Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
A Crisis of Confidence Among Security Pros
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/5/2014 | 11:55:10 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Agree. It would be iluminating to know how the actuaries are calculating risk in order to make a profit!
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/5/2014 | 11:48:37 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Story of my life, a dollar short and a day late.  However, this expansion into the cyber injury arena by AIG demonstrates effectively that there is a market.  I would expect the number of companies offering insurance to grown significantly over the next decade.  

The only issue I see is that generally in the insurance industry the way you can offer reasonable premiums to your clients is to have a good mix of high risk and low risk clientele.  However, who would be your low risk clientele in this arena?  If a company doesn't retain sensitive information then they wouldn't need the insurance.  However, if a company does retain sensitive information then how could they not be high risk?

I suppose it will take someone smarter or craftier than myself to figure this conundrum out.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/5/2014 | 9:59:32 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Robert, AIG has beat you to the punch. Last month, the company became the first major insurer to expand the emerging cyber insurance market beyond corporate losses arising from data breaches. More info from Financial Times in AIG offers insurance against cyber injury.

 





 

 

Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/2/2014 | 1:30:28 PM
Re: Accepting Reality
Unfortunately, I don't think it has made its way to senior management yet.  In my experience there are few in senior management who understand the true value of information security. The line of thinking the majority of C level executives possess in regards to information security falls into two different categories.  The first of these is the belief that an information security department should be able to prevent anything bad from happening.  The second is the "nothing has happened" therefore why should I pay for information security mentality.  Regrettably, most people in senior management do not truly comprehend or appreciate the dynamics of our industry.

To address your second point, I think cyber incident insurance is a great idea.  If I had the capital to start an insurance company, I might just steal your idea! 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/2/2014 | 11:15:11 AM
Re: Accepting Reality
Drew, are you sure you shouldn't be working on Wall Street?
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
5/2/2014 | 11:13:52 AM
Re: Accepting Reality
I'm curious if this acceptance of reality has trickled up to senior management, and whether it might make cyber-insurance seem more worthwhile?

If so, I wonder if we'll see a derivatives market emerge for cyber-insurance policies: put together some risk pools, and then set an over/under on a breach.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/2/2014 | 10:45:42 AM
Re: Accepting Reality
I agree, this is just the reality in our business.  I work with some of the most talented security professionals in the country and not a single one of us would proclaim that we 'are confident' we know all the threats to our organization.  The truth of the matter is that no matter how much you research or plan something will sneak up and bite you eventually.

The goal is to protect yourself as best you can and be preparred for when an incident arises.
Randy Naramore
50%
50%
Randy Naramore,
User Rank: Ninja
5/2/2014 | 10:04:04 AM
Re: Accepting Reality
It is almost impossible to stop every threat that exists on your network but the key is to be mindful of the threats and use forums to stay informed of ways other people defend their information. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/2/2014 | 9:42:25 AM
Re: Accepting Reality
I agree, @Drew Conry-Murray. It's a good sign they can make an honest assessment of their security postures. Now comes the hard part, of course.

(And btw, your avatar always cracks me up). Happy Friday!
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
5/2/2014 | 9:36:30 AM
Accepting Reality
These results sound like industry professionals acknowledging reality. This isn't to say it's time to give up and go home; instead, it's better to understand the grim reality and then find ways to cope instead of pretending everything's fine.
Page 1 / 2   >   >>


Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-34812
PUBLISHED: 2021-06-18
Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2021-34808
PUBLISHED: 2021-06-18
Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.
CVE-2021-34809
PUBLISHED: 2021-06-18
Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVE-2021-34810
PUBLISHED: 2021-06-18
Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVE-2021-34811
PUBLISHED: 2021-06-18
Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors.