3 ms·
Don’t they have insurance for these things? A small college near me had an attack like this but paid via insurance.
by surfpel 6y ago
Don’t they have insurance for these things? A small college near me had an attack like this but paid via insurance.
- gorgoiler 6y agoWould you want the insurance policy to pay out though? At some level of recklessness, insurance becomes void. I think a lack of infrastructure to restore a hacked server — with data valued at over $1M — is negligent enough to not be covered. But maybe UCSF are on MegaCo’s YOLO tier of server insurance, which is so expensive and isolated it has no impact on my MegaCo pet insurance premiums?
- surfpel 6y agoBut patients suffering for administrative negligence? I don’t agree with that but there does need to be some kind of incentive there.
- gorgoiler 6y agoThat’s a good point, I hadn’t thought of that. Perhaps the health of some businesses is so important that they should be protected by, ahem, state-backed insurance paid for by the taxpayer?
- closeparen 6y agoI'll venture a guess that UCSF was nominally in compliance with some relevant bureaucratic regime (ISO 27001, SOC 2, etc), and that was good enough for a stodgy insurance company that's not very sophisticated about "cyber risk" (in case use of the term "cyber" isn't a giveaway...)
- gorgoiler 6y agoThe CISO’s top 5 “security tips” PR piece didn’t mention off-system backups. Policy voided.
- WrtCdEvrydy 6y agoMost of the time, the insurance guys will just negotiate on your behalf (lowering costs) and handling purchasing of the crypto. They also won't tell you how much they paid out...
- masonic 6y agoI'd expect that UCSF is self-insuring.
- robbrown451 6y agoHow would that work? Would the bad guys just ask for 10 times as much, since the insurance company is obligated to pay whatever it costs?
- closeparen 6y agoIf kidnap & ransom insurance is any precedent: the policy has a limit, the insurance company's business is negotiation, and the whole thing is shrouded in secrecy to keep attackers from knowing who is insured & for how much. Even attackers who get paid have an incentive not to piss off the insurer.
- raegis 6y agoMy school district has insurance for this, and we paid a ransom (via insurance) a few years ago.