Re:Insurers run from ransomware cover as losses mount
by dredmorbius on Tuesday November 23, 2021 @07:10AM
(#29316895)
"Small fuckups" in home construction which have no material consequence are acceptable.
"Small fuckups" which result in catastrophic failure, property damage, injury, or death, are not.
For the latter, you'll find all manner of standards, codes, practices, maintenance, and inspections.
What we're discussing with regards to infosec aren't "small fuckups", they're repeat major catastrophies, bearing little or no risk to the firms and organisations perpetrating them.
A large component of the risk resides simply in collecting and retaining data, as well as exchanging it with other organisations. That turns out to be a very high-risk activity, though the risks are externalised. The point is to internalise those costs, and to sharply reduce the incentives for the practices which present those risks. This includes incentivising the IT products and services sector toward architectures which can be more adequately protected.
"Small fuckups" which result in catastrophic failure, property damage, injury, or death, are not.
For the latter, you'll find all manner of standards, codes, practices, maintenance, and inspections.
What we're discussing with regards to infosec aren't "small fuckups", they're repeat major catastrophies, bearing little or no risk to the firms and organisations perpetrating them.
A large component of the risk resides simply in collecting and retaining data, as well as exchanging it with other organisations. That turns out to be a very high-risk activity, though the risks are externalised. The point is to internalise those costs, and to sharply reduce the incentives for the practices which present those risks. This includes incentivising the IT products and services sector toward architectures which can be more adequately protected.