Counterpane to Offer Hacker Insurance

Counterpane Internet Security plans today to put money behind its claims that it can protect companies from Internet intruders.

The company will offer hacker insurance policies of up to $10 million through Lloyds of London.

The policies will offer payment for lost services and also provide warranty coverage to allow application service providers and Web hosting companies to offer protection to their customers.

Counterpane will offer the insurance to customers of its consulting service. As part of that service, Counterpane checks for intrusions by monitoring the logs of firewalls, routers and other devices on the network, checking for telltale warnings of security problems. Counterpane collects the logs by installing a Linux server on the customer's network and using that server as a monitoring point. The logs are monitored by Counterpane staff. Counterpane also recomends preventive measures to guard against intrusion.

The insurance is part of Counterpane's business model of helping companies manage risks rather than avoid threats, said Bruce Schneier, founder and CTO of the company.

"Computer security is always sold as threat avoidance," Schneier said. "Firewalls avoid the threat of someone breaking into your network. Encryption avoids the threat of someone reading your messages. But the real model that works, the one that we use, is risk management. You're a business, you like risk; risk is in your blood. If you can manage risk better than anyone else you make more money."

The insurance will be priced at starting at $20,000 per year for $1 million coverage, and $75,000 per year for $10 million coverage.

Counterpane is not the first company to offer hacker insurance. For instance, Marsh & McLellan offers insurance in conjunction with Internet Security Systems Inc. The difference is that the Marsh & McLellan plan requires companies to submit to regular, outside insurance audits, which is burdensome and is itself a security risk, said John Pescatore, an analyst with GartnerGroup.

Regular security audits result in a list of the company's security holes that can be exploited if the list falls into the wrong hands. Moreover, those lists are generated at intervals and the problems must be corrected all at once, while Counterpane offers continuous monitoring and problems can be solved as they come up, Pescatore said.

But the Counterpane service is more expensive, priced at about $12,000 per month, compared with $5,000 per month for other security firms, Pescatore said.

Pescatore said that, moving forward, he expects hacker insurance to be available from Web hosting companies and application service providers.