You're missing the potential benefit in improving overall security by getting the insurance industry involved in underwriting security risks. Insurance companies want to pay out benefits as infrequently as possible, and are therefore likely to drive better security practices to prevent security incidents from happening in the first place. You pay a much lower premium for fire insurance if you have sprinklers and effective fire protection built in to your facility. The hope is that the same sort of thing would happen for information security, and the insurance industry would become a driver for companies implementing better security practices.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/94/14162#14162