4 ms·

> I hope we soon get to the point where companies that do not properly invest in cyber security get wiped out and ones that take matters seriously survive Coul

by yunohn 5y ago

> I hope we soon get to the point where companies that do not properly invest in cyber security get wiped out and ones that take matters seriously survive Could you provide some more detail on this viewpoint? Because I find this quite infeasible and toxic. While the most obvious security failures could be patched, it’s near impossible to guarantee perfect security for most reasonably sized companies. And for most non-tech or smaller businesses, it’s prohibitively expensive. Would you rather theft insurance also be outlawed, since the fault is on the home owner who failed to secure their home well enough?

bagacrap 5y ago
Insurance should be used in addition to security best practices, not as a replacement. OP did not suggest that insurance should be outlawed, but that "just relying" on it should be a strategy that the market snuffs out. As a tech professional, it's hard to have sympathy for companies that are "hacked" via very basic exploits. I doubt Schlage would have much sympathy for a burglarized homeowner who had neglected to invest in locks.
csydas 5y ago
> While the most obvious security failures could be patched, it’s near impossible to guarantee perfect security for most reasonably sized companies. And for most non-tech or smaller businesses, it’s prohibitively expensive. Would you rather theft insurance also be outlawed, since the fault is on the home owner who failed to secure their home well enough? I deal with ransomware a lot with clients, and while I absolutely sympathize with persons who are hit by an attack, I feel there are many different aspects to this where applying existing law/comparisons is more derailing than helpful. 1. Perfect is the enemy of good I see far too many people who get so hung up on this [0] that they ignore practical and easily fixable problems as a result. Far too many companies get the idea they need to protect from nation-state actors when, as is mostly a given, it's infeasible to do so as any given nation-state is likely going to be able to throw more resources at a problem than a given company. Even North Korea (maybe with help from China) has a fairly successful* cyberwarfare division, and they really did almost get away with a major heist. [1] 2. The conclusion one should draw from the above isn't that it's hopeless and you shouldn't do any protection, but instead, you should scale your protection for the risk you carry. Nation States "likely" aren't interested in Bob and Alice's Autoshop in Shucksville, USA. But ransomware gangs that just scan casually for openings certainly are. The answer here is consider your value practically and check your risk assets; what's exposed online, what ways do outsiders have into your environment? 3. Avoid checklists and passive scanners Passive scanners are a huge pain in the ass for my company as an MSP as we get clients that end up with a checklist they paid a non-trivial amount of money for and the recommendations would be funny if the payment for the recommendation wasn't so high. Passive scanning applications, even if we assume they have good intentions, have poor implementation and in fact reinforce the core problem; they allow IT administrators to just not think about the situation and instead fall back on the excuse of "I followed the list, there was nothing I could do", even when they had gaping holes in their infrastructure or extremely unsafe security practices. I could continue on, but I need to address the inevitable comparison to other crimes that produced the term "victim blaming", and while indeed ransomware attacks share some similarities, I'd like to point out where I see some differences. 1. Victims of personal attacks only have the duty to themselves; the implication is that reasonably, a person should be able to exist without another infringing on their freedoms and rights. 2. Victims of ransomware at a business level are responsible for the data of others; even if it's their own company, that's employee data which likely is not theirs, employee money among their resources, and so on. There is an expectation I think here that they're responsible not just for their own security, but have accepted and suggest responsibility for the livelihood of others. That is, I expect that someone who undertakes responsibility for others has a duty to go beyond to protect that which belongs to others. To me, this means when you accept responsibility for someone else's livelihood, you don't have the right to decide to expose their livelihood to potential risk without their consent. 3. An attack is an attack, for sure, and regardless of the situation, the attacker is the one at fault. The issue for me is more about those who choose to put others properties at risk because of decisions the responsible person made, because as above, my expectation is that when it involves someone else, unless they have 100% transparency into decisions I make, I have a duty to make the most responsible decisions for a given situation. If a sysadmin/netadmin implements lazy security because it's convenient for them and gets attacked, yes, I hold the attacker accountable. But I also then hold the admins accountable for not being responsible with my property. The responsibility for others is where I see that there's a significant difference, as it's no longer about personal liberty and freedom to exist online as much as it is about "did you take the reasonable steps to protect the data you are the protector of?" Me walking down the street, I should have an expectation I shouldn't be attacked, and I should have recourse if I am. If my data is exfiltrated by an attack that someone holding my data was a victim of, I have a right to know if that person was negligent while they were in charge of my data, and if they were found to be committing obvious flaws, despite that they were attacked, I have a right to know this and likely should have some recourse. [0] - "it’s near impossible to guarantee perfect security" [1] - https://www.bbc.com/news/stories-57520169 https://www.bbc.com/news/stories-57520169
- csydas 5y ago
  Also, after reflection I suppose custody is the word I'm looking for :)
PicassoCTs 5y ago
In a ecosystem with permanent hostilities all creatures become crabs. https://en.wikipedia.org/wiki/Carcinisation https://en.wikipedia.org/wiki/Carcinisation Its a nice example of self-taxation. If one refuses to pay taxes for the police and state, one pays his gains to a guarded community, a armored car and insurance against criminal acts.
miohtama 5y ago
Stock buybacks are record high: https://www.cnbc.com/2021/10/27/stock-buybacks-surge-to-likely-record-highs-but-a-tax-from-congress-poses-a-threat.html https://www.cnbc.com/2021/10/27/stock-buybacks-surge-to-like... Meanwhile cybersecurity IT talent is underpaid, understaffed and hard to retain: https://leadcomm.com.br/wp-content/uploads/2020/03/State-of-Cybersecurity-2020-Part-1.pdf https://leadcomm.com.br/wp-content/uploads/2020/03/State-of-... Companies simply does not invest enough in a critical area. If the capitalism works, companies that constantly optimise short term profit vs. investing survivability should eventually go broke. If this does not happen then there is no incentive for companies to do the right thing and invest in the security in the first place. It will be never 100% secure, but now we are like 50% secure when we should be 95% secure.
- darkwater 5y ago
  > Meanwhile cybersecurity IT talent is underpaid, understaffed and hard to retain If it's hard to retain means that there is someone else paying better, it cannot be underpaid at the same time.
  - miohtama 5y ago
    It also might be hard to retain, because people involved in cybersecurity are not giving proper authority, respect or other organisational resources to do their job.
  - purple_turtle 5y ago
    1) they could be changing jobs away from being security researcher 2) they can be changing jobs to one that is just unpaid, but they are treated more seriously 3) they could be changing from severely underpaid to just underpaid
  - Mountain_Skies 5y ago
    I left cybersecurity and went back to software development due to the difference in wages.
    - 5y ago
mlac 5y ago
Yeah this would be bad for innovation as well. All things equal, the startups that emphasize security to the detriment of functionality will lose to those that get the product to market faster and secure it later. Not saying this is ideal (I’d love security to be a competitive advantage and properly required so startups start prioritizing it), but I’d say we need to focus security on the platforms and tech used by most startups so that their attack surface is their unique product.
- miohtama 5y ago
  This is a good comment. However most of ransomware targets are well-established companies and already have an insurance, as the article stated. The insurance pays any lack of cybersecurity on behalf of them. Until it does not.
elliekelly 5y ago
With homeowners insurance you usually have to prove there was some visible damage or evidence of forced entry in order to make a claim from a burglary. That’s because the homeowner has a duty to prevent and mitigate losses. I can’t leave my front door unlocked and say “Take whatever you want! I can just make a claim to Allstate!” But that seems to be the preferred approach to cybersecurity at some companies...
__s 5y ago
Insurance coverage can be conditional on sufficient efforts being made. Insuring against ransomware should come along with a list of preconditions & random security auditing (sure, there'll be some stupid rules like "no having port 22 open" but if you want your own security rules you can do that without insurance). Comparing physical security with cyber security is facetious. Anyone in the world has to make a serious effort to break into my home, & they'll have to do it on Canadian soil. All for a pretty lousy pay off. These incentives are not the same in software security
- staticautomatic 5y ago
  In the insurance world, sufficient efforts aren’t always sufficient to mitigate this kind of problem. In commercial wildfire risk and in municipal insurance (think police brutality cases), for example, precautionary prescriptions often aren’t enough to keep entities from becoming uninsurable due to things like litigation risk.
- Haegin 5y ago
  Some cyber insurers are already doing this. I know at least one that scans the company network when quoting and will decline applicants who have open RDP detected on their network for example.
dd82 5y ago
At coalition, we scan the infra when deciding to make an automated quote or do a secondary manual review. So being able to have data about what the possible insured actually has in terms of hardware and practices (MFA, backups, etc) is very valuable. When we decline, the applicant gets the reasons why for the decline, and they're free to re-apply after implementing fixes and good practices. We're not demanding perfect security. We do ask for good practices and evaluate risk from there. Security does not need to be expensive, but many places see it as second or third tier priority until shit hits the fan, and _that_ is where it gets prohibitively expensive. Penny wise, pound foolish.
- Root_Denied 5y ago
  This is where I've been predicting the insurance side of cybersec going for a while. You have some baseline required security for the premium that offers X coverage, and you can reduce the premium or increase the coverage if you can prove Y standards have been met. Get a list of approved 3rd party auditors/pentesting companies, have them certify what level your company is at, apply appropriate discount. Insurance costs are a language that businesses speak fluently, so I think this has a higher chance of moving the needle on cybersecurity standards and have them actually be implemented across the board.

by yunohn 5y ago

bagacrap 5y ago

Insurance should be used in addition to security best practices, not as a replacement. OP did not suggest that insurance should be outlawed, but that "just relying" on it should be a strategy that the market snuffs out. As a tech professional, it's hard to have sympathy for companies that are "hacked" via very basic exploits. I doubt Schlage would have much sympathy for a burglarized homeowner who had neglected to invest in locks.

csydas 5y ago

> While the most obvious security failures could be patched, it’s near impossible to guarantee perfect security for most reasonably sized companies. And for most non-tech or smaller businesses, it’s prohibitively expensive. Would you rather theft insurance also be outlawed, since the fault is on the home owner who failed to secure their home well enough? I deal with ransomware a lot with clients, and while I absolutely sympathize with persons who are hit by an attack, I feel there are many different aspects to this where applying existing law/comparisons is more derailing than helpful. 1. Perfect is the enemy of good I see far too many people who get so hung up on this [0] that they ignore practical and easily fixable problems as a result. Far too many companies get the idea they need to protect from nation-state actors when, as is mostly a given, it's infeasible to do so as any given nation-state is likely going to be able to throw more resources at a problem than a given company. Even North Korea (maybe with help from China) has a fairly successful* cyberwarfare division, and they really did almost get away with a major heist. [1] 2. The conclusion one should draw from the above isn't that it's hopeless and you shouldn't do any protection, but instead, you should scale your protection for the risk you carry. Nation States "likely" aren't interested in Bob and Alice's Autoshop in Shucksville, USA. But ransomware gangs that just scan casually for openings certainly are. The answer here is consider your value practically and check your risk assets; what's exposed online, what ways do outsiders have into your environment? 3. Avoid checklists and passive scanners Passive scanners are a huge pain in the ass for my company as an MSP as we get clients that end up with a checklist they paid a non-trivial amount of money for and the recommendations would be funny if the payment for the recommendation wasn't so high. Passive scanning applications, even if we assume they have good intentions, have poor implementation and in fact reinforce the core problem; they allow IT administrators to just not think about the situation and instead fall back on the excuse of "I followed the list, there was nothing I could do", even when they had gaping holes in their infrastructure or extremely unsafe security practices. I could continue on, but I need to address the inevitable comparison to other crimes that produced the term "victim blaming", and while indeed ransomware attacks share some similarities, I'd like to point out where I see some differences. 1. Victims of personal attacks only have the duty to themselves; the implication is that reasonably, a person should be able to exist without another infringing on their freedoms and rights. 2. Victims of ransomware at a business level are responsible for the data of others; even if it's their own company, that's employee data which likely is not theirs, employee money among their resources, and so on. There is an expectation I think here that they're responsible not just for their own security, but have accepted and suggest responsibility for the livelihood of others. That is, I expect that someone who undertakes responsibility for others has a duty to go beyond to protect that which belongs to others. To me, this means when you accept responsibility for someone else's livelihood, you don't have the right to decide to expose their livelihood to potential risk without their consent. 3. An attack is an attack, for sure, and regardless of the situation, the attacker is the one at fault. The issue for me is more about those who choose to put others properties at risk because of decisions the responsible person made, because as above, my expectation is that when it involves someone else, unless they have 100% transparency into decisions I make, I have a duty to make the most responsible decisions for a given situation. If a sysadmin/netadmin implements lazy security because it's convenient for them and gets attacked, yes, I hold the attacker accountable. But I also then hold the admins accountable for not being responsible with my property. The responsibility for others is where I see that there's a significant difference, as it's no longer about personal liberty and freedom to exist online as much as it is about "did you take the reasonable steps to protect the data you are the protector of?" Me walking down the street, I should have an expectation I shouldn't be attacked, and I should have recourse if I am. If my data is exfiltrated by an attack that someone holding my data was a victim of, I have a right to know if that person was negligent while they were in charge of my data, and if they were found to be committing obvious flaws, despite that they were attacked, I have a right to know this and likely should have some recourse. [0] - "it’s near impossible to guarantee perfect security" [1] - https://www.bbc.com/news/stories-57520169 https://www.bbc.com/news/stories-57520169

csydas 5y ago
Also, after reflection I suppose custody is the word I'm looking for :)

PicassoCTs 5y ago

In a ecosystem with permanent hostilities all creatures become crabs. https://en.wikipedia.org/wiki/Carcinisation https://en.wikipedia.org/wiki/Carcinisation Its a nice example of self-taxation. If one refuses to pay taxes for the police and state, one pays his gains to a guarded community, a armored car and insurance against criminal acts.

miohtama 5y ago

Stock buybacks are record high: https://www.cnbc.com/2021/10/27/stock-buybacks-surge-to-likely-record-highs-but-a-tax-from-congress-poses-a-threat.html https://www.cnbc.com/2021/10/27/stock-buybacks-surge-to-like... Meanwhile cybersecurity IT talent is underpaid, understaffed and hard to retain: https://leadcomm.com.br/wp-content/uploads/2020/03/State-of-Cybersecurity-2020-Part-1.pdf https://leadcomm.com.br/wp-content/uploads/2020/03/State-of-... Companies simply does not invest enough in a critical area. If the capitalism works, companies that constantly optimise short term profit vs. investing survivability should eventually go broke. If this does not happen then there is no incentive for companies to do the right thing and invest in the security in the first place. It will be never 100% secure, but now we are like 50% secure when we should be 95% secure.

darkwater 5y ago
> Meanwhile cybersecurity IT talent is underpaid, understaffed and hard to retain If it's hard to retain means that there is someone else paying better, it cannot be underpaid at the same time.
- miohtama 5y ago
  It also might be hard to retain, because people involved in cybersecurity are not giving proper authority, respect or other organisational resources to do their job.
- purple_turtle 5y ago
  1) they could be changing jobs away from being security researcher 2) they can be changing jobs to one that is just unpaid, but they are treated more seriously 3) they could be changing from severely underpaid to just underpaid
- Mountain_Skies 5y ago
  I left cybersecurity and went back to software development due to the difference in wages.
  - 5y ago

mlac 5y ago

Yeah this would be bad for innovation as well. All things equal, the startups that emphasize security to the detriment of functionality will lose to those that get the product to market faster and secure it later. Not saying this is ideal (I’d love security to be a competitive advantage and properly required so startups start prioritizing it), but I’d say we need to focus security on the platforms and tech used by most startups so that their attack surface is their unique product.

miohtama 5y ago
This is a good comment. However most of ransomware targets are well-established companies and already have an insurance, as the article stated. The insurance pays any lack of cybersecurity on behalf of them. Until it does not.

elliekelly 5y ago

With homeowners insurance you usually have to prove there was some visible damage or evidence of forced entry in order to make a claim from a burglary. That’s because the homeowner has a duty to prevent and mitigate losses. I can’t leave my front door unlocked and say “Take whatever you want! I can just make a claim to Allstate!” But that seems to be the preferred approach to cybersecurity at some companies...

__s 5y ago

Insurance coverage can be conditional on sufficient efforts being made. Insuring against ransomware should come along with a list of preconditions & random security auditing (sure, there'll be some stupid rules like "no having port 22 open" but if you want your own security rules you can do that without insurance). Comparing physical security with cyber security is facetious. Anyone in the world has to make a serious effort to break into my home, & they'll have to do it on Canadian soil. All for a pretty lousy pay off. These incentives are not the same in software security

staticautomatic 5y ago
In the insurance world, sufficient efforts aren’t always sufficient to mitigate this kind of problem. In commercial wildfire risk and in municipal insurance (think police brutality cases), for example, precautionary prescriptions often aren’t enough to keep entities from becoming uninsurable due to things like litigation risk.
Haegin 5y ago
Some cyber insurers are already doing this. I know at least one that scans the company network when quoting and will decline applicants who have open RDP detected on their network for example.

dd82 5y ago

At coalition, we scan the infra when deciding to make an automated quote or do a secondary manual review. So being able to have data about what the possible insured actually has in terms of hardware and practices (MFA, backups, etc) is very valuable. When we decline, the applicant gets the reasons why for the decline, and they're free to re-apply after implementing fixes and good practices. We're not demanding perfect security. We do ask for good practices and evaluate risk from there. Security does not need to be expensive, but many places see it as second or third tier priority until shit hits the fan, and _that_ is where it gets prohibitively expensive. Penny wise, pound foolish.

Root_Denied 5y ago
This is where I've been predicting the insurance side of cybersec going for a while. You have some baseline required security for the premium that offers X coverage, and you can reduce the premium or increase the coverage if you can prove Y standards have been met. Get a list of approved 3rd party auditors/pentesting companies, have them certify what level your company is at, apply appropriate discount. Insurance costs are a language that businesses speak fluently, so I think this has a higher chance of moving the needle on cybersecurity standards and have them actually be implemented across the board.