3 ms·

There’s nothing inherently unsustainable about relying on insurance for this type of thing. Arguably, properly priced cyber coverage would increase companies’ i

There’s nothing inherently unsustainable about relying on insurance for this type of thing. Arguably, properly priced cyber coverage would increase companies’ incentive to invest in good security, since it translates a possible cost in the future to a certain cost today in the form of higher premium. The problem is that cyber risk is (1) effectively impossible to model due to a lack of representative data and (2) probably highly correlated between companies, meaning that a vulnerability in a widely-used library or platform could mean massive systemic risk for insurers. As a result, premiums probably don’t align well with the underlying risk, even after the corrections described in the article. Profits in cyber insurance were very high (think combined ratios in the 50s-60s) and stable for a long time, but that ship seems to have sailed.

elliekelly 5y ago
This is a really interesting point. Arguably the entity in the best position to “purchase” the insurance (and indemnify users) are the software companies rather than the licensees of the software.
- rectang 5y ago
  At which point, we'll discover that selling such indemnity guarantees as part of software is ludicrously unprofitable and unsustainable, just like the insurance industry has. There is not a software tool which on its own can defend against ransomware. The most robust defense requires a total system design of "Continuous Restoration", with everything backed up, with backups stored in such a way that they cannot be destroyed, with backups constantly being restored to production, and with periodic human monitoring and manual confirmation that the system is working.
toss1 5y ago
>>There’s nothing inherently unsustainable about relying on insurance for this type of thing. The counter to this is the behavior of the ransomware gangs - they increase their demand to the available insurance. So, when everyone has insurance, everyone is a target, and promptly pays out to the max insurable level (higher payouts get to be too much trouble for the ransomers). As this scales up, either the insurance company goes bankrupt, or the premium goes up to the same as the payout. Insurance is not the fix and arguably makes it a lot worse, as this provides a stream of funds to aid the ransomware gangs win the arms race. I'm not usually enthusiastic about law enforcement first policies, but it does seem from a game theory perspective that it'd be more effective to outlaw ransomware payments to choke funds from the criminals, and aggressively hunt them. Possibly fines doubling the ransom paid would help fund the fight on the enforcement side?
- TheCoelacanth 5y ago
  Insurance to pay off the gangs makes things worse, but insurance to pay for the damage caused by refusing to pay wouldn't.
  - toss1 5y ago
    Yes, good point. Although paying only for recovery requires a lot of access to internal accounting information to ensure that the victim is actually paying for recovery and not paying off the gangs in secret. And there's a pretty strong motive for the victim to do this. While I find insurers are far too often in the category of scammers (e.g., see recision of fully paid health insurance policies on bogus criteria after an insured person gets an expensive disease), I don't envy them here. I don't see how an insurer is to make a product profitable (i.e., worth selling) when they are specifically & systematically targeted by these gangs.
rkagerer 5y ago
The problem is that cyber risk is effectively impossible to model As an embedded consultant I've worked very closely with several companies in at-risk spaces (eg. banking), and from a technical / corporate-culture perspective I have a good idea of which ones are less likely to be breached. I think part of the challenge is there's a huge disconnect between how the insurance companies work (fairly macro) and the little details that really matter to assessing the security posture of an individual customer. A premiums discount for those who undergo intensive annual security audits by respected professionals would be a good start, then you can begin to rate the auditor's performance tier based on the relative number of their clients impacted.
- tfehring 5y ago
  A qualitative assessment like whether Company A is more likely to be breached than Company B is a good start, but it's a far cry from being able to actually quantify each of their expected losses. I agree that there's a big disconnect between the way that insurers assess risk and the way that security researchers assess risk. But I'm skeptical that the type of assessment you're describing can be done at scale in a rigorous enough way to inform pricing decisions, I worry that it would just turn into gameable checklists and therefore cease to be a good measure. Perhaps more importantly, it's probably possible for insurers to accurately assess the expected annual cost associated with a given company's employees getting phished for a seven-digit ransom, but that's not the only risk they're worried about. Even if it can accurately assess the average loss associated with, say, a major 0day in a particular piece of software that's used by a double-digit percentage of companies - a much harder task - an insurer might just not want that much exposure to a single point of failure on its balance sheet.

elliekelly 5y ago

This is a really interesting point. Arguably the entity in the best position to “purchase” the insurance (and indemnify users) are the software companies rather than the licensees of the software.

rectang 5y ago
At which point, we'll discover that selling such indemnity guarantees as part of software is ludicrously unprofitable and unsustainable, just like the insurance industry has. There is not a software tool which on its own can defend against ransomware. The most robust defense requires a total system design of "Continuous Restoration", with everything backed up, with backups stored in such a way that they cannot be destroyed, with backups constantly being restored to production, and with periodic human monitoring and manual confirmation that the system is working.

toss1 5y ago

>>There’s nothing inherently unsustainable about relying on insurance for this type of thing. The counter to this is the behavior of the ransomware gangs - they increase their demand to the available insurance. So, when everyone has insurance, everyone is a target, and promptly pays out to the max insurable level (higher payouts get to be too much trouble for the ransomers). As this scales up, either the insurance company goes bankrupt, or the premium goes up to the same as the payout. Insurance is not the fix and arguably makes it a lot worse, as this provides a stream of funds to aid the ransomware gangs win the arms race. I'm not usually enthusiastic about law enforcement first policies, but it does seem from a game theory perspective that it'd be more effective to outlaw ransomware payments to choke funds from the criminals, and aggressively hunt them. Possibly fines doubling the ransom paid would help fund the fight on the enforcement side?

TheCoelacanth 5y ago
Insurance to pay off the gangs makes things worse, but insurance to pay for the damage caused by refusing to pay wouldn't.
- toss1 5y ago
  Yes, good point. Although paying only for recovery requires a lot of access to internal accounting information to ensure that the victim is actually paying for recovery and not paying off the gangs in secret. And there's a pretty strong motive for the victim to do this. While I find insurers are far too often in the category of scammers (e.g., see recision of fully paid health insurance policies on bogus criteria after an insured person gets an expensive disease), I don't envy them here. I don't see how an insurer is to make a product profitable (i.e., worth selling) when they are specifically & systematically targeted by these gangs.

rkagerer 5y ago

The problem is that cyber risk is effectively impossible to model As an embedded consultant I've worked very closely with several companies in at-risk spaces (eg. banking), and from a technical / corporate-culture perspective I have a good idea of which ones are less likely to be breached. I think part of the challenge is there's a huge disconnect between how the insurance companies work (fairly macro) and the little details that really matter to assessing the security posture of an individual customer. A premiums discount for those who undergo intensive annual security audits by respected professionals would be a good start, then you can begin to rate the auditor's performance tier based on the relative number of their clients impacted.

tfehring 5y ago
A qualitative assessment like whether Company A is more likely to be breached than Company B is a good start, but it's a far cry from being able to actually quantify each of their expected losses. I agree that there's a big disconnect between the way that insurers assess risk and the way that security researchers assess risk. But I'm skeptical that the type of assessment you're describing can be done at scale in a rigorous enough way to inform pricing decisions, I worry that it would just turn into gameable checklists and therefore cease to be a good measure. Perhaps more importantly, it's probably possible for insurers to accurately assess the expected annual cost associated with a given company's employees getting phished for a seven-digit ransom, but that's not the only risk they're worried about. Even if it can accurately assess the average loss associated with, say, a major 0day in a particular piece of software that's used by a double-digit percentage of companies - a much harder task - an insurer might just not want that much exposure to a single point of failure on its balance sheet.