11 ms·

> Insurers say some attackers may even check whether potential victims have policies that would make them more likely to pay out. > Dickson said one technology

• fisherjeff 5y ago
  I don’t think the businesses that are buying insurance (my own included) are “just relying on insurance payments.” It’s just an additional layer of risk mitigation - not sure why there’s so much derision in many of the comments here.
  • c21h30o2 5y ago
    Because there are so many companies who deserve derision. Not all companies of course.
    • fisherjeff 5y ago
      Sure, but I would be surprised if those businesses are buying this insurance.
• zizee 5y ago
  > I hope we soon get to the point where companies that do not properly invest in cyber security get wiped out How do you determine this objectively?
  • azemetre 5y ago
    Well I suppose them continuing to get hit by ransomware attacks is the only legitimate metric.
• chii 5y ago
  > get wiped out like a real biological virus, these ransomware people would likely reduce their ransom to something the company can bear, and leech parasitically rather than ransom so much that their victims die off. The cost will be borne by the ultimate consumers, as long as cybersecurity remains more expensive on average than the cost of the ransom.
• alliao 5y ago
  anything untraceable is too enticing for insiders. the only way to shift this dynamic is to let everyone know that the companies that are hit are rife with rats eating investor value by using anonymous means to transfer wealth from company to insider. let them figure it out. in the mean time, unless proven otherwise, I'd treat all ransomware jobs as insider jobs.
• yunohn 5y ago
  > I hope we soon get to the point where companies that do not properly invest in cyber security get wiped out and ones that take matters seriously survive Could you provide some more detail on this viewpoint? Because I find this quite infeasible and toxic. While the most obvious security failures could be patched, it’s near impossible to guarantee perfect security for most reasonably sized companies. And for most non-tech or smaller businesses, it’s prohibitively expensive. Would you rather theft insurance also be outlawed, since the fault is on the home owner who failed to secure their home well enough?
  • bagacrap 5y ago
    Insurance should be used in addition to security best practices, not as a replacement. OP did not suggest that insurance should be outlawed, but that "just relying" on it should be a strategy that the market snuffs out. As a tech professional, it's hard to have sympathy for companies that are "hacked" via very basic exploits. I doubt Schlage would have much sympathy for a burglarized homeowner who had neglected to invest in locks.
  • csydas 5y ago
    > While the most obvious security failures could be patched, it’s near impossible to guarantee perfect security for most reasonably sized companies. And for most non-tech or smaller businesses, it’s prohibitively expensive. Would you rather theft insurance also be outlawed, since the fault is on the home owner who failed to secure their home well enough? I deal with ransomware a lot with clients, and while I absolutely sympathize with persons who are hit by an attack, I feel there are many different aspects to this where applying existing law/comparisons is more derailing than helpful. 1. Perfect is the enemy of good I see far too many people who get so hung up on this [0] that they ignore practical and easily fixable problems as a result. Far too many companies get the idea they need to protect from nation-state actors when, as is mostly a given, it's infeasible to do so as any given nation-state is likely going to be able to throw more resources at a problem than a given company. Even North Korea (maybe with help from China) has a fairly successful* cyberwarfare division, and they really did almost get away with a major heist. [1] 2. The conclusion one should draw from the above isn't that it's hopeless and you shouldn't do any protection, but instead, you should scale your protection for the risk you carry. Nation States "likely" aren't interested in Bob and Alice's Autoshop in Shucksville, USA. But ransomware gangs that just scan casually for openings certainly are. The answer here is consider your value practically and check your risk assets; what's exposed online, what ways do outsiders have into your environment? 3. Avoid checklists and passive scanners Passive scanners are a huge pain in the ass for my company as an MSP as we get clients that end up with a checklist they paid a non-trivial amount of money for and the recommendations would be funny if the payment for the recommendation wasn't so high. Passive scanning applications, even if we assume they have good intentions, have poor implementation and in fact reinforce the core problem; they allow IT administrators to just not think about the situation and instead fall back on the excuse of "I followed the list, there was nothing I could do", even when they had gaping holes in their infrastructure or extremely unsafe security practices. I could continue on, but I need to address the inevitable comparison to other crimes that produced the term "victim blaming", and while indeed ransomware attacks share some similarities, I'd like to point out where I see some differences. 1. Victims of personal attacks only have the duty to themselves; the implication is that reasonably, a person should be able to exist without another infringing on their freedoms and rights. 2. Victims of ransomware at a business level are responsible for the data of others; even if it's their own company, that's employee data which likely is not theirs, employee money among their resources, and so on. There is an expectation I think here that they're responsible not just for their own security, but have accepted and suggest responsibility for the livelihood of others. That is, I expect that someone who undertakes responsibility for others has a duty to go beyond to protect that which belongs to others. To me, this means when you accept responsibility for someone else's livelihood, you don't have the right to decide to expose their livelihood to potential risk without their consent. 3. An attack is an attack, for sure, and regardless of the situation, the attacker is the one at fault. The issue for me is more about those who choose to put others properties at risk because of decisions the responsible person made, because as above, my expectation is that when it involves someone else, unless they have 100% transparency into decisions I make, I have a duty to make the most responsible decisions for a given situation. If a sysadmin/netadmin implements lazy security because it's convenient for them and gets attacked, yes, I hold the attacker accountable. But I also then hold the admins accountable for not being responsible with my property. The responsibility for others is where I see that there's a significant difference, as it's no longer about personal liberty and freedom to exist online as much as it is about "did you take the reasonable steps to protect the data you are the protector of?" Me walking down the street, I should have an expectation I shouldn't be attacked, and I should have recourse if I am. If my data is exfiltrated by an attack that someone holding my data was a victim of, I have a right to know if that person was negligent while they were in charge of my data, and if they were found to be committing obvious flaws, despite that they were attacked, I have a right to know this and likely should have some recourse. [0] - "it’s near impossible to guarantee perfect security" [1] - https://www.bbc.com/news/stories-57520169 https://www.bbc.com/news/stories-57520169
• rectang 5y ago
  ̶N̶a̶t̶i̶o̶n̶ ̶s̶t̶a̶t̶e̶s̶ State level actors are already involved, through sheltering criminals seen to be damaging the economies of other states. https://en.wikipedia.org/wiki/Maksim_Yakubets https://en.wikipedia.org/wiki/Maksim_Yakubets The burdens of heated economic warfare are falling on private companies, because laws against ransomware can't practically be enforced. If these crimes were taking place entirely within the sphere of a single state, capturing the perpetrators wouldn't be completely impossible as it is now. Is your company prepared to be raided by a highly trained state-sponsored militia? Would we expect every company to ensure that its facilities can withstand artillery bombardment?
  • dan-robertson 5y ago
    You write nation state but link to an article about a Russian. Outside of the United States[1], ‘nation state’ is not synonymous with ‘country’ (for example Russia and Iran, two commonly mentioned adversaries, are multiethnic states rather than nation states). If you don’t want to write ‘country’ because it isn’t fancy enough, you can say ‘state level actor’ or ‘government actor’. I realise this is a stupid nitpick but this is a hill I am willing to die on. [1] lots of people in the national security sphere in the US like to use the term ‘nation state’ but they also use lots of stupid terms that don’t seem so much into everyday language. I do notice some media outlets or government sources outside of the US using alternative terms like the ones suggested above.
    • mistrial9 5y ago
      I agree with the post here -- it is a terrible error to brand an entire nation as "criminal" when it is antagonists within doing antagonistic things. This is fundemental to the concept of Justice -- on the other side, it is fomenting prejuidice directly to tar an entire set of the world, wherever.. thirdly, it ignores a lot of context
    • xrisk 5y ago
      I don’t see how being multiethnic makes Russia or Iran not have national identities (the requirement for being a nation state).
• tfehring 5y ago
  There’s nothing inherently unsustainable about relying on insurance for this type of thing. Arguably, properly priced cyber coverage would increase companies’ incentive to invest in good security, since it translates a possible cost in the future to a certain cost today in the form of higher premium. The problem is that cyber risk is (1) effectively impossible to model due to a lack of representative data and (2) probably highly correlated between companies, meaning that a vulnerability in a widely-used library or platform could mean massive systemic risk for insurers. As a result, premiums probably don’t align well with the underlying risk, even after the corrections described in the article. Profits in cyber insurance were very high (think combined ratios in the 50s-60s) and stable for a long time, but that ship seems to have sailed.
  • elliekelly 5y ago
    This is a really interesting point. Arguably the entity in the best position to “purchase” the insurance (and indemnify users) are the software companies rather than the licensees of the software.
    • rectang 5y ago
      At which point, we'll discover that selling such indemnity guarantees as part of software is ludicrously unprofitable and unsustainable, just like the insurance industry has. There is not a software tool which on its own can defend against ransomware. The most robust defense requires a total system design of "Continuous Restoration", with everything backed up, with backups stored in such a way that they cannot be destroyed, with backups constantly being restored to production, and with periodic human monitoring and manual confirmation that the system is working.
  • toss1 5y ago
    >>There’s nothing inherently unsustainable about relying on insurance for this type of thing. The counter to this is the behavior of the ransomware gangs - they increase their demand to the available insurance. So, when everyone has insurance, everyone is a target, and promptly pays out to the max insurable level (higher payouts get to be too much trouble for the ransomers). As this scales up, either the insurance company goes bankrupt, or the premium goes up to the same as the payout. Insurance is not the fix and arguably makes it a lot worse, as this provides a stream of funds to aid the ransomware gangs win the arms race. I'm not usually enthusiastic about law enforcement first policies, but it does seem from a game theory perspective that it'd be more effective to outlaw ransomware payments to choke funds from the criminals, and aggressively hunt them. Possibly fines doubling the ransom paid would help fund the fight on the enforcement side?
• dan-robertson 5y ago
  I think this does not acknowledge how incredibly asymmetric the difficulty is on each side. It is expensive and difficult to protect against security breaches, even with specialised software and expensive dedicated cybersecurity teams. Meanwhile, top-notch offensive capabilities might set you back up to seven figures which is easily achievable by unfriendly regimes (eg Russia, Iran, China, North Korea) or just criminals in places where they have little interference from authorities (eg most ransomware). One small fuckup is sufficient to have the whole thing compromised (though cybersecurity people do live to talk about defence in depth) and security doesn’t compose well. That is, security is a property of the system as a whole and security of individual parts needn’t imply security of the whole. I think analogies to physical security are bad because when you think of physical security you don’t imagine stealthy strangers constantly trying to pick your locks or open your windows or even tailgate people into the office at all times of day or night. But once one has a tool to breach a common system, it can be quickly tried on many systems at little marginal cost. When the marginal cost and risk are low, you may see more attacks. The real difference these days is that cryptocurrencies have made the potential payout high and so there are a lot of incentives to carrying these attacks.
  • deleted 5y ago
    [deleted]
  • mannykannot 5y ago
    It is not clear to me that OP's position fails to acknowledge the difficulties. It is, rather, the tacit assumption that this problem could be mitigated through insurance, in the way that comparatively low-level scams and thefts are, that fails to recognize the magnitude of the threat.
    • pfortuny 5y ago
      I am amazed that an insurance company is keen to make such a lose-lose deal, honestly, without proper verification of the capabilities of the insured person. Well, they seem to be learning now.
  • dcow 5y ago
• ip26 5y ago
  One route is that insurers require due diligence from their clients & employ pen-testers, perhaps adjusting your rate based on the findings of the pen-testers... Actually, this could be a viable business model for the white hats of the world.
• markus_zhang 5y ago
  Going to extremely difficult for small-mid companies. Instead we should ask government to be more serious about the threats and strike out if applicable. At the same time, should also find ways to monitor bitcoin movements.
  • dwd 5y ago
    Even more so for a boot-strapped startup - fronting 100s of dollars in insurance is a big ask to get started without taking on investor money. In this environment would an early stage JIRA, Salesforce or Bootcamp have gotten off the ground without incident? Probably a place where a viable startup should be able to apply for Gov funding or tax breaks for security investment, much like they provide funding for R&D.
• unclebucknasty 5y ago
  This blaming of companies and effective absolving of criminals every single time is ridiculous and I don't believe the etiology of this "sentiment" is organic. It has the hallmark signs of Russian propaganda. Deny and redirect blame. At the end of the day, this is a national security and organized crime problem. Russia and other adversarial governments are either directly behind the attacks or openly sanction them. It makes no sense to blame the companies, any more than it would to blame them for having a bomb dropped on them. We need to be rallying behind our companies and our governments to defend the interests we should all share as people of good faith, whose prosperity and well-being are under attack. These attacks represent assymetrical battlefield actions and we should be rallying around the idea of defense plus effective deterrent and offensive capabilities. Stop cheering on criminals and giving a pass to openly hostile regimes. It's past time to give Russia and others beligerents the smack in the mouth they've earned.
  • goldenkey 5y ago
    A teenager can do these attacks. Quit using boogeyman as excuses.
    • unclebucknasty 5y ago
      >A teenager can do these attacks. Quit using boogeyman as excuses. This is exactly the kind of propaganda I'm referring to. We all know that sophisticated attacks exist, the attack surface is vast, and it is extraordinarily difficult to indefinitely secure that attack surface against determined adversaries. We also know that foreign adversaries, and not "teenagers", are responsible for the overwhelming number of these attacks. But, here we have an apologist for those actors who blames the victims and calls the simple identification of the criminals "using boogeymen as excuses". It's gaslighting propaganda that has a consistent quality, and its origin is not organic.
      • staticassertion 5y ago
        It might be underselling their capabilities by referring to them as teenagers, but you're overselling the difficulty - it is not extraordinarily difficult to deal with these attackers.
• notesinthefield 5y ago
  Many in my area hedge coverages against what they estimate attackers might want because there simply isn't enough talent in the infosec sector. The policy always looks better than increasing headcount.
• rmah 5y ago
  This sort of attitude does not help expand the adoption of better security measures by organizations. It's the cybersecurity equivalent of "just say no", "this is your brain on drugs" or "all sex before marriage is evil".
  • lima 5y ago
    Buying insurance instead of adopting better security measures is not a helpful attitude either. Nany companies don't invest in better security measures because it's expensive to do so for decades worth of legacy systems and they'd rather take a small risk and get insured for it.