Comment by PakG1 | Hacker News Reader

Comment by PakG1 | Hacker News Reader

I can't fathom insurance companies seriously and sincerely wanting to offer insurance policies for infosec. I know they do. But it doesn't make sense to me.

1. The attack surface for any organization is so hard to defend that insurance companies would probably have to pay out a lot more than for other types of insurance policies.

2. In an age that is increasingly tech and data-driven, the value of data becomes larger and larger. Hence, the payout starts to get really expensive. I find it difficult to imagine what kind of insurance premiums could be charged to customers that are both affordable to the customer and also properly covers the risk the insurer is taking on.

3. Insurance companies are going to have to become infosec experts in order to properly assess the risk of their clients. Are they up for that? There's such a shortage of infosec workers already, or am I being fed a load of crap by HN? Where would they find capable infosec experts to do these assessments before quoting the client for an insurance policy? War for talent isn't easy.

I think this would all end up making insurance policies extremely expensive and unprofitable for the insurance firms. Yes, I hope that this makes organizations more serious about infosec, but I honestly don't see that happening so long as the average joe is not outraged whenever a service they use gets breached.

None of these details really matter for an insurance company. As long as they can accurately keep their total premiums above their total payouts, they'll make a profit.

1. Paying out more is not a problem as long as the premiums are covering it.

2. As payouts start to get expensive, insurers can either raise premiums, or, should the market not tolerate that, they can restrict policy coverage instead.

3. Properly assessing the risk of their _individual_ clients (as opposed to their entire portfolio) will allow them to offer more competitive policies against other insurers. They only need to be as good at that as their competitors, no more.

Three can be addressed by requiring security audits. Historically the Big 4 have done them for SOX compliance or other reasons, but its becoming much more routine for internal purposes. There is no reason it couldn't expand to external users (insurance companies). Many accounting firms are already doing them for hospital boards, etc.

Just like financial audits (or lack thereof) determine your loan rates in a SMB business, a security audit will do likewise.

The mistake you're making is in assuming insurance companies care about the overall risk. They don't. They only care about the risk they're insuring. Insurers very carefully word their policies to limit what they cover - anything outside of that and you won't get a dime. If a company has some holes in its security that's fine, so long as they're also outside of the policy coverage and the insurance company is capable to proving that.

I've never read any of these policies but I'd hazard a guess they all contain blanket statements like "providing reasonable security measures have been taken" without stating what is actually "reasonable". That pushes all the responsibility to the policy holder.

The question of what's covered and what "reasonable" security looks like is the problem for this industry.

If those definition's aren't clear, it'll mean that every major claim becomes a lawsuit, that's not going to help anyone apart from law firms.

Also if a lot of major claims are denied, companies will stop taking out these policies on the grounds that they're worthless.

FWIW my feeling is that Information security of a company is too complex and poorly understood to accurately model risk enough for decent insurance policy to be put in place.

From experience we over-estimate the actuarial competence of insurance companies. In most cases they will trial a new product with premium calculated from incredibly basic stats, see how it goes and then up/reduce the premium as they have more in house data on claims.

Generally these insurance policies have requirements or cluases for things like training staff on good security practices, documenting that this training happened. Helps to lower exposure to lawsuit (ie we weren't negligent). I know of one insurer that requires companies to place a hardware device that blackholes dns in front of the customers network. Things like this really help to lower exposure to attackers. I'm surprised black hole dns isn't more common.

> to properly assess the risk of their clients

I've sat through a lot of these insurance company cyber risks assessments. It's absurd. You get asked a question like "did you pay for a firewall?". Then you say yes. Then you get asked to prove it by showing them an invoice. Repeat the question for antivirus. Throw in password expiry question and boom, you're low risk.

Insurance also creates a moral hazard regarding proper cybersecurity. A risk/reward analysis may arrive to the conclusion that upgrading infrastructure and hiring/training staff will be more expensive than simply paying more for insurance.

That doesn't seem to make sense from the insurer's point of view. If your infrastructure is in a state so bad, then the risk is much higher and they would charge more. There would have to be either some kind of review before signing the paperwork, or the rules would exclude negligence in basic ops.

Similar to how house insurance will ask if all entries have locks and the structure is sound/secure. If they prove it was left open - you're not getting your payout.

I think the insurance company would not accept any claim under these circumstances, for the same reason they do not cover burglary when your house is not properly secured.

Reply on news.ycombinator.com