Users, who are often not experienced in such matters, should, therefore, ensure that they understand what is included and not included in an insurance policy, while at the same time defining their own requirements clearly, Francis added. But Bob Walder, director of security at analyst company NSS Group, warns that organisations are right to fear outside audits of their systems. Rarely have we performed a security audit or penetration test without finding security holes or flaws. Deri Jones, security services manager at NTA Monitor, said that although the practice of auditing ecommerce systems wasn't as widespread as it should be, it was becoming increasingly common in big contracts. This is only being carried out for the megabucks contracts.
Insurance companies look to protect themselves and ecommerce is getting the most attention.
But the testing required by the insurers themselves is not always particularly thorough. But security firms are also starting to take an interest in this market and are partnering with insurance brokers as a result. MIS Corporate Defence, for example, has teamed up with insurer JS Wurzler to provide loss of revenue and virus attack insurance. The risk assessment is based on a security audit carried out by MIS, which is then submitted to Wurzler. Wurzler bases the premium on MIS's assessment of the integrity of a company's security infrastructure.