Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
A Crisis of Confidence Among Security Pros
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/5/2014 | 11:55:10 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Agree. It would be iluminating to know how the actuaries are calculating risk in order to make a profit!
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/5/2014 | 11:48:37 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Story of my life, a dollar short and a day late.  However, this expansion into the cyber injury arena by AIG demonstrates effectively that there is a market.  I would expect the number of companies offering insurance to grown significantly over the next decade.  

The only issue I see is that generally in the insurance industry the way you can offer reasonable premiums to your clients is to have a good mix of high risk and low risk clientele.  However, who would be your low risk clientele in this arena?  If a company doesn't retain sensitive information then they wouldn't need the insurance.  However, if a company does retain sensitive information then how could they not be high risk?

I suppose it will take someone smarter or craftier than myself to figure this conundrum out.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/5/2014 | 9:59:32 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Robert, AIG has beat you to the punch. Last month, the company became the first major insurer to expand the emerging cyber insurance market beyond corporate losses arising from data breaches. More info from Financial Times in AIG offers insurance against cyber injury.

 





 

 

Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/2/2014 | 1:30:28 PM
Re: Accepting Reality
Unfortunately, I don't think it has made its way to senior management yet.  In my experience there are few in senior management who understand the true value of information security. The line of thinking the majority of C level executives possess in regards to information security falls into two different categories.  The first of these is the belief that an information security department should be able to prevent anything bad from happening.  The second is the "nothing has happened" therefore why should I pay for information security mentality.  Regrettably, most people in senior management do not truly comprehend or appreciate the dynamics of our industry.

To address your second point, I think cyber incident insurance is a great idea.  If I had the capital to start an insurance company, I might just steal your idea! 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/2/2014 | 11:15:11 AM
Re: Accepting Reality
Drew, are you sure you shouldn't be working on Wall Street?
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
5/2/2014 | 11:13:52 AM
Re: Accepting Reality
I'm curious if this acceptance of reality has trickled up to senior management, and whether it might make cyber-insurance seem more worthwhile?

If so, I wonder if we'll see a derivatives market emerge for cyber-insurance policies: put together some risk pools, and then set an over/under on a breach.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/2/2014 | 10:45:42 AM
Re: Accepting Reality
I agree, this is just the reality in our business.  I work with some of the most talented security professionals in the country and not a single one of us would proclaim that we 'are confident' we know all the threats to our organization.  The truth of the matter is that no matter how much you research or plan something will sneak up and bite you eventually.

The goal is to protect yourself as best you can and be preparred for when an incident arises.
Randy Naramore
50%
50%
Randy Naramore,
User Rank: Ninja
5/2/2014 | 10:04:04 AM
Re: Accepting Reality
It is almost impossible to stop every threat that exists on your network but the key is to be mindful of the threats and use forums to stay informed of ways other people defend their information. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/2/2014 | 9:42:25 AM
Re: Accepting Reality
I agree, @Drew Conry-Murray. It's a good sign they can make an honest assessment of their security postures. Now comes the hard part, of course.

(And btw, your avatar always cracks me up). Happy Friday!
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
5/2/2014 | 9:36:30 AM
Accepting Reality
These results sound like industry professionals acknowledging reality. This isn't to say it's time to give up and go home; instead, it's better to understand the grim reality and then find ways to cope instead of pretending everything's fine.
Page 1 / 2   >   >>


Commentary
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
Edge-DRsplash-10-edge-articles
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21554
PUBLISHED: 2021-06-14
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and, Dell Precision 7920 Rack Workstation BIOS contain a stack-based buffer overflow vulnerability in systems with Intel Optane DC Persistent Memory installed. A local malicious user with high privileges may potentially exploit t...
CVE-2021-21555
PUBLISHED: 2021-06-14
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a heap-based buffer overflow vulnerability in systems with NVDIMM-N installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, a...
CVE-2021-21556
PUBLISHED: 2021-06-14
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a stack-based buffer overflow vulnerability in systems with NVDIMM-N installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, ...
CVE-2021-21557
PUBLISHED: 2021-06-14
Dell PowerEdge Server BIOS and select Dell Precision Rack BIOS contain an out-of-bounds array access vulnerability. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of service, arbitrary code execution, or information disclosure in System Ma...
CVE-2021-32682
PUBLISHED: 2021-06-14
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration...