The Price of a Hack | Hacker News Reader

The Price of a Hack

npr.org

18 pointsdanso11 comments

I just listened to this podcast episode. At no point do they answer the question on the title.

This is a very short peek into cyber insurance and phishing.

It you like podcasts and stories about hacking, skip this one and try the podcast Darknet Diaries.

I think they do, at least in part: They directly discuss how the price of their insurance policy changed following the event:

> WENDY: I emailed our agent this morning because I hadn't heard anything. Knowing that we are - ah, AIG quoted the renewal with limits with a 66 percent increase and increased the retention from 10,000 to 25,000. Ew, that's the deductible.

> TEMPLE-RASTON: Increasing your premium by 66 percent and more than doubling your deductible - that motivates change.

[...]

> DUFFIN: Wendy was able to convince a new insurance company that her new training program actually worked. She got a new policy with more coverage, but for less money.

Exact costs for the policy, prior remediation, and the training program are not disclosed, but I wouldn't necessarily expect those to be shared publicly anyway.

But this is all subjective -- I enjoyed it and found it a worthwhile listen while prepping dinner tonight. I'll be sure to check out Darknet Diaries (https://darknetdiaries.com/) as well, thanks for the recommendation!

It might be better to link to the actual episode, rather than just the transcript"

https://www.npr.org/sections/money/2019/01/04/682327333/epis...

Mavis should have been fired. That was a careless mistake against which someone in her position should be constantly vigilant. If we punished people for hacks that are the direct result of their incompetence then we wouldn’t have these “Gee we’re sorry about that” corporate responses. She opened an email attachment because the stranger who sent it said that she should. If you fall for that you should not be using the internet at all.

People get phished all the time. Its a general problem with how people are informed about these kinds of these things. Mavis is a victim of circumstance

The fast food industry covers hand washing in training videos why don’t more companies train people for basic street smarts online?

It would be like a chef who doesn't wash his hands firing a line cook for not washing his hands. A company giving their executive who stores social security numbers on the same system on which she opens emails (and trusts them implicitly without a second thought) a free pass is a way for them to give themselves a free pass. If she were to be held responsible for not understanding basic security protocols then the company could be held accountable for failing to train her properly. Until we raise our standards the companies who compromise our privacy and security will have no incentive to raise theirs.

Do you have a right to behave as if every link and file is safe and secure or should the people who are tasked with protecting personal information be expected to behave with reasonable suspicion of wrongdoing on the part of perfect strangers? HN wants to have it both ways, apparently.

I’ve never fallen for phishing are you implying this avoidance skill is impossible to teach to executives? Obviously anyone who has custody of important information should not be in the born yesterday category of understanding what to do with that responsibility.

You misunderstood my comment.

She compromised the social security numbers and other personal information of people who pay her company under the assumption that they will protect that information and you're telling me that SHE is the victim?

There is no reason to fire that employee. After such an event, they will likely be one of the most attentive employees in your company. Same way you don't fire an ops/dev employee after deleting a database. You look for solutions that will prevent it, like in the article, have training in place, run simulations, etc

Reply on news.ycombinator.com