4 ms·

And if the interviews on infosec podcasts are any indication, insurance also means complacency on a management level because "we have insurance", and the insure

And if the interviews on infosec podcasts are any indication, insurance also means complacency on a management level because "we have insurance", and the insurers don't require you to actually make your security better. So being cyber-insured: - likely to have money to pay the ransom - probably not really implementing strong security policies - management more important than reality, so engineering buy-in unlikely which also means backups and redundancies unlikely to be effective at the target This makes you wonder who ends up paying for all of this (with time, energy, money, mental health).

malka 5y ago
> This makes you wonder who ends up paying for all of this (with time, energy, money, mental health). > the insurers don't require you to actually make your security better Dumb insurers it seems. Money going from dumb actor to smarter actors. This is capitalism.
mschuster91 5y ago
> This makes you wonder who ends up paying for all of this (with time, energy, money, mental health). The employees who are force-fed "security" crapware that some clueless CTO or other high level manager got sold at a golfing course (or got bribed to do such as Netskope did, see https://news.ycombinator.com/item?id=27047474 https://news.ycombinator.com/item?id=27047474), evaluated it on the specsheet as "fulfills the requirement of the insurance" and passed the can of turds down the line, for one.
vkou 5y ago
> This makes you wonder who ends up paying for all of this (with time, energy, money, mental health). With money? The cost gets passed on to the customers. In a few decades, the invisible hand of the market might push those customers to firms taking this issue seriously... But I think that to be quite unlikely.
curryst 5y ago
I think there's a net benefit to both sides here. The insurers probably charge a lot, in part because the risk is so hard to estimate and changes constantly with changes as well as new CVEs. I doubt they're losing money. The insured company gets benefits in terms of opex instead of capex, but more importantly, gets the expertise of the insurer in dealing with the situation. In that interview, the hacker also talks about liking working with insurance companies because they understand how this situation works. They don't try to negotiate down to 10%; there's an understood negotiation window. They know how to get the bitcoins and send them, and probably know how to do bookkeeping for all of that. I think it's closer to ransom insurance. The insurance company paying the ransom is a benefit, but not the primary reason to pay them. You pay them because they know what to do in that situation, and paying for ransom insurance looks slightly less ridiculous than paying a retainer to a Hostage Rescue Team. Most of the ransoms for hacks I've seen seemed well within the ability of the victim to pay. It's more about the negotiator that comes along with it, the bookkeeping, ensuring you get proof, ensuring they actually follow through, etc, etc.
- oneplane 5y ago
  That's a perspective I probably heard before but completely forgot about. Nice summary! I suppose having an efficient resolution to any 'problem' would be a net benefit for all parties involved, even if we would think all sorts of negative thoughts about it from a technical perspective. The same goes for botched negotiations or indeed people who don't even know how to deal with cryptocurrency. It does make me wonder when thinking about hostage negotiations if that parallel insurance concept has different requirements on the company in question. Say you ship expensive employees to a facility in a country where they are likely to be captured for ransom, you'd expect some training for the employees to deal with 'being held hostage', or 'reducing the likelyhood of being taken'. If that is the case, something similar would be sensible in the ransomware scenario, right?

malka 5y ago

> This makes you wonder who ends up paying for all of this (with time, energy, money, mental health). > the insurers don't require you to actually make your security better Dumb insurers it seems. Money going from dumb actor to smarter actors. This is capitalism.

mschuster91 5y ago

> This makes you wonder who ends up paying for all of this (with time, energy, money, mental health). The employees who are force-fed "security" crapware that some clueless CTO or other high level manager got sold at a golfing course (or got bribed to do such as Netskope did, see https://news.ycombinator.com/item?id=27047474 https://news.ycombinator.com/item?id=27047474), evaluated it on the specsheet as "fulfills the requirement of the insurance" and passed the can of turds down the line, for one.

vkou 5y ago

> This makes you wonder who ends up paying for all of this (with time, energy, money, mental health). With money? The cost gets passed on to the customers. In a few decades, the invisible hand of the market might push those customers to firms taking this issue seriously... But I think that to be quite unlikely.

curryst 5y ago

I think there's a net benefit to both sides here. The insurers probably charge a lot, in part because the risk is so hard to estimate and changes constantly with changes as well as new CVEs. I doubt they're losing money. The insured company gets benefits in terms of opex instead of capex, but more importantly, gets the expertise of the insurer in dealing with the situation. In that interview, the hacker also talks about liking working with insurance companies because they understand how this situation works. They don't try to negotiate down to 10%; there's an understood negotiation window. They know how to get the bitcoins and send them, and probably know how to do bookkeeping for all of that. I think it's closer to ransom insurance. The insurance company paying the ransom is a benefit, but not the primary reason to pay them. You pay them because they know what to do in that situation, and paying for ransom insurance looks slightly less ridiculous than paying a retainer to a Hostage Rescue Team. Most of the ransoms for hacks I've seen seemed well within the ability of the victim to pay. It's more about the negotiator that comes along with it, the bookkeeping, ensuring you get proof, ensuring they actually follow through, etc, etc.

oneplane 5y ago
That's a perspective I probably heard before but completely forgot about. Nice summary! I suppose having an efficient resolution to any 'problem' would be a net benefit for all parties involved, even if we would think all sorts of negative thoughts about it from a technical perspective. The same goes for botched negotiations or indeed people who don't even know how to deal with cryptocurrency. It does make me wonder when thinking about hostage negotiations if that parallel insurance concept has different requirements on the company in question. Say you ship expensive employees to a facility in a country where they are likely to be captured for ransom, you'd expect some training for the employees to deal with 'being held hostage', or 'reducing the likelyhood of being taken'. If that is the case, something similar would be sensible in the ransomware scenario, right?