Culprit or victim?

[stevel]

Good news for security professionals and insurance companies but what a kick in the nuts to small business.

In my experience small businesses lack even the most basic fundamental security measures. These companies will need to define policies and procedures along with performing regularly scheduled audits which means they have to hire or contract a security consultant. The insurance companies will be hiring security professionals to audit businesses before providing "cyber insurance" and suddenly a whole lot of money is directed towards eradicating a minimal risk.

However the cost of an incident is high enough that the premiums will be to steep for many small businesses. This is going to put them in a sticky situation. How many small businesses will be able to afford consultants and insurance? *Catch22* How many of them can afford to go without? One incident could bankrupt the company.

An great paper on cyber insurance. http://citebm.business.uiuc.edu/TWC%...0Insurance.pdf