2 ms·

I can, but the vendor's negligence causes me to suffer higher insurance premiums without any ability to leverage them into better practices. If they were oblig

I can, but the vendor's negligence causes me to suffer higher insurance premiums without any ability to leverage them into better practices. If they were obligated to buy that insurance, the insurers could require that their insured observe the underwriter's mandatory security practices (or otherwise they would be uninsured, and in my ideal universe, out of business). As it stands, the vendors take unreasonable risks, and I'm on the hook trying to insure the bloody mess that results without any control over the vendor's security practices.

AnthonyMouse 6y ago
> If they were obligated to buy that insurance, the insurers could require that their insured observe the underwriter's mandatory security practices (or otherwise they would be uninsured, and in my ideal universe, out of business). Then you're hoping that the insurance company's checklist does more good than the overhead in enforcing it costs. Those type of guidelines generally fall into three categories. The first is the ones that are sensible and cost effective, but mostly those are the ones that everybody does regardless. You might marginally increase the number of people who do these things. This is where the possible benefit comes from. The second is the ones that are just ridiculous nonsense. Things insurance companies require because they're fallible entities. The typical "install antivirus on Linux servers" checkbox. It has no benefit but it has a cost and the cost offsets the benefit of the useful measures. The insurance company has minimal incentive not to do this, especially if insurance is required by law, because the cost is being paid by somebody else. The third are measures that are marginally effective but not cost effective. They do a little and cost a lot. Insurance companies love these because they do marginally reduce the number of claims and the cost is hidden, but it still gets passed on to the customer (you), and the cost exceeds the benefit. It's a deadweight loss to you but the insurance company has a perverse incentive to require it. When you put them all together you're lucky if you break even.

AnthonyMouse 6y ago

> If they were obligated to buy that insurance, the insurers could require that their insured observe the underwriter's mandatory security practices (or otherwise they would be uninsured, and in my ideal universe, out of business). Then you're hoping that the insurance company's checklist does more good than the overhead in enforcing it costs. Those type of guidelines generally fall into three categories. The first is the ones that are sensible and cost effective, but mostly those are the ones that everybody does regardless. You might marginally increase the number of people who do these things. This is where the possible benefit comes from. The second is the ones that are just ridiculous nonsense. Things insurance companies require because they're fallible entities. The typical "install antivirus on Linux servers" checkbox. It has no benefit but it has a cost and the cost offsets the benefit of the useful measures. The insurance company has minimal incentive not to do this, especially if insurance is required by law, because the cost is being paid by somebody else. The third are measures that are marginally effective but not cost effective. They do a little and cost a lot. Insurance companies love these because they do marginally reduce the number of claims and the cost is hidden, but it still gets passed on to the customer (you), and the cost exceeds the benefit. It's a deadweight loss to you but the insurance company has a perverse incentive to require it. When you put them all together you're lucky if you break even.