4 ms·

“DDoS insurance” would almost certainly be covered under cyber security insurance, which any decently sized organization should have these days. Even without t

“DDoS insurance” would almost certainly be covered under cyber security insurance, which any decently sized organization should have these days. Even without that, I wouldn’t be surprised if it’s covered by other forms of insurance, such as policies that would cover an internet or power outage. It would probably be harder to get the insurance to pay out, but if your legal team is big enough, maybe...

freehunter 6y ago
Yup. I've been working in cyber security for going on 10 years now and even when I started at my first company, we already had for-pay DDoS mitigation services and cyber attack insurance. The insurance covered the cost of compensating customers for any outages that came from a successful attack (fictional example: site was down for an hour due to a DDoS so we had to reimburse millions of dollars to thousands of customers all at once). These days incident response retainers are very common, where you would pay a security firm like Mandient or Verizon or IBM a small fee every month and in exchange they guarantee that they will have an expert on site within X hours if you have a security breach. Almost every major company has a retainer like this.
- deleted 6y ago
  [deleted]
- jacobwilliamroy 6y ago
  Who gets the retainer fee?
  - freehunter 6y ago
    The company you pay for the retainer gets the retainer. For example a place I worked had a retainer with Verizon. Every month we paid Verizon ~$500/hr for X number of hours. If we didn't need those hours for incident response we could use them for penetration testing or consulting to improve our detection tools, etc. But when something bad happened, we had already pre-paid for their consultant to come visit and help us. The real benefit to this situation is you get to avoid haggling over price and waiting for a quote from the sales guy and running it past your legal department. All that enterprise sales nonsense is already done so when you pick up the phone it's all business with no negotiation.
    - jacobwilliamroy 6y ago
      Who at verizon gets the retainer fee if the consultant is never requested? How is it distributed?

freehunter 6y ago

Yup. I've been working in cyber security for going on 10 years now and even when I started at my first company, we already had for-pay DDoS mitigation services and cyber attack insurance. The insurance covered the cost of compensating customers for any outages that came from a successful attack (fictional example: site was down for an hour due to a DDoS so we had to reimburse millions of dollars to thousands of customers all at once). These days incident response retainers are very common, where you would pay a security firm like Mandient or Verizon or IBM a small fee every month and in exchange they guarantee that they will have an expert on site within X hours if you have a security breach. Almost every major company has a retainer like this.

deleted 6y ago
[deleted]
jacobwilliamroy 6y ago
Who gets the retainer fee?
- freehunter 6y ago
  The company you pay for the retainer gets the retainer. For example a place I worked had a retainer with Verizon. Every month we paid Verizon ~$500/hr for X number of hours. If we didn't need those hours for incident response we could use them for penetration testing or consulting to improve our detection tools, etc. But when something bad happened, we had already pre-paid for their consultant to come visit and help us. The real benefit to this situation is you get to avoid haggling over price and waiting for a quote from the sales guy and running it past your legal department. All that enterprise sales nonsense is already done so when you pick up the phone it's all business with no negotiation.
  - jacobwilliamroy 6y ago
    Who at verizon gets the retainer fee if the consultant is never requested? How is it distributed?