Hacker News Reader

Comment by dsacco | Hacker News Reader

Is that a requirement your security auditor has, or are vendors demanding this in vendor-specific security reviews? And is this for e.g. network segmentation in PCI, or more routine assessments?

Depending on what you mean, perhaps you want to get in touch if you'd like better technical due diligence :)

View on HN

I have filled out a few applications for tech e&o and cyber liability insurance over the past week and they all had a question about antivirus on the servers, workstations, and phones. I answered truthfully (no) and wonder if that is going to hurt me.

It will be interesting what an insurance company thinks is needed.

If having an antivirus can create possibly more security holes than it closes - then from an insurance perspective they would not want you to have it.

i.e. if they have to pay based upon an attack - they want to ensure the lowest risk.

The thing is that in most companies you're far more likely to fall victim to a simple and random malware emailed or ran by your employees, than you are to be carefully targeted by a worm based on AV vulnerabilities.

With that said I prefer to view security as, "You likely will be the victim of a planned attack, so plan from there", but still. Odds are not favourable.

If people understood those that were building the Cyber liability policies within the big firms, they'd realize few have a clue. Having worked with the big 5 for years now on this, many are so far behind on reality it hurts.

Reply on news.ycombinator.com