behemoth by 2005, according to insurance industry projections."
Wow (Score:5, Insightful)
An analogy (Score:5, Funny)
Re:An analogy (Score:5, Informative)
Re:An analogy (Score:4, Insightful)
I don't know about you, but I wouldn't want bits of (conductive) graphite floating around if *I* were in a space ship.
Re:Wow (Score:4, Insightful)
When a company buys insurance they are 100% guarenteed to recover losses from a crack.
When a company spends that money on an admin, the chance for being broken into goes down, but will never be 0%
Disclaimer: This assumes the company negotiates a "good" insurance contract, and fullfills all of their requirements.
Re:Wow (Score:5, Insightful)
When a company buys insurance they are 100% guarenteed to recover losses from a crack.
When a company spends that money on an admin, the chance for being broken into goes down, but will never be 0%
Taking out h/crack insurance, then, lowers the incentive for additionally investing in proper network security (e.g. a decent sysadmin). The companies, if the insurance leaves them feeling "financially safe" from an attack, will be even less inclined than they are now to implement proper security. In "normal" insurance, this sort of thing amounts to negligent/deliberate behaviour that in some cases will make the insurer decide not to pay. If enough people leave their networks vulnerable, and the insurers are struggling to stay afloat as a result, then they are going to start getting more strict about the conditions of the insurance vs premiums (as happens in auto insurance, more security features on a car imply general lower risk and thus lower premiums). I don't see why it should be any different here. If companies are making almost no effort whatsoever to secure their networks (as many companies do now), then the insurer either should refuse to cover them, or they should have to pay much larger premiums. (Although then it starts to look like the old "then whats the point of insurance" argument; disability insurance providers in my country routinely refuse to even consider covering people with a medical past that includes things like even very minor back problems. In other words, they will only cover people who do not represent much of a risk at all). However, in the case of 'network insurance', its deliberately irresponsible behaviour that places one in a high risk group (e.g. like smoking).
Re:Wow (Score:4, Insightful)
Nope. You don't understand much about insurance if you think that
I worked in that industry for 5+ years, this is a second/third career for me.
Insurance companies are above all else cautious. They make money by not paying claims. That is not to say they do not pay legitimate ones, they do do that, contrary to popular opinion.
The do however analyse risk, and charge money to their customers to offset the potential payout that risk represents.
I would be willing to bet that a prerequisite for obtaining said 'crack' insurance would be passing an audit by one of their security folks, particularly when obtaining big policies with large potential payouts.
It's no different than fire insurance, if you want a million dollars of fire insurance, they're going to come down, and make sure you're not running an explosives factory in which everyone smokes at their 'station'.
Insurance doesn't encourage sloppiness, in fact, in North America, many of the early fire brigades were sponsored by and run by insurance companies themselves.
Insurers don't want to pay those claims any more than you want to be put out of business by a cracker. They'll ensure you've got an adequate plan, and they'll ease the financial blow, but believe me, what they won't do is let you drop all pretense of security, just because you're insured.
In fact, just before Y2K, the entire industry rushed to put in 'exclusions' -- i.e. they wouldn't pay a penny for Y2K related catastrophes, unless you paid HUGE dollars to them (because they hadn't had the benefit of collecting money for that specific risk).
This is just a sign of the times, Insurance companies are getting more in tune with technology, and likely have a panel of experts they can call on for inspecting/auditing, and assessing claims against that kind of risk.
Re:Wow (Score:2, Informative)
One of the best ways to reduce the risk to the insurance company is to introduce "self-insurance" where the customer has claim to bear some of the cost of any claim - like the excess on your car insurance policy. For these policies, the customer's probably liable for something like the first $5 or $10 million of any claim.
I'd also expect the insurance company to follow up any large claims with another audit, to see if any of the security controls and procedures had become lax since the time the policy was taken out, and there'll be a standard clause to reduce/invalidate the claim if anything's found in this audit.
Re:Wow (Score:2)
What is the value of a lost reputation? What is the value of a system administrator that built that reputation?
Insurance is for the short-sighted.
Re:Wow (Score:5, Insightful)
You are most likely wrong. Insurance companies aren't stupid, and they're not going to charge everyone the same rate any more than auto insurance companies charge everyone the same rate regardless of their driving record. They'll give better rates to companies that have good security practices and good track records than ones with bad practices and records. They may even refuse to offer insurance unless the companies follow specified practices; I'd guess that hiring certified administrators would be one required practice. This is similar to the way that insurance companies won't sell you auto insurance if you don't have a driver's license, or some homeowners insurance companies won't sell burglary insurance unless you have a home security system. I'd also expect that a well run insurance company would not offer 100% coverage. They'll probably only offer 80-90% coverage, so that companies still have a strong incentive to protect themselves.
FWIW, there was some discussin of these insurance policies on /. in the past. One article pointed out that insurance companies were charging more if a company used Windows than if it ran Linux or a Unix variant because of Windows's inferior security track record. If they're already smart enough to do that, you can bet that they'll be smart enough not to let companies slack off in their efforts to secure their computers after they've bought the insurance.
Re:Wow (Score:3, Insightful)
These are PHBs we're talking about.
The answer is "$35,000, and $36,000 if he has an MCSE".
Risks... (Score:2, Funny)
Re:Risks... (Score:3, Funny)
Re:Risks... (Score:2, Insightful)
Re:Risks... (Score:2)
The one thing the article doesn't mention, but I (at least) would find interesting is how the rates vary by OS (and distriubtion). Anyone have any info?
First lame insurance post. (Score:1, Funny)
Re:First lame insurance post. (Score:2)
So, did the insurance industry unleash the slapper worm on companies that would not buy "network risk insurance?" I would not suprise me at all.
Imagine what we as a society could do with the billions and billions we piss away on vapor products like insurance if we spent it on something that benefits society in a tangible way like health care, or replacing our crumbling infrastructure.
Re:First lame insurance post. (Score:4, Interesting)
Imagine the billions and billions we wouldn't have to piss away on insurance if we clamped down on the trial lawyers.
When a medical malpractice suit can cost $100M, a doctor can't afford to diagnose a common cold without malpractice insurance.
And when that lawsuit can cost his malpractice insurance company $100M, no insurance company is going to write a policy unless your doctor pays $100K/year in premiums.
And when your doctor's paying $100K/year in premiums, is it any wonder that he charges you $100 to diagnose a common cold?
Gee, when it costs you $100 to get a common cold diagnosed, anyone with sprog can't afford to get medical care... without insurance. (Gee, what a coincidence :)
We need to break the trial lawyers by putting caps on the Landshark Lottery.
Re:First lame insurance post. (Score:2)
Malpractice insurance is something no competent health care provider needs anyway, only the quacks need it, and it gives them a license to be careless. Tort is the only recourse the public has for medical malpractice, dangerous products, negligence, and many other things with no criminal penalties. Tort reform could give the incompetent and unscrupulous a license to do vast harm to an even greater degree than the insurance industry does. It is not the solution the corporate media, who are strongly tied to insurance companies make it out to be.
By the way, lawyers aren't the ones who decide how much in compensatory damages should be given to victims, or how much in punitive damages should be charged to perpetrators. Juries do that.
Abolishing lawyers is not the answer. Abolishing punitive damages is not the answer unless criminal penalties will be substituted for them. Strict regulation the insurance industry, including bans on shakedowns like malpractice insurance and hacker insurance,however, would be a great idea.
Re:First lame insurance post. (Score:2)
But how would they cover the debt.... (Score:5, Interesting)
fp
You know how they will cover the losses (Score:1)
Re:But how would they cover the debt.... (Score:5, Insightful)
Better yet, how do you even determine the losses? The only science I've seen of it to date is: Company A says, "We lost $x amount when we lost our connection for 2 hours because of this attack," with nothing to back up the dollar figure.
This insurance idea could be a good one, simply because it might force businesses to justify their losses when network attacks occur. I'm not going to hold my breath, though.
Re:But how would they cover the debt.... (Score:3, Insightful)
Although I do agree with you that whenever someone's systems or networks go down they start throwing around random numbers indicating their losses, it would be pretty easy to calculate the loss to a relative accuracy. Just get all the numbers for the amount of business done during that period using the systems that are down and average to the time period that the systems were down. Say company XYZ does business through a phone system and a website. Say they make $730 dollars a year and that $365 of that come from the phone system and $365 of that comes from the website. Now, say the website goes down for a single normal business day (not some holiday or otherwise, just a random normal day) and that normally their website is up 24/7/365.
Loss = ($365/year)*(1 year/365 days) = $1/day on average So, they lost $1 for that single day.
Now, for example, let's say that this is the company Dell. From Aug 2, 2001 to Aug 2, 2002 Dell took in revenues equalling $32.054 Billion. So, they bring in ($32.054)/(365) = $0.087819 Billion per day, or $87.819 Million in one day. Now, let's approximate that %50 of that is from various computer networks (kiosks at office stores, home users online, business users online, etc) and %50 is from their phone systems (I really have no idea as I could not find any actual percentages). That means that if Dell's networks all went down for a single day, they would lose $43.910 Million in sales.
The really hard part is estimating how network slow downs effect the business. But then again you could just see what the average expected sales for that day were and then what the actual sales for that day were and find the difference. If you have some data, statistics can handle the rest. But it sure does seem like some of these CEOs pull numbers out of their arses and throw them around to get sympathy or something.
Re:But how would they cover the debt.... (Score:2)
Yeh, but I'm sure Dell wouldn't pay me a 6-figure salary to do the calculations I just did. Their financial people should be able to handle the numbers and make those sorts of corrections. The only question then is whether or not they will or if Dell will simply find the way to report the largest loss figure (for whatever reason).
Re:But how would they cover the debt.... (Score:3, Insightful)
This is what actuaries do. They determine how to make money off of policies, they determine risk exposure and how to mitigate that risk, etc etc.
To have an actuary that could successfully do a plausible job at this, you'd need one that was a computer security and loss expert.
My father was the youngest person to become an FSA (Fellow of the Society of Actuaries) and last year was the Computer Science chairperson for the SOA (Society of Actuaries).
As both an accomplished actuary (to say the least) and an accomplished computerphile (are you fluent in 360 assembler ?) i feel like he's pretty well versed to speak on this matter.
I can tell you quite confidently that the cross section of actuaries, and people who are computer security experts in the united states is roughly:
0 persons.
When the "hacker insurance costs more for IIS" article came out a year ago i talked it over with my dad. He said it was, "bullshit", and went into a small rant about how ridiculous and sensationalist it was.
Force majeure? (Score:2, Insightful)
The good thing about cracker insurance, is that the insurance companies will impose terms that the insured parties have to comply with. And they can give discounts on premiums if some measures are taken by the insured. How about a 10% discount for switching from Windows to a secure system
Product liability instead (Score:5, Insightful)
Re:Product liability instead (Score:5, Insightful)
Because you clicked "Yes, I agree".
Re:Product liability instead (Score:3, Informative)
Drugs (medical): Your pharmacist doesn't check to find that the drug prescribed is something you're listed as being highly allergic to, you die.
SQL Server crashes: You lose money, you require stress leave, but in most cases it isn't life or death.
Re:Product liability instead (Score:2)
If my local 911 was drastically slowed down like this, and a family member died because info didn't get to the right people fast enough, i'd be pretty ticked. Especially if it was because of yet another bug in a supposedly "commercial grade" database.
Re:Product liability instead (Score:2, Insightful)
Re:Product liability instead (Score:2)
If SQL server ships with sever security flaws that enable a worm to lay waste to the interneet for a couple of days and, furthermore, fails to release reliable* patches that don't down the server, is Microsoft liable?
* for values of reliable including not breaking anything else nor removing fixes to previous vulnerabilities.
Re:Product liability instead (Score:2, Interesting)
Anyway, now what about bespoke software of the kind that runs banking systems? Surely there is a leap of faith here. When a company commissions software from another firm, apart from contractual agreements are there any standard practices that one can quote here to say this is how the industry handles the risk arising out of product defects that could potentially knock the person out of business or worse liable for external damages too?
Re:Product liability instead (Score:5, Insightful)
2) We don't REALLY want this. It's incredibly expensive to have crash-tests / drug-tests done; Open Source software would suffer greatly if it was "controlled" in this way.
S
Re:Product liability instead (Score:2, Informative)
duh! (Score:5, Insightful)
nothing else will do!
Re:duh! (Score:1)
Re:duh! (Score:4, Funny)
Re:duh! (Score:2, Funny)
Re:duh! (Score:5, Interesting)
No, the best insurance is a competent admin and management that gives him the support he needs and listens to him (or her).
I speak from experience. At a company I used to work for, the "business manager" decided that connecting a server (admininstered by another company, I couldn't legally touch it) with NO root password (AIX, BTW) to a modem anyone could dial into (no logging either) was a good idea. I objected, in writing, but was overruled.
It was about a week before the hard drive suddenly went blank. The company administring it said it was a bad hard drive. I disagreed, and said someone had broken into it. Again, I was overruled, and they replaced the hard drive and restored the system from the last system backup (charging about $800 for this service). They put the modem back online.
Exactly a month later, same thing. This time the company says it's a bad controller card (and again won't listen to me). The company claimed it would take a very sophisicated attack to do what was happening. Apparently, they never heard of cron and "rm -rf /*"! Anyway, again they restored the last system backup (not checking anything either; I watched). Another bill (unknown amount).
Month 3, same time, same blank hard drive. Now they belived me and did an install off known good media. They refused scan the data backups for leftovers though. Fortunately, it doesn't appear like the visitor left anything there. The business manager also finally gave the ok to disconnect the modem.
They eventually did reimburse for some of the bills for non-faulty equipment, but the billing department (it was "their" server) was down for about 7 days. I have no idea how much that cost.
The best admin in the world can't protect squat if management ties his (or her) hands.
Re:duh! (Score:3, Funny)
Re:duh! (Score:2)
Too bad it didn't lead to real changes.
Re:duh! (Score:2)
The problem is that the tighter you make your security the harder the system will be to use. So you have to find some form of a midpoint. Plus even if the systems are good. It does not prevent someone from hacking the people.
After all airlines have insurance and they train their people like very well.
Hacker vs. Cracker (Score:5, Insightful)
I can see it now: company tries to claim a loss due to having their network compromised.
Insurer: I'm sorry but we have rejected your claim.
Insured: What the hell do you mean? This is why we bought hacker insurance!!
Insurer: Yes, but you bought "hacker" insurance. If you wanted to be reimbursed for a loss like this, you should have bought our "cracker" insurance! But you're in luck! We've got a special offer now! If you buy cracker insurance and already have purchased hacker insurance from us, you will save 10%! I guess today is your lucky day after all!
Insured: You insurance companies are vultures! Profiting off our loss! Well, okay, I don't want to think any more about it. Just sell me whatever insurance you think is best for me.
Insurer: Just what I was hoping you'd say! Sign here, here, and here, please! No, don't bother reading that. It's just a bunch of legal jargon...
GMD
DDOS Flood insurance (Score:3, Interesting)
curious ... (Score:2, Insightful)
Insurance HA (Score:3, Insightful)
Re:Insurance HA (Score:2)
I agree. In the article it says that you have to pay $50,000 to have an outside consultant access you security. Then of course there are the insurance premiums...
That kind of $$$ would go a long ways toward paying a security admin and internal security awareness training for your staff.
Re:Insurance HA (Score:2)
Yeah, next time my house burns down I'll keep that in mind.
Remember, insurance isn't about protecting the stupid. It's about protecting you in case of ACCIDENTS. And yes, they do happen, even to the best of us.
Do they cover your bandwidth bill too? (Score:5, Interesting)
How 'bout "slashdot effect" insurance? (Score:2)
problem (Score:3, Funny)
Hackers Need Insurance (Score:1)
Hartford Steam Boiler Insurance covers this (Score:5, Interesting)
Hartford Steam Boiler offers good rates, but requires intrusive inspections. Before they insure something, they inspect and provide a list of things they want fixed. Then they inspect again, after the problems are fixed. Only then will they provide insurance coverage. They then have the right to inspect at any time, and they use it.
This works great for steam boilers (where they have great expertise) but they haven't tried to expand much out of their niche. Even though they do cover some computers, they're still mostly focused on boilers. It's good that others are now moving in that direction.
This is the right approach. When Hartford Steam Boiler started in 1866, steam boilers blew up regularly. Within a few years, boilers insured by Hartford Steam Boiler weren't blowing up. A similar approach may eliminate computer crashes as a major problem. The day may well come when you can't buy insurance because you have an insecure OS on the premises.
Hmm, systems improve if they are open to scrutiny? (Score:2)
This fact may prevent the kind of scenario your post describes to occur in the computer industry.
mitigating risk (Score:4, Insightful)
Every company expects numerous break ins, vandalism, data theft, etc.. The problem is that it is hard to budget for this because the value of the damage is different in every case.
Buying insurance for the attacks allows shortfalls in the data crime budget to be covered, and provides benefits for budgeting and tax purposes by increasing stability in the face of constant inevitable loss.
What a great idea. I can see it now. (Score:5, Funny)
Customer: What do you mean?
Nunzio: You know, accidents, like your customer records being posted on slashdot. Accidents happen you know.
Guido: But your in luck, my brother and me can, for a small fee, grantee your network wont be hacked by disreputable people like us. Think of it as "insurance".
Re:What a great idea. I can see it now. (Score:5, Funny)
Solomon
Re:What a great idea. I can see it now. (Score:2, Funny)
Luigi: How many servers you got here, Colonel?
Colonel: Oh, er
Luigi:Sun servers, Dino.
Dino:Be a shame if someone was to set fire to them.
Colonel: Set fire to them?
Luigi: Fires happen, Colonel.
Dino: Things burn.
Not a bad idea (Score:5, Interesting)
If companies actually buy cracking insurance, they will want to get it at a low price.
The insurance industry, by charging high-premiums for bad IT management, bad security, bad policy, and bad software, could force companies to improve themselves.
How high are the premiums on MS SQL 2000?
You could clearly point to the insurance premiums and show how much bad security is costing the company.
Re:Not a bad idea (Score:4, Insightful)
This is how insurance companies can actually act on behalf of the consumers. While personal injury lawyers make insurance companies out to be money-grubbing scum-sucking urine-soaked bug feces, we can't forget that those same insurance companies finance car crash testing and safety reporting for the their own and the public's benefit. We also can't forget it is the insurance companies who can actually challenge run-a-way medical costs for their own and the public's benefit. The same goes for construction (flood plains, building codes, etc.), too.
Insurance companies could be Microsoft's worst nightmare.
Will this make better security? (Score:5, Insightful)
If you're board of directors tries to get cracker insurance, and the insurance company fails you as being to big of a risk
Might actually help (Score:5, Insightful)
Ironically, if more companies would conduct assessments, patch vulnerable systems, setup security policies, etc. the demand for this type of insurance might actually diminish. Little chance of that.
Re:Might actually help (Score:3, Insightful)
Re:Might actually help (Score:2, Interesting)
More info (Score:4, Insightful)
Does anybody know where documentation can be found on how "risk assessment" is done for this type of insurance?
This would be a very interesting way to gauge what software and network hardware an establishment should/should not be using.
It would be very interesting to see where Microsoft products fall in the mix.
Re:More info (Score:4, Informative)
http://www.sans.org/rr/casestudies/insurance.ph
Who Provides Hacker's
Insurance
Providing insurance for cyber loss is a new industry. Most insurance
carriers do not have the necessary expertise or tools to adequately
assess the needed coverage. As a result, there are currently only a few
companies offering hacker's insurance. However, with the financial
losses continuing to escalate, the demand for this protection will also
increase.
Lloyd's of London has created an insurance product that incorporates
elements of crime coverage and property coverage, addressing specific
exposures faced in our computer age.
The product, Computer Information & Data Security Insurance (CIDSI),
combines theft and malicious damage protection coupled with business
interruption coverage. CIDSI further provides expert computer security
surveying and loss control services to mitigate exposures and losses.
The product is a comprehensive program that can help address significant
exposures.
Other vendors of computer crime insurance include:
* Internet Security Systems (www.iss.net)
* Counterpane
(www.counterpane.com)
* J.S. Wurzler Website Insurance & Security
(www.jswum.com)
* Axent Technologies (www.axent.com)
* Insuretrust.com
LLC (www.insuretrust.com)
* Ace Ltd. (www.acelimited.com)
Cost
Liability is still difficult to calculate. An example of one method for
calculations is to average a Web site's revenue over several months and
divide for an estimate of the hourly cost of downtime. However, this
calculation doesn't consider account traffic and potential customers
lost as the result of service interruption.
Insurers typically determine policy costs according to the company's
size, the volume of business a company conducts on the Web, and the
effectiveness of company's security policy. Some insurers offer a
discount if you have an affiliation with certified information security
experts.
Policies can carry premiums starting at $7,000 all the way to $3 million
dollars. Lloyd's of London has recently announced a policy to cover up
to $100 million dollars but the price of the premium has to be
negotiated specifically with Lloyd's.
What to look for in a policy is addressed here:
http://216.239.53.100/search?q=cache:nLr6A
worldbeat-1202.html+%22hac
Counterpane customers can get it cheaper through an arrangement with Lloyd's of
London because they are their customers:
http://www.counterpane.com/pr-lloydsqa.html
Re:More info (Score:2)
Maybe as part of whatever the requirements are for getting a Systems Admin license?
Maybe as part of suspending your Systems Admin license if you fail?
All of the above are good things.
Let me guess.. (Score:2, Funny)
Microsoft perhaps?
How do they pro-rate it? (Score:2, Interesting)
Would a firm get a break on their insurance if they ran 100 OpenBSD servers rather than 100 Windows servers or do they view a box as a box as a box?
There is an easier way (Score:3, Interesting)
This reduces total overhead by removing the license fees associated with Windows, SQL, and Exchange, and eliminates the need for expensive insurance options. The money saved could be used to hire a qualified network security person in-house.
Insurance? (Score:4, Insightful)
The problem here, is that Microsoft has already admitted that their products have crap security. What's preventing M$ from opening their own (or buying out another) hacker insurance co. and giving large discounts to Windoze based corporations? Would other corporations stick with a non-M$ operating system if they had to pay double the insurance premium and/or accept reduced coverage?
There is definite potantial for abuse here.
Re:Insurance? (Score:5, Informative)
If MS offers huge discounts for windows insurance, then the would loose GOBS of money when it comes time to pay out those insurance claims. I'm guessing the profit margin on insurance generally isn't as big as it is on software! They would essentially have to pay for their own bugs.
Re:Insurance? (Score:2)
If MS offers huge discounts for windows insurance, then the would loose GOBS of money when it comes time to pay out those insurance claims. I'm guessing the profit margin on insurance generally isn't as big as it is on software! They would essentially have to pay for their own bugs.
Of course they would lose gobs of money on the claims. But gobs of money is exactly what Microsoft has! Look at the Xbox. It's losing millions and millions of dollars for MS. Do they care? No! It's all about market share.
Remember, although MS has 90% market share on the desktop, they have a far lower percentage of the server market. And the server market is where the big profit margins are.
Whats a few million here and there (in claim payouts) if they can flex their "insurance muscle" and "force" all large corporations to switch to Windows on the Servers.
Remember - it's usually not the techies in the server room making these decisions. Mr. Big Boss sees that it's just a nickel and a dime to insure his Windows servers with Microsoft Insurance Co. while it costs him an arm and a leg to insure oBSD, Linux, etc. It's doesn't take Einstein to do the math and watch the non M$ platforms disappear.
Scary.
More insurance. (Score:2, Funny)
Stock-buying time. (Score:2, Interesting)
Even taking these predictions with a rather large grain of salt, this is still fairly impressive. Might be a good time to look into putting your money into (gasp!) the stock market?
How do you judge a products security. (Score:2, Interesting)
Auditing and insuring as apropriate for these applications would be a slow and tricky process (the cynic in me says it is yet another business oppertunity) as many thousands of apps would have to be tested and rated on an insurance-risk-table - if you do want to be insured from this so called 'h/cracker threat' it isn't going to come cheap.
[H|Cr]acker? (Score:5, Funny)
(simple regular expression bugs in article titles explain a lot about why Slash is the way it is)
Re:[H|Cr]acker? (Score:2)
Re:[H|Cr]acker? (Score:2)
Nah.... Posting flames on regular expression bugs in article titles explain a lot about why Slashdot is the way it is....
*nix flavors are vulnerable too (Score:4, Interesting)
The issue here is really interesting. Do you think that by patching systems, and by going through security testing, the premiums for this type of insurance will go down? How do you determine a financial settlement (Kevin Mittnick allegedly cost several companies billions of dollars in damage, blah blah blah)? Will this make security teams wealthy and sysadmins better?
Furthermore, the article says that this type of insurance has been around for 3 years now, but I didn't get a hit when I typed in "network risk insurance" into Google...who is providing this?
Sounds like a scam I'd like to be a part of...
What, are Forrester consultants on deep discount? (Score:2)
fuel the fires (Score:1, Flamebait)
YES! STEP 2 IS REALIZED! (Score:4, Funny)
2) H@x0r 127.0.0.1
3) Profit!
a115tat3 (Score:3, Funny)
Bean counters can understand now! (Score:4, Insightful)
SURELY I would pay less insurance if I'm using all FreeBSD 5.0 boxes vs. Windows NT 4.0 SP1 boxes! Let's see what the rates turn out to be. Again... very good news!
Re:Bean counters can understand now! (Score:2)
Nobody that is experienced enough to make an objective computer security threat analysis works in the insurance industry.
Insurance underwriters aren't fantastically bright, and the actuaries that keep insurance companies running don't have computer security expertise.
Just running FreeBSD vs NT4.0 SP1 isn't enough to make any kind of a policy decision.
If all aspects of network, administration, training, etc were identical, then, perhaps, a premium for a policy might be different based on OS choice.
But, if you know anything at all, the choice of technology has a lot less to do with computer security than the choice of humans and procedures.
Furthermore, the number of variables involved in something like writing a anti-hacker policy is so large that many of them will be ignored, as the models that the actuaries use to do their risk analysis work on terms of masses of people, and all of the variables in those models are not exposed to the underwriters.
Here's an example -- for an auto insurance policy, they ask you what kind of car it is, how often you get a trafic violation, how old you are, and how far you drive in an average day.
Wouldn't you say there are more variables that are statistically significant than that ? The underwriters don't care that you drink, own a cell phone, etc etc (although they may start on the cell phone matter). Yet those are things that may be modelled by the actuaries, on broad terms to set the safety margins in the premiums.
Similarly, there are all kinds of factors that relate to insuring some kind of computer operation. First off, if you're talking about a computer network, then the OS on a specific host doesn't seem relevant (or were you envisioning that each host would be a multi-valued line item on the policy, just like each car is a line item on an insurance policy ?)
The difference... (Score:2)
All other things being equal, you pay less car insurance when you have airbags vs. none. Or when you have an alarm vs. none. It's a slight reduction on the comprehensive part of the insurance. I think running BSD instead of Windoze is a big enough difference that there, on whatever level large or small, should be a change in premiums paid. It should be interesting!
INSURANCE DENIED (Score:2, Funny)
sorry.
Not to be anal, but... (Score:4, Interesting)
The article title reads [H|Cr]acker Insurance
This regex works but I don't think it works for the reasons that the author intended. For example,
The [H|Cr] is a character class matching the single character H, C, r or |.
So this regex will match Hacker Insurance, and Cracker Insurance (bolding indicates what part of the word matches)... it will also match |acker Insurance
I wouldn't normally be so anal but the title involves hackers/crackers... you'd think you'd get the logic right, no?
I would humbly suggest the regex (H|Cr)acker Insurance
If the author was intending some weird regex syntax where [] indicates something other than a character class then I apologize in advance,
Insurance Insurance (Score:2)
So, do the companies buy insurance to guard against the chance that their predictions are wrong?
Re:Insurance Insurance (Score:2)
Actually, yes. Insurance is essentially a business based on probability, and there are many examples of this:
On the smaller end of the scale are things like Hole-in-One insurance - basically, an insurance company will pay, say, $20,000, if someone gets a hole-in-one during your corporate golf tournament, but you only pay $500 for this coverage. Odds of someone getting a hole-in-one = just slightly less than $500/$20,000, so the insurance company makes a small profit overall, and you get a really neat prize if you're lucky enough.
Numbers completely contrived, it's been a couple of years since I sold insurance.
This Has To Be A HUGE Scam (Score:2, Interesting)
My favorite part of the article is.. (Score:3, Interesting)
"I believe that within a few years hacking insurance will be ubiquitous," Schneier said. "The notion that you must rely on prevention is just as stupid as building a brick wall around your house. That notion is just wrong."
Uh, my house has brick walls on all sides for that very purpose..
I guess he is saying that now we should all just forget about applying patches, and installing firewalls. We should just buy insurance for when we get hacked.
Just call them Attackers (Score:2)
Say what you mean, mean what you say.
--Dan
The new fraud... (Score:2)
Hmmmm.. (Score:2)
Imagine a theif wants to steal my TV set and no law or threat of force is going to stop him. If I were to "store" my TV set out on the sidewalk in front of my house, it WILL disappear. It's only a matter of time. Likewise, if I keep an insecure server wide open on the internet, with known exploits, it WILL get cracked, it's only a matter of time.
Now consider that I store my TV set inside my house, like most people do, and keep the doors locked, like most people do. The cracker still knows where the TV is, but he'll first need to get inside to take it. However, if he is undeterred, he can break a window and get in. This compares to your average insecure system behind a firewall. Good protection, to be sure, but if there is a flaw in the system, and an insecure system behind a firewall is still a major flaw, someone can still get in. The options are just limited.
Now say I bolt down the TV set. Removing it will require an extensive amount of time. A dedicated thief can still get it if he wants to, but there's almost a 100% chance that he'll get caught in the process. A well patched, up to date system with no known vulnerabilities is safe. Certainly, some blackhat might have a way in that nobody has ever heard of before, but it's highly unlikely. And likewise, they can track down the physical location of the machine, and hit it manually, but by that time you have bigger problems.
How does this relate to insurance? Imagine an insurance company willing to insure a TV set you store on your sidewalk. It's not going to happen.
So will an insurance company choose to cover a network that has any known vulnerabilities on it? Or are they going to do a risk assessment based on a company's ability to keep their machines secured? And do they plan to keep track of these things? Simple fact is, a well secured network probably won't need the insurance. And good administrators will know this.
This means, that anyone who really needs the insurance will have to pay a TON of money for it, otherwise the insurance companies will go broke handling all the claims, for if someone is well insured, they're likely to be more sloppy. This means the insurance company is going to have to take a somewhat proactive stance to insure (no pun intended) that the customer's network is secured.
And just think of the possibilities for fraud...
-Restil
I wonder if www.hollywoodreporter was insured :) (Score:2)
www.hollywoodreporter.com
No match for "WWW.HOLLYWOODREPORTER.COM".
Wayback machine [archive.org]
Some quick notes: www.hollywoodreporter.com recently posted an article about RIAA web site being hacked and then suddenly it disappeared from Internet DNS.
Cracker insurance is YAFOWT (Score:2)