But that seems to be the preferred approach to cybersecurity at some companies...
We're not demanding perfect security. We do ask for good practices and evaluate risk from there. Security does not need to be expensive, but many places see it as second or third tier priority until shit hits the fan, and _that_ is where it gets prohibitively expensive. Penny wise, pound foolish.
You have some baseline required security for the premium that offers X coverage, and you can reduce the premium or increase the coverage if you can prove Y standards have been met. Get a list of approved 3rd party auditors/pentesting companies, have them certify what level your company is at, apply appropriate discount.
Insurance costs are a language that businesses speak fluently, so I think this has a higher chance of moving the needle on cybersecurity standards and have them actually be implemented across the board.
Not saying this is ideal (I’d love security to be a competitive advantage and properly required so startups start prioritizing it), but I’d say we need to focus security on the platforms and tech used by most startups so that their attack surface is their unique product.
However most of ransomware targets are well-established companies and already have an insurance, as the article stated. The insurance pays any lack of cybersecurity on behalf of them. Until it does not.
https://en.wikipedia.org/wiki/Carcinisation
Its a nice example of self-taxation. If one refuses to pay taxes for the police and state, one pays his gains to a guarded community, a armored car and insurance against criminal acts.
https://www.cnbc.com/2021/10/27/stock-buybacks-surge-to-like...
Meanwhile cybersecurity IT talent is underpaid, understaffed and hard to retain: https://leadcomm.com.br/wp-content/uploads/2020/03/State-of-...
Companies simply does not invest enough in a critical area. If the capitalism works, companies that constantly optimise short term profit vs. investing survivability should eventually go broke. If this does not happen then there is no incentive for companies to do the right thing and invest in the security in the first place.
It will be never 100% secure, but now we are like 50% secure when we should be 95% secure.
If it's hard to retain means that there is someone else paying better, it cannot be underpaid at the same time.
2) they can be changing jobs to one that is just unpaid, but they are treated more seriously
3) they could be changing from severely underpaid to just underpaid
I deal with ransomware a lot with clients, and while I absolutely sympathize with persons who are hit by an attack, I feel there are many different aspects to this where applying existing law/comparisons is more derailing than helpful.
1. Perfect is the enemy of good
I see far too many people who get so hung up on this [0] that they ignore practical and easily fixable problems as a result. Far too many companies get the idea they need to protect from nation-state actors when, as is mostly a given, it's infeasible to do so as any given nation-state is likely going to be able to throw more resources at a problem than a given company. Even North Korea (maybe with help from China) has a fairly successful* cyberwarfare division, and they really did almost get away with a major heist. [1]
2. The conclusion one should draw from the above isn't that it's hopeless and you shouldn't do any protection, but instead, you should scale your protection for the risk you carry. Nation States "likely" aren't interested in Bob and Alice's Autoshop in Shucksville, USA. But ransomware gangs that just scan casually for openings certainly are. The answer here is consider your value practically and check your risk assets; what's exposed online, what ways do outsiders have into your environment?
3. Avoid checklists and passive scanners
Passive scanners are a huge pain in the ass for my company as an MSP as we get clients that end up with a checklist they paid a non-trivial amount of money for and the recommendations would be funny if the payment for the recommendation wasn't so high. Passive scanning applications, even if we assume they have good intentions, have poor implementation and in fact reinforce the core problem; they allow IT administrators to just not think about the situation and instead fall back on the excuse of "I followed the list, there was nothing I could do", even when they had gaping holes in their infrastructure or extremely unsafe security practices.
I could continue on, but I need to address the inevitable comparison to other crimes that produced the term "victim blaming", and while indeed ransomware attacks share some similarities, I'd like to point out where I see some differences.
1. Victims of personal attacks only have the duty to themselves; the implication is that reasonably, a person should be able to exist without another infringing on their freedoms and rights.
2. Victims of ransomware at a business level are responsible for the data of others; even if it's their own company, that's employee data which likely is not theirs, employee money among their resources, and so on. There is an expectation I think here that they're responsible not just for their own security, but have accepted and suggest responsibility for the livelihood of others. That is, I expect that someone who undertakes responsibility for others has a duty to go beyond to protect that which belongs to others. To me, this means when you accept responsibility for someone else's livelihood, you don't have the right to decide to expose their livelihood to potential risk without their consent.
3. An attack is an attack, for sure, and regardless of the situation, the attacker is the one at fault. The issue for me is more about those who choose to put others properties at risk because of decisions the responsible person made, because as above, my expectation is that when it involves someone else, unless they have 100% transparency into decisions I make, I have a duty to make the most responsible decisions for a given situation. If a sysadmin/netadmin implements lazy security because it's convenient for them and gets attacked, yes, I hold the attacker accountable. But I also then hold the admins accountable for not being responsible with my property.
The responsibility for others is where I see that there's a significant difference, as it's no longer about personal liberty and freedom to exist online as much as it is about "did you take the reasonable steps to protect the data you are the protector of?" Me walking down the street, I should have an expectation I shouldn't be attacked, and I should have recourse if I am. If my data is exfiltrated by an attack that someone holding my data was a victim of, I have a right to know if that person was negligent while they were in charge of my data, and if they were found to be committing obvious flaws, despite that they were attacked, I have a right to know this and likely should have some recourse.
[0] - "it’s near impossible to guarantee perfect security" [1] - https://www.bbc.com/news/stories-57520169
Could you provide some more detail on this viewpoint? Because I find this quite infeasible and toxic.
While the most obvious security failures could be patched, it’s near impossible to guarantee perfect security for most reasonably sized companies. And for most non-tech or smaller businesses, it’s prohibitively expensive.
Would you rather theft insurance also be outlawed, since the fault is on the home owner who failed to secure their home well enough?