5 ms·

No insurance company is going to take that deal because infosec audits are not perfect and they can not audit every possible software release. So your plan mea

No insurance company is going to take that deal because infosec audits are not perfect and they can not audit every possible software release. So your plan means governments will have to provide this insurance (there is precendent for governments providing insurance; eg Medicare in the US) That means taxpayers will fund the payouts. This is not a good solution. I don’t have an alternative, but I dont like this one.

WhompingWindows 6y ago
Regulations could encourage/entice/require big insurance companies to take on infosec contracts.
INGELRII 6y ago
Insurance business is risk management in imperfect world. Quantifying the risk and pricing it is their business.
- beefield 6y ago
  Insurance companies like risks that are diversified over their customer base, with regular enough occurrence in the customer population that the cost of payments over time is relatively stable. Insurance companies absolutely abhor risks that are affecting large portion of their customer base at the same time but only rarely. Re-insurers offer some help, you can talk about some special investment vehicles where insurance companies can offload those kind of risks off their books, but in the whole, I think it is quite safe to assume that insurnace market for those kind of risks would be seriously broken.
  - tupputuppu 6y ago
    Your opinion is invalidated by the fact that cyber breach insurance is a thing that insurance companies sell already today.
    - beefield 6y ago
      " For this sensitive private health information compensation should be at least 5 figures per person, no excuses." I still have my doubts this kind of insurance is for sale with non-prohibitive prices.
hrktb 6y ago
Replace privacy leak with car accident. No insurance company has perfect info on car safety, driver behavior or road maintenance status. Yet as a mandatory system it works well enough. Insurance companies have the tools to deal with lack of information.
- eru 6y ago
  Alas, infosec failures often come in much bigger lumps than car accidents.
- SilasX 6y ago
  Insurance companies have relatively low caps on what they have to pay out per accident though. The figures here would be much higher.
  - hrktb 6y ago
    It’s a matter of balancing costs and income. Insurance companies can deal with skyscrapers or airline crash insurances, I don’t think privacy leaks should be harder to manage than actual death.
    - SilasX 6y ago
      >It’s a matter of balancing costs and income. I know, I just thought car accidents were a bad way to make the point. Data breaches vs skyscrapers/airplanes are harder to distinguish, so yeah those are more comparable. Edit: that is, data breaches under the proposed system of high per-user liability are comparable.
- robocat 6y ago
  Car fatalities in Finland: approximately 250 per year. That gives an idea of the orders of magnitude difference that can occur with security breaches. There have been breaches where every person in a whole country has been affected. Most importantly car accidents have a known variance and are statistically predictable. There are insurers that will take on one-off unpredictable risks (reinsurance), but equating cybersecurity to car insurance makes little sense.
vsareto 6y ago
>and they can not audit every possible software release. Do less frequent, more meaningful releases. Grow and invest in security talent. Move slow and polish things. Plus infosec is definitely not taking everyone in with a proven interest. Even with the popular certs, there's still barriers to entry for no good reason.
jcims 6y ago
Cybersecurity insurance is presently about a 5 billion dollar market globally. There are quite a few underwriters getting into the game and vendors stepping all over each other trying to figure out how to get a piece of that risk reduction work. Personally I think it's adequate just to fine companies for breaches and let them figure out if they want to insure or do better or both.
- eru 6y ago
  > Personally I think it's adequate just to fine companies for breaches and let them figure out if they want to insure or do better or both. They'd just need to post a bond or similar, if they don't want to insure. (Any insurance company would need to do something similar.)
- robocat 6y ago
  GP poster was suggesting the victims (patients in this case) get compensation, not the company. Currently cybersecurity insurance pays the company, so actually the company itself has less incentive to fix real security issues (albeit with more incentive to resolve the specific security-audit needs of the policy.). And expensive policies reduce the pot of money available to fix problems. Government policies that make directors criminally liable, and ways to spread that liability for criminally negligent security faults, would probably have a better effect than monetary fines.
  - jcims 6y ago
    My read was that the insurance was to ensure that the company would have funds to pay damages.
AnthonyMouse 6y ago
> No insurance company is going to take that deal because infosec audits are not perfect and they can not audit every possible software release. That doesn't cause them to be unwilling to write a policy. What it does is cause the premiums to be high. But the insurance companies will still want to mitigate the risk as much as possible, so they'll still dump compliance costs on the policy holders to try to mitigate the risk. And since the insurance is mandatory, they have no real incentive to minimize those costs or ensure that they achieve a worthwhile cost/benefit ratio. So mental health providers will have two new large operating costs imposed on them. And the breaches will still happen, because most of the compliance requirements will be in the nature of having to install antivirus on your Linux servers and mandating passwords to be changed often enough that everybody writes them on a sticky note on the side of their monitor and the password reset mechanism becomes "easy to use" with the obvious implications of that. This style of solution is common in healthcare in the US and is one of the reasons it's so expensive.
- d4mi3n 6y ago
  > And the breaches will still happen, because most of the compliance requirements will be in the nature of having to install antivirus on your Linux servers and mandating passwords to be changed often enough that everybody writes them on a sticky note on the side of their monitor and the password reset mechanism becomes "easy to use" with the obvious implications of that. I'll note that the whole password on a sticky note example is not ideal, but doesn't weaken such systems against what is likely the biggest risk they face: network systems being compromised remotely. This is of course not ideal, but a far cry better than not having such policies in place.
  - AnthonyMouse 6y ago
    > I'll note that the whole password on a sticky note example is not ideal, but doesn't weaken such systems against what is likely the biggest risk they face: network systems being compromised remotely. Until somebody posts a selfie with the sticky note in the background.
    - 6y ago
skybrian 6y ago
I don't think it's a perfect solution, but it might help on the margin? We don't need penalties to be so high that they drive firms into bankruptcy and make insurance unaffordable. A lower amount of financial risk would be enough to provide incentives for companies to buy insurance and improve their security in whatever way makes sense.

WhompingWindows 6y ago

Regulations could encourage/entice/require big insurance companies to take on infosec contracts.

INGELRII 6y ago

Insurance business is risk management in imperfect world. Quantifying the risk and pricing it is their business.

beefield 6y ago
Insurance companies like risks that are diversified over their customer base, with regular enough occurrence in the customer population that the cost of payments over time is relatively stable. Insurance companies absolutely abhor risks that are affecting large portion of their customer base at the same time but only rarely. Re-insurers offer some help, you can talk about some special investment vehicles where insurance companies can offload those kind of risks off their books, but in the whole, I think it is quite safe to assume that insurnace market for those kind of risks would be seriously broken.
- tupputuppu 6y ago
  Your opinion is invalidated by the fact that cyber breach insurance is a thing that insurance companies sell already today.
  - beefield 6y ago
    " For this sensitive private health information compensation should be at least 5 figures per person, no excuses." I still have my doubts this kind of insurance is for sale with non-prohibitive prices.

hrktb 6y ago

Replace privacy leak with car accident. No insurance company has perfect info on car safety, driver behavior or road maintenance status. Yet as a mandatory system it works well enough. Insurance companies have the tools to deal with lack of information.

eru 6y ago
Alas, infosec failures often come in much bigger lumps than car accidents.
SilasX 6y ago
Insurance companies have relatively low caps on what they have to pay out per accident though. The figures here would be much higher.
- hrktb 6y ago
  It’s a matter of balancing costs and income. Insurance companies can deal with skyscrapers or airline crash insurances, I don’t think privacy leaks should be harder to manage than actual death.
  - SilasX 6y ago
    >It’s a matter of balancing costs and income. I know, I just thought car accidents were a bad way to make the point. Data breaches vs skyscrapers/airplanes are harder to distinguish, so yeah those are more comparable. Edit: that is, data breaches under the proposed system of high per-user liability are comparable.
robocat 6y ago
Car fatalities in Finland: approximately 250 per year. That gives an idea of the orders of magnitude difference that can occur with security breaches. There have been breaches where every person in a whole country has been affected. Most importantly car accidents have a known variance and are statistically predictable. There are insurers that will take on one-off unpredictable risks (reinsurance), but equating cybersecurity to car insurance makes little sense.

vsareto 6y ago

>and they can not audit every possible software release. Do less frequent, more meaningful releases. Grow and invest in security talent. Move slow and polish things. Plus infosec is definitely not taking everyone in with a proven interest. Even with the popular certs, there's still barriers to entry for no good reason.

jcims 6y ago

Cybersecurity insurance is presently about a 5 billion dollar market globally. There are quite a few underwriters getting into the game and vendors stepping all over each other trying to figure out how to get a piece of that risk reduction work. Personally I think it's adequate just to fine companies for breaches and let them figure out if they want to insure or do better or both.

eru 6y ago
> Personally I think it's adequate just to fine companies for breaches and let them figure out if they want to insure or do better or both. They'd just need to post a bond or similar, if they don't want to insure. (Any insurance company would need to do something similar.)
robocat 6y ago
GP poster was suggesting the victims (patients in this case) get compensation, not the company. Currently cybersecurity insurance pays the company, so actually the company itself has less incentive to fix real security issues (albeit with more incentive to resolve the specific security-audit needs of the policy.). And expensive policies reduce the pot of money available to fix problems. Government policies that make directors criminally liable, and ways to spread that liability for criminally negligent security faults, would probably have a better effect than monetary fines.
- jcims 6y ago
  My read was that the insurance was to ensure that the company would have funds to pay damages.

AnthonyMouse 6y ago

> No insurance company is going to take that deal because infosec audits are not perfect and they can not audit every possible software release. That doesn't cause them to be unwilling to write a policy. What it does is cause the premiums to be high. But the insurance companies will still want to mitigate the risk as much as possible, so they'll still dump compliance costs on the policy holders to try to mitigate the risk. And since the insurance is mandatory, they have no real incentive to minimize those costs or ensure that they achieve a worthwhile cost/benefit ratio. So mental health providers will have two new large operating costs imposed on them. And the breaches will still happen, because most of the compliance requirements will be in the nature of having to install antivirus on your Linux servers and mandating passwords to be changed often enough that everybody writes them on a sticky note on the side of their monitor and the password reset mechanism becomes "easy to use" with the obvious implications of that. This style of solution is common in healthcare in the US and is one of the reasons it's so expensive.

d4mi3n 6y ago
> And the breaches will still happen, because most of the compliance requirements will be in the nature of having to install antivirus on your Linux servers and mandating passwords to be changed often enough that everybody writes them on a sticky note on the side of their monitor and the password reset mechanism becomes "easy to use" with the obvious implications of that. I'll note that the whole password on a sticky note example is not ideal, but doesn't weaken such systems against what is likely the biggest risk they face: network systems being compromised remotely. This is of course not ideal, but a far cry better than not having such policies in place.
- AnthonyMouse 6y ago
  > I'll note that the whole password on a sticky note example is not ideal, but doesn't weaken such systems against what is likely the biggest risk they face: network systems being compromised remotely. Until somebody posts a selfie with the sticky note in the background.
  - 6y ago

skybrian 6y ago

I don't think it's a perfect solution, but it might help on the margin? We don't need penalties to be so high that they drive firms into bankruptcy and make insurance unaffordable. A lower amount of financial risk would be enough to provide incentives for companies to buy insurance and improve their security in whatever way makes sense.