Cyber security insurance has liability caps, relatively low for the premiums. Standard boilerplate demands to hold such insurance in the US is around $1M liability coverage for small shops, usually gets quoted around $50K annual premiums. If you can even get underwritten at all. I have been able to negotiate those clauses away so far.

Everyone is already trying to pass the buck (quite literally) on information security risk via insurance, and the insurance industry is pushing back. One possibility that might develop out of the standoff is customers pushing the liability onto Cloud vendors and washing their hands of the concern.

What no one outside of information security wants to admit much less promulgate is development and IT teams must grow larger, or security continues as an expensive as hell fat tail risk. The cheap hedge is hiring additional staff; businesses have grown so accustomed to living outside the fat tail that the accumulated technical debt presents the illusion that status quo is normal. The new normal is ever-more expensive attacks.

I wish POSIX would offer a standard way to elide certain parts of a the command string that shows up in a process list. There are piles of legacy programs that won’t get retrofitted to use a file to read a password anytime soon. There are sins aplenty in our fields when it comes to security.

>>> One possibility that might develop out of the standoff is customers pushing the liability onto Cloud vendors and washing their hands of the concern.

That would be good, the cloud is a lot more secure than everything self hosted or self developed.

It’s team- and manager-dependent. I’ve seen good and bad security in cloud and on-prem. The key is management recognizes and budgets for the fat tail risk, just like the fat tail risk of financial fraud is treated by the finance teams. Much of the response is proforma, and only intended to secure from drive-by opportunistic raids, and insider attacks are still difficult to defend against, for example, so no silver bullets in this story.

Is that always true?

If you're doing heavy R&D and you keep things on isolated networks, might not your R&D be at least similarly secure on-premises, if you follow secure practices?

How much visibility do you have into your cloud provider's security? For email, sure go with a known cloud provider. Some SaaS services on the back-end can be less than ideally secure.

Security is easier in the cloud. It comes with good access management, audit trails, inventory of active resources and it enforces a lot of good practices.

All companies who don't have cloud tools have to re invent everything, it's hard and a lot of effort so the result is always terrible. Poor UI, poor security, full of bugs, pick any three.

AWS is better for isolated networks, it can manage strict network access rules way beyond anything iptables can achieve. In fact, cloud is the only way to have well isolated networks, unless we're talking about a computer unplugged from any network.

There are many stories of AWS users setting their access rules improperly because they weren't given sufficient time or resources to understand how to use them, in some cases leaving S3 containers for example wide open. It isn't just the technology, it's the incentives, people and processes as well.