4 ms·
Would you want the insurance policy to pay out though? At some level of recklessness, insurance becomes void. I think a lack of infrastructure to restore a ha
by gorgoiler 6y ago
Would you want the insurance policy to pay out though?
At some level of recklessness, insurance becomes void. I think a lack of infrastructure to restore a hacked server — with data valued at over $1M — is negligent enough to not be covered.
But maybe UCSF are on MegaCo’s YOLO tier of server insurance, which is so expensive and isolated it has no impact on my MegaCo pet insurance premiums?
- surfpel 6y agoBut patients suffering for administrative negligence? I don’t agree with that but there does need to be some kind of incentive there.
- gorgoiler 6y agoThat’s a good point, I hadn’t thought of that. Perhaps the health of some businesses is so important that they should be protected by, ahem, state-backed insurance paid for by the taxpayer?
- closeparen 6y agoI'll venture a guess that UCSF was nominally in compliance with some relevant bureaucratic regime (ISO 27001, SOC 2, etc), and that was good enough for a stodgy insurance company that's not very sophisticated about "cyber risk" (in case use of the term "cyber" isn't a giveaway...)
- gorgoiler 6y agoThe CISO’s top 5 “security tips” PR piece didn’t mention off-system backups. Policy voided.
- WrtCdEvrydy 6y agoMost of the time, the insurance guys will just negotiate on your behalf (lowering costs) and handling purchasing of the crypto. They also won't tell you how much they paid out...
- masonic 6y agoI'd expect that UCSF is self-insuring.