Insurers run from ransomware cover as losses mount

Re:Insurers run from ransomware cover as losses mount by warkdarrior on Saturday November 20, 2021 @11:17AM (#29289350)

Engineers design for resilience to physical failures, whose types are known and can be estimated, predicted, and modeled. Cybersecurity has to deal with human attackers, which cannot be modeled.

[ Parent | on HN ]

Re:Insurers run from ransomware cover as losses mount by syshum on Saturday November 20, 2021 @11:31AM (#29289482)

>>Cybersecurity has to deal with human attackers, which cannot be modeled.

It absolutely can, it is called Zero Trust, as has been a cyber security model for many many years now

The problem is most organizations have their entire business workflow around the Ring Fence model, and organizations is extremely prone to "we have always done it that way" when it comes to business processes so they expect IT to buy some software, or some widget to bolt on to the ring fence that will protect them

Businesses need to completely rework their internal methodologies, and processes which is something most companies refuse to do

[ Parent | on HN ]

Re:Insurers run from ransomware cover as losses mount by throw10920 on Saturday November 20, 2021 @12:18PM (#29289926)

Human behavior is absolutely modelable - usefully, even ("all models are wrong but some are useful") - and people in security do it all the time.

Moreover, engineers also design for resilience to human "attackers" in physical systems all the time.

If anything, cybersecurity is easier because you can leverage the work of tens of thousands of other people in your tooling. You wanna re-write ssh or fail2ban yourself?

[ Parent | on HN ]

Re:Insurers run from ransomware cover as losses mount by staticassertion on Saturday November 20, 2021 @11:37AM (#29289538)

We model human attackers all the time, it's probably one of the core components of the role.

[ Parent | on HN ]