[Economist] 网络安全的神话（完）

The myth of cyber-security

网络安全的神话

---

Fortunately, the small but growing market in cyber-security insurance offers a way to protect consumers while preserving the computing industry’s ability to innovate. A firm whose products do not work properly, or are repeatedly hacked, will find its premiums rising, prodding it to solve the problem. A firm that takes reasonable steps to make things safe, but which is compromised nevertheless, will have recourse to an insurance payout that will stop it from going bankrupt. It is here that some carve-outs from liability could perhaps be negotiated. Once again, there are precedents: when excessive claims against American light-aircraft firms threatened to bankrupt the industry in the 1980s, the government changed the law, limiting their liability for old products.

幸运的是，现在微小但处于增长阶段的网络安全保险市场提供了一条在保留计算机产业创新性的同时保护消费者的途径。一家企业的产品在使用中出现问题或者经常被黑客入侵，将会使得其保险费增加，最后刺激企业去解决问题。一家企业采取了合理的措施来保证产品安全，但仍然被入侵，就可以依靠保险费的赔付来确保自身不会走向破产。正是在这个方面责任的分担可以被重新设定。同样，这种方式也有先例：当在 1980 年代美国大量的轻型飞机公司由于过量的诉请而威胁要求破产时，政府调整了法律，缩小了对于老旧产品的责任承担。

One reason computer security is so bad today is that few people were taking it seriously yesterday. When the internet was new, that was forgivable. Now that the consequences are known, and the risks posed by bugs and hacking are large and growing, there is no excuse for repeating the mistake. But changing attitudes and behaviour will require economic tools, not just technical ones.

现今计算机安全问题如此突出的一个原因是往日我们并没有认真去对待。当互联网还是新生事物时，这是可原谅的，如今这种危害已经众所周知，由于产品缺陷以及入侵带来的额问题如此严峻并不断增长，我们没有理由可以重复这种错误。但改变立场态度和措施需要的不仅仅是技术措施，更有经济手段。