| ▲ | betaby a day ago |
| > but a lot of seemingly dumb security policies are due to insurers. I keep hearing that often on HN, however I've personally never seen seen such demands from insurers.
I would greatly appreciate if one share such insurance policy.
Insurance policies are not trade secrets and OK to be public. I can google plenty of commercial cars insurance policies for example. |
|
| ▲ | simonw a day ago | parent | next [-] |
| I found an example! https://retail.direct.zurich.ch/resources/definition/product... Questionnaire Zurich Cyber Insurance Question 4.2: "Do you have a technically enforced password policy that ensures use of strong passwords and that passwords are changed at least quarterly?" Since this is an insurance questionnaire, presumably your answers to that question affect the rates you get charged? (Found that with the help of o4-mini https://chatgpt.com/share/680bc054-77d8-8006-88a1-a6928ab99a...) |
| |
| ▲ | smithkl42 17 hours ago | parent | next [-] | | We've been asked that question before on security questionnaires, and our answer has always been, "Forcing users to change passwords regularly is widely regarded as a very bad security practice, and we don't engage in bad security practices." We've never had anyone complain. | | |
| ▲ | austhrow743 7 hours ago | parent [-] | | I've never had a complaint about anything I put in to a form requesting a quote for insurance. I just get the quote back. Did you write that in the comment expecting an insurance salesperson to call you up and argue passwords with you? Call their back office and say "hey this guy says our password question is crap, get our best guys on it!"? I just cant imagine any outcome other than it was translated to just a "no" and increased your premium over what it would have otherwise been. |
| |
| ▲ | betaby a day ago | parent | prev | next [-] | | Password policy is something rather common, and 'standard' firewalls.
Question is in the context of of WAF as in the article. WAF requirement is something more invasive to say the least. | |
| ▲ | kiitos a day ago | parent | prev [-] | | Directly following is question 4.3: "Are users always prevented from installing programs on end-user devices?" Totally bonkers stuff. | | |
| ▲ | 9x39 a day ago | parent | next [-] | | A trend for corporate workstations is moving closer to a phone with a locked-down app store, with all programs from a company software repo. Eliminating everything but a business's industry specific apps, MS Office, and some well-known productivity tools slashes support calls (no customization!) and frustrates cyberattacks to some degree when you can't deploy custom executables. | | |
| ▲ | bigfatkitten 20 hours ago | parent | next [-] | | That's why this it's been a requirement for Australian government agencies for about 15 years. In around 2011, the Defence Signals Directorate (now the Australian Signals Directorate) went through and did an analysis of all of the intrusions they had assisted with over the previous few years. It turned out that app whitelisting, patching OS vulns, patching client applications (Office, Adobe Reader, browsers), and some basis permission management would have prevented something like 90% of them. The "Top 4" was later expanded to the Essential Eight which includes additional elements such as backups, MFA, disabling Office macros and using hardened application configs. https://www.cyber.gov.au/resources-business-and-government/e... | |
| ▲ | michaelt 20 hours ago | parent | prev | next [-] | | Then the users start using cloud webapps to do everything. I can't install a PDF-to-excel converter, so I'll use this online service to do it. At first glance that might seem a poor move for corporate information security. But crucially, the security of cloud webapps is not the windows sysadmins' problem - buck successfully passed. | |
| ▲ | serial_dev a day ago | parent | prev [-] | | I don’t think locking down slashes support calls because you will now receive support requests anytime someone wants to install something and actually have a good business reason to do so. | | |
| ▲ | 9x39 a day ago | parent [-] | | Consider the ones you don't get: ones where PCs have to be wiped from customization gone wrong, politics and productivity police calls - "Why is Bob gaming?", "Why is Alice on Discord?". It's about the transition from artisanal hand-configuration to mass-produced fleet standards, and diverting exceptional behavior and customizations somewhere else. | | |
| ▲ | bornfreddy a day ago | parent | next [-] | | Coupled with protection against executing unknown executables this also actually helps with security. It's not like (most) users know which exe is potentially a trojan. | |
| ▲ | Aeolun 18 hours ago | parent | prev [-] | | If you don’t want exceptional behavior, that’s exactly what you’ll get. In more than one way. Alice is on Discord because half of the products the company uses now give more or less direct access to their devs through Discord |
|
|
| |
| ▲ | pjmlp a day ago | parent | prev [-] | | This is standard practice for years in big corporations. You install software via ticket requests to IT, and devs might have admin rights, but not root, and only temporary. This is nothing new though, back in the timesharing days, where we would connect to the development server, we only got as much rights as required for the ongoing development workflows. Hence why PCs felt so liberating. | | |
| ▲ | betaby a day ago | parent [-] | | It's a standard practice. And at $CURENT_JOB it's driven by semi-literate security folks, definitely not insurance. | | |
| ▲ | pjmlp a day ago | parent [-] | | Insurance and liability concerns drive the security folks. Just wait when more countries keep adopting cybersecurity laws for companies liabilities when software doesn't behave, like in any other engineering industry. | | |
| ▲ | stefan_ 19 hours ago | parent [-] | | Hello, the security folks in those companies made those up. "cyber insurance" is hogwash. That entire branch has been taken over by useless middle manager types who know to type up checklists in Word but have no understanding of anything. | | |
| ▲ | pjmlp 12 hours ago | parent | next [-] | | As someone that happens to also be one of those clueless people when assuming DevOps roles in consulting projects, it is a very bad day when some clever user is responsible for a security breach. A breach can turn out into enough money being lost, in credibility, canceled orders, or lawsuits, big enough to close shop, or having to fire those that thought security rules were dumb. Also anyone with security officer title, in many countries has legal responsibilities when something goes wrong, so when they sign off software deliverables that go wrong, is their signature on the approval. | |
| ▲ | blangk 18 hours ago | parent | prev [-] | | Are you arguing non technical people should have root access to company owned and managed PCs? Because I can tell you from experience, that will result in a very bad time at some point. Even if it is just for the single end user and not the wider org. |
|
|
|
|
|
|
|
| ▲ | bigbuppo 19 hours ago | parent | prev | next [-] |
| The fun part is that they don't demand anything, they just send you a worksheet that you fill out and presumably it impacts your rates. You just assume that whatever they ask about is what they want. Some of what they suggest is reasonable, like having backups that aren't stored on storage directly coupled to your main environment. The worst part about cyber insurance, though, is that as soon as you declare an incident, your computers and cloud accounts now belong to the insurance company until they have their chosen people rummage through everything. Your restoration process is now going to run on their schedule. In other words, the reason the recovery from a crypto-locker attack takes three weeks is because of cyber insurance. And to be fair, they should only have to pay out once for a single incident, so their designated experts get to be careful and meticulous. |
|
| ▲ | tmpz22 a day ago | parent | prev | next [-] |
| This is such an important comment. Fear of a prospective expectation, compliance, requirement, etc., even when that requirement does not actually exist is so prevalent in the personality types of software developers. |
| |
| ▲ | 9x39 a day ago | parent [-] | | It cuts both ways. I've struggled to get things like backups or multifactor authentication approved without being able to point to some force like regulation or insurance providers that can dislodge executives' inertia. My mental model at this point says that if there's a cost to some important improvement, the politics and incentives today are such that a typical executive will only do the bare minimum required by law or some equivalent force, and not a dollar more. |
|
|
| ▲ | manwe150 a day ago | parent | prev [-] |
| You can buy insurance for just about anything, not just cars. Companies frequently buy insurance against various low-probability incidents such as loss of use, fraud, lawsuit, etc. |
