Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
A Crisis of Confidence Among Security Pros
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/5/2014 | 11:55:10 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Agree. It would be iluminating to know how the actuaries are calculating risk in order to make a profit!
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/5/2014 | 11:48:37 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Story of my life, a dollar short and a day late.  However, this expansion into the cyber injury arena by AIG demonstrates effectively that there is a market.  I would expect the number of companies offering insurance to grown significantly over the next decade.  

The only issue I see is that generally in the insurance industry the way you can offer reasonable premiums to your clients is to have a good mix of high risk and low risk clientele.  However, who would be your low risk clientele in this arena?  If a company doesn't retain sensitive information then they wouldn't need the insurance.  However, if a company does retain sensitive information then how could they not be high risk?

I suppose it will take someone smarter or craftier than myself to figure this conundrum out.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/5/2014 | 9:59:32 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Robert, AIG has beat you to the punch. Last month, the company became the first major insurer to expand the emerging cyber insurance market beyond corporate losses arising from data breaches. More info from Financial Times in AIG offers insurance against cyber injury.

 





 

 

Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/2/2014 | 1:30:28 PM
Re: Accepting Reality
Unfortunately, I don't think it has made its way to senior management yet.  In my experience there are few in senior management who understand the true value of information security. The line of thinking the majority of C level executives possess in regards to information security falls into two different categories.  The first of these is the belief that an information security department should be able to prevent anything bad from happening.  The second is the "nothing has happened" therefore why should I pay for information security mentality.  Regrettably, most people in senior management do not truly comprehend or appreciate the dynamics of our industry.

To address your second point, I think cyber incident insurance is a great idea.  If I had the capital to start an insurance company, I might just steal your idea! 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/2/2014 | 11:15:11 AM
Re: Accepting Reality
Drew, are you sure you shouldn't be working on Wall Street?
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
5/2/2014 | 11:13:52 AM
Re: Accepting Reality
I'm curious if this acceptance of reality has trickled up to senior management, and whether it might make cyber-insurance seem more worthwhile?

If so, I wonder if we'll see a derivatives market emerge for cyber-insurance policies: put together some risk pools, and then set an over/under on a breach.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/2/2014 | 10:45:42 AM
Re: Accepting Reality
I agree, this is just the reality in our business.  I work with some of the most talented security professionals in the country and not a single one of us would proclaim that we 'are confident' we know all the threats to our organization.  The truth of the matter is that no matter how much you research or plan something will sneak up and bite you eventually.

The goal is to protect yourself as best you can and be preparred for when an incident arises.
Randy Naramore
50%
50%
Randy Naramore,
User Rank: Ninja
5/2/2014 | 10:04:04 AM
Re: Accepting Reality
It is almost impossible to stop every threat that exists on your network but the key is to be mindful of the threats and use forums to stay informed of ways other people defend their information. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/2/2014 | 9:42:25 AM
Re: Accepting Reality
I agree, @Drew Conry-Murray. It's a good sign they can make an honest assessment of their security postures. Now comes the hard part, of course.

(And btw, your avatar always cracks me up). Happy Friday!
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
5/2/2014 | 9:36:30 AM
Accepting Reality
These results sound like industry professionals acknowledging reality. This isn't to say it's time to give up and go home; instead, it's better to understand the grim reality and then find ways to cope instead of pretending everything's fine.
Page 1 / 2   >   >>


Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31618
PUBLISHED: 2021-06-15
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why...
CVE-2021-20027
PUBLISHED: 2021-06-14
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls.
CVE-2021-32684
PUBLISHED: 2021-06-14
magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, an...
CVE-2021-34693
PUBLISHED: 2021-06-14
net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.
CVE-2021-27887
PUBLISHED: 2021-06-14
Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids ...