4 ms·

It might actually be a good thing in the long term as insurance companies may require 3rd party audits and that you comply with basic security practices.

msla 8y ago
It might well kill the use of open source and small-company software in business, in that the developers/management behind said code can't pay insurance companies to say that their code will pass audit. Microsoft and Oracle will pass with flying colors, of course.
- bluejekyll 8y ago
  It could just as well lead to better support models for contributions to fix and audit open source. The open source model is benefiting too many businesses to just up and throw it out.
- jabart 8y ago
  Doubt it, there are a lot of PCI Compliant businesses that get audited with open source software in their systems. I'm sure they have a node_modules somewhere on their build server. When you have an attack that moves from your servers to your desktop computers, you have a network issue, which would be covered in an audit to verify you properly segment your network instead of having it in one large broadcast domain.
dontbenebby 8y ago
But do audits show compliance with basic security practices, or compliance with PCI DSS and other standards which may be orthogonal to security?
- wefarrell 8y ago
  In this case it would be the insurance company who requests the audit, so there would be incentives to ensure that the audits are meaningfully preventative.
  - dontbenebby 8y ago
    Good point!
Animats 8y ago
More like in the short term. A friend of mine just got a job at a SF startup for that. They're a consultancy which evaluates computer security for insurance companies, before they insure a business. She used to work on AI for intrusion detection, so they're hiring serious people for this. There are specialty insurance companies which cover specific risks and know how to evaluate them. The classic is The Hartford Steam Boiler Insurance Company.[1] They were the first insurance company willing to insure steam boilers. About half their employees are boiler inspectors. When they started, in 1866, nobody else would touch that business. They inspect before they insure. Typically, they send inspectors and provide the boiler owner with a to-do list. Then they come back to see if everything was fixed. Only then does HSB write a policy. Their policies give them the right to come in at any time and inspect. Which, randomly, they do. Boring old Hartford Steam Boiler is expanding into computer systems insurance.[2] But they are not as hard-ass about inspections as they are with boilers, unfortunately. They know how to keep boilers from blowing up. Computer security isn't there yet. [1] https://www.munichre.com/HSB/about-hsb/index.html https://www.munichre.com/HSB/about-hsb/index.html [2] https://www.munichre.com/HSB/cyber-insurance/index.html https://www.munichre.com/HSB/cyber-insurance/index.html
- curry-castaway 8y ago
  > They're a consultancy which evaluates computer security for insurance companies, before they insure a business. Can you share the name of the company?
wvenable 8y ago
Insurance companies already do this but that's not the point at all. You can be the victim of a cyberattack even if you do everything right and the insurance company will refuse to pay out of it's tied to (perhaps with little evidence) to a state-funded attack.

msla 8y ago

It might well kill the use of open source and small-company software in business, in that the developers/management behind said code can't pay insurance companies to say that their code will pass audit. Microsoft and Oracle will pass with flying colors, of course.

bluejekyll 8y ago
It could just as well lead to better support models for contributions to fix and audit open source. The open source model is benefiting too many businesses to just up and throw it out.
jabart 8y ago
Doubt it, there are a lot of PCI Compliant businesses that get audited with open source software in their systems. I'm sure they have a node_modules somewhere on their build server. When you have an attack that moves from your servers to your desktop computers, you have a network issue, which would be covered in an audit to verify you properly segment your network instead of having it in one large broadcast domain.

dontbenebby 8y ago

But do audits show compliance with basic security practices, or compliance with PCI DSS and other standards which may be orthogonal to security?

wefarrell 8y ago
In this case it would be the insurance company who requests the audit, so there would be incentives to ensure that the audits are meaningfully preventative.
- dontbenebby 8y ago
  Good point!

Animats 8y ago

More like in the short term. A friend of mine just got a job at a SF startup for that. They're a consultancy which evaluates computer security for insurance companies, before they insure a business. She used to work on AI for intrusion detection, so they're hiring serious people for this. There are specialty insurance companies which cover specific risks and know how to evaluate them. The classic is The Hartford Steam Boiler Insurance Company.[1] They were the first insurance company willing to insure steam boilers. About half their employees are boiler inspectors. When they started, in 1866, nobody else would touch that business. They inspect before they insure. Typically, they send inspectors and provide the boiler owner with a to-do list. Then they come back to see if everything was fixed. Only then does HSB write a policy. Their policies give them the right to come in at any time and inspect. Which, randomly, they do. Boring old Hartford Steam Boiler is expanding into computer systems insurance.[2] But they are not as hard-ass about inspections as they are with boilers, unfortunately. They know how to keep boilers from blowing up. Computer security isn't there yet. [1] https://www.munichre.com/HSB/about-hsb/index.html https://www.munichre.com/HSB/about-hsb/index.html [2] https://www.munichre.com/HSB/cyber-insurance/index.html https://www.munichre.com/HSB/cyber-insurance/index.html

curry-castaway 8y ago
> They're a consultancy which evaluates computer security for insurance companies, before they insure a business. Can you share the name of the company?

wvenable 8y ago

Insurance companies already do this but that's not the point at all. You can be the victim of a cyberattack even if you do everything right and the insurance company will refuse to pay out of it's tied to (perhaps with little evidence) to a state-funded attack.