Re: cybersecurity insurance

[Ross Stapleton-Gray <Ross.Stapleton-Gray () UCOP EDU>]

At 12:09 PM 9/20/2002 -0400, Andrea Foster wrote:
> Do you know of any college that has obtained, or is considering
> obtaining cybersecurity insurance?
> Have insurance companies been marketing this type of insurance to
> colleges?

Andrea, I'm not aware of any, though it may be happening; biases against
universities obtaining such insurance would include perception (and
reality?) that we've less to lose, e.g., compared to a bank or brokerage,
and the prevalence of self-insurance strategies in other areas of
risk.  (I've given some thought to the idea, though, of internal insurance
markets, e.g., rules for how and when a loss might be covered by the
university at large, vs. falling on the head of the compromised
component... something to encourage meeting standards.)

Earlier this year, there was a workshop on economics and Internet security
held at UC Berkeley; "cyberinsurance" was one of the topics.  See Bill
Yurcik's presentation here:
http://www.sims.berkeley.edu/resources/affiliates/workshops/econsecurity/
He may be able to supply details on the current market for it, and who's
buying.

Ross


Ross Stapleton-Gray, Ph.D., CISSP
IT Security Officer
University of California Office of the President
510-587-6152
510-301-2858 cell

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/memdir/cg/.