SoylentNews is people
SoylentNews
Picked via cryptogram, with the original here
...with reliance on all things digital skyrocketing, cyber threats now pose grave, even existential, dangers to corporations as well as the entire digital economy. In response, companies have begun to develop a cyber insurance market, offering corporations a mechanism to manage their exposure to these risks. Yet the prospects for this market now seem uncertain in light of a major court battle. Mondelez International is reportedly suing Zurich Insurance in Illinois state court for refusing to pay its $100 million claim for damages caused by the 2017 NotPetya attack.
Mondelez's claim represents just a fraction of the billions of dollars in collateral damage caused by NotPetya, a destructive, indiscriminate cyberattack of unprecedented scale, widely suspected to have been launched by Russia with the aim of hurting Ukraine and its business partners... According to reports, Zurich apparently rejected Mondelez's claim on the grounds that NotPetya was an act of war and, therefore, excluded from coverage under its policy agreement. If the question of whether and how war risk exemptions apply is left to the courts to decide on a case-by-case basis, this creates a profound source of uncertainty for policyholders about the coverage they obtain.
...
Many hurdles stand in the way of insurance providing a more robust solution. Data on cyber risks are scarce, and the threat is evolving constantly, often rendering data obsolete before they can be used. That means actuaries lack a credible repository of information to accurately price cyber risk. Moreover, NotPetya and other attacks with cascading effects have reinforced fears of aggregation risk, meaning the potential for a single incident to cause simultaneous losses across multiple policyholders. If Zurich had underwritten even a handful of the major corporations disrupted by the attack, it could have faced catastrophic losses from just one incident. This is a particularly acute concern for reinsurers—companies that provide stop-loss coverage, or protection against unsustainably costly claims, to other insurers—making both reinsurers and primary cyber insurance providers naturally hesitant to support more extensive cyber underwriting. The lack of adequate reinsurance backing means that carriers may become overwhelmed with claims if a systemic cyber incident causes simultaneous losses across many policyholders.
(Score: 1, Insightful) by Anonymous Coward on Monday February 18 2019, @09:44AM (3 children)
Whoever is offering insurance against data loss is a fool and worth bankruptcy.
It is so much easier to arrange for it than an arson or a suicide; plus it can be arranged let so little traces that the deniability is plausible.
Either the 'insured' has proper backups and security setup (and thus survive with at most a day worth of lost data - in which case why should it pay insurance premiums?) - or it is too risky to insure.
Look, none of the stock exchanges suffered because of NotPetya, so it is possible to do it.
(Score: 2) by Runaway1956 on Monday February 18 2019, @10:00AM (1 child)
You nailed it with "too risky to insure". My point is, if the insurance company wrote the policy, and accepted payment, then the insurance company needs to pay off. It's not OUR fault that some insurance company failed to assess the risks.
(Score: 5, Interesting) by canopic jug on Monday February 18 2019, @10:21AM
The answer is that they're not allowed to properly assess the risks when it comes to deployed software. Remember almost 20 years ago when this kind of insurance was just starting to rear its head? The premiums for M$ products were much higher than for the better designed software.
That's what looks like happened here with NotPetya [wired.com]. What we see is probably an extension of that, the M$ products are in practice "too risky to insure" but no one, and certainly no corporation, is allowed to say that directly. Thus they try to get out of paying a different way. The whine we hear in response is that no system is absolutely secure. Of course they aren't. However, there is a world of difference in levels of vulnerability and repercussions from eventual compromises. The result, all those years ago, was that insurers were forced not to price against M$ products and to find other ways to weasel out of paying.
Money is not free speech. Elections should not be auctions.
(Score: 3, Interesting) by janrinok on Monday February 18 2019, @10:16AM
You're probably correct, but it might only mean that nobody has found any evidence that the stock exchange or company software has been compromised. It doesn't prove that it hasn't happened though.