Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
A Crisis of Confidence Among Security Pros
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/5/2014 | 11:55:10 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Agree. It would be iluminating to know how the actuaries are calculating risk in order to make a profit!
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/5/2014 | 11:48:37 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Story of my life, a dollar short and a day late.  However, this expansion into the cyber injury arena by AIG demonstrates effectively that there is a market.  I would expect the number of companies offering insurance to grown significantly over the next decade.  

The only issue I see is that generally in the insurance industry the way you can offer reasonable premiums to your clients is to have a good mix of high risk and low risk clientele.  However, who would be your low risk clientele in this arena?  If a company doesn't retain sensitive information then they wouldn't need the insurance.  However, if a company does retain sensitive information then how could they not be high risk?

I suppose it will take someone smarter or craftier than myself to figure this conundrum out.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/5/2014 | 9:59:32 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Robert, AIG has beat you to the punch. Last month, the company became the first major insurer to expand the emerging cyber insurance market beyond corporate losses arising from data breaches. More info from Financial Times in AIG offers insurance against cyber injury.

 





 

 

Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/2/2014 | 1:30:28 PM
Re: Accepting Reality
Unfortunately, I don't think it has made its way to senior management yet.  In my experience there are few in senior management who understand the true value of information security. The line of thinking the majority of C level executives possess in regards to information security falls into two different categories.  The first of these is the belief that an information security department should be able to prevent anything bad from happening.  The second is the "nothing has happened" therefore why should I pay for information security mentality.  Regrettably, most people in senior management do not truly comprehend or appreciate the dynamics of our industry.

To address your second point, I think cyber incident insurance is a great idea.  If I had the capital to start an insurance company, I might just steal your idea! 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/2/2014 | 11:15:11 AM
Re: Accepting Reality
Drew, are you sure you shouldn't be working on Wall Street?
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
5/2/2014 | 11:13:52 AM
Re: Accepting Reality
I'm curious if this acceptance of reality has trickled up to senior management, and whether it might make cyber-insurance seem more worthwhile?

If so, I wonder if we'll see a derivatives market emerge for cyber-insurance policies: put together some risk pools, and then set an over/under on a breach.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/2/2014 | 10:45:42 AM
Re: Accepting Reality
I agree, this is just the reality in our business.  I work with some of the most talented security professionals in the country and not a single one of us would proclaim that we 'are confident' we know all the threats to our organization.  The truth of the matter is that no matter how much you research or plan something will sneak up and bite you eventually.

The goal is to protect yourself as best you can and be preparred for when an incident arises.
Randy Naramore
50%
50%
Randy Naramore,
User Rank: Ninja
5/2/2014 | 10:04:04 AM
Re: Accepting Reality
It is almost impossible to stop every threat that exists on your network but the key is to be mindful of the threats and use forums to stay informed of ways other people defend their information. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/2/2014 | 9:42:25 AM
Re: Accepting Reality
I agree, @Drew Conry-Murray. It's a good sign they can make an honest assessment of their security postures. Now comes the hard part, of course.

(And btw, your avatar always cracks me up). Happy Friday!
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
5/2/2014 | 9:36:30 AM
Accepting Reality
These results sound like industry professionals acknowledging reality. This isn't to say it's time to give up and go home; instead, it's better to understand the grim reality and then find ways to cope instead of pretending everything's fine.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31834
PUBLISHED: 2021-10-22
Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized.
CVE-2021-31835
PUBLISHED: 2021-10-22
Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via a specific parameter where the administrator's entries were not correctly sanitized.
CVE-2021-34362
PUBLISHED: 2021-10-22
A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, this vulnerability allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of Media Streaming add-on: QTS 5.0.0: Media ...
CVE-2021-41127
PUBLISHED: 2021-10-21
Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model `tar.gz` file which allows a malicious actor to craft a `model.tar.gz` file which can overwrite or replace bot...
CVE-2021-41169
PUBLISHED: 2021-10-21
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.