10 ms·

It’s the premium you pay that quantifies the risk. Until there’s no insurance company that quantifies the damages and makes a quote to insure it, it’s all “Sno

by eecc 6y ago

It’s the premium you pay that quantifies the risk. Until there’s no insurance company that quantifies the damages and makes a quote to insure it, it’s all “Snowden cranks waving arms” nonsense. Once that is in place a new excel sheet magically blips onscreen and big maneuvers begin to minimize that premium and comply to the minimum standards the insurance will not classify as negligence.

AnthonyMouse 6y ago
> It’s the premium you pay that quantifies the risk. But then what? You pay the premium. Then you comply with whatever "make sure your Linux servers have antivirus" rules the insurance company comes up with. Then you stop doing anything that costs a penny more than that because the risk is now on the insurance company, which makes the problem worse. And when everybody does that, everybody's premiums go up.
- beagle3 6y ago
  My experience was that the insurance company had reasonable and effective (if costly) requirements - the “install antivirus on Linux” requirements tend to come from payment processors who would be liable for exactly nothing if you got hacked. One of my colleagues preaches - for the case of fire/damage etc insurance - to get a quote; do everything they require (as these are almost always things that have or would have saved them payment before, e.g. keeping beige boxes above floor level and under a desk - which mostly mitigates water damage from both floor flooding and ceiling leaks). And after they would insure you, once it is clear they are confident they have positive expectation from insuring you (and they know what they are doing) - that’s the time to reevaluate if you want an external insurer, or your own piggy bank. With respect to hacking, this advice is less applicable, however.
- adrianN 6y ago
  In an efficient market (I know...) another insurance company would start offering lower rates if you implemented more effective measures.
- eecc 6y ago
  Well, if the insurance is not looking for an excuse to go bankrupt they’ll survey the existing setup and either refuse to insure or ask an astronomical premium. The infrastructure operator will then negotiate a compliance progress plan to reduce the premium down to an affordable amount. I’m not saying there aren’t other mechanisms to pervert this model, but as a first approximation this is how’s it supposed to work: as long as the operator is forced to buy insurance, and there’s no way for the insurance to get off the hook, parties are forced to develop a credible risk assessment and mitigation.
  - AnthonyMouse 6y ago
    Here's the failure mode: The insurance company comes up with some prohibitively expensive and not cost effective at all requirements that would work (but bankrupt you) if you actually implemented them. Someone at the company feigns compliance with the rules. Then, if there is a claim, the insurance company investigates whether you followed the rules, finds that you didn't, and denies the claim. The insurance company doesn't go bankrupt and doesn't care that this happened. But most of the time there isn't a claim so nobody on either side actually notices that this is happening.

by eecc 6y ago

AnthonyMouse 6y ago

> It’s the premium you pay that quantifies the risk. But then what? You pay the premium. Then you comply with whatever "make sure your Linux servers have antivirus" rules the insurance company comes up with. Then you stop doing anything that costs a penny more than that because the risk is now on the insurance company, which makes the problem worse. And when everybody does that, everybody's premiums go up.

beagle3 6y ago
My experience was that the insurance company had reasonable and effective (if costly) requirements - the “install antivirus on Linux” requirements tend to come from payment processors who would be liable for exactly nothing if you got hacked. One of my colleagues preaches - for the case of fire/damage etc insurance - to get a quote; do everything they require (as these are almost always things that have or would have saved them payment before, e.g. keeping beige boxes above floor level and under a desk - which mostly mitigates water damage from both floor flooding and ceiling leaks). And after they would insure you, once it is clear they are confident they have positive expectation from insuring you (and they know what they are doing) - that’s the time to reevaluate if you want an external insurer, or your own piggy bank. With respect to hacking, this advice is less applicable, however.
adrianN 6y ago
In an efficient market (I know...) another insurance company would start offering lower rates if you implemented more effective measures.
eecc 6y ago
Well, if the insurance is not looking for an excuse to go bankrupt they’ll survey the existing setup and either refuse to insure or ask an astronomical premium. The infrastructure operator will then negotiate a compliance progress plan to reduce the premium down to an affordable amount. I’m not saying there aren’t other mechanisms to pervert this model, but as a first approximation this is how’s it supposed to work: as long as the operator is forced to buy insurance, and there’s no way for the insurance to get off the hook, parties are forced to develop a credible risk assessment and mitigation.
- AnthonyMouse 6y ago
  Here's the failure mode: The insurance company comes up with some prohibitively expensive and not cost effective at all requirements that would work (but bankrupt you) if you actually implemented them. Someone at the company feigns compliance with the rules. Then, if there is a claim, the insurance company investigates whether you followed the rules, finds that you didn't, and denies the claim. The insurance company doesn't go bankrupt and doesn't care that this happened. But most of the time there isn't a claim so nobody on either side actually notices that this is happening.