The Insurance Industry is in the business of assuming and predicting risk, including cyber risk. Despite this, less than half of insurance CEOs claim that their organization is fully prepared for a cyber event. The sheer amount of personal data they hold, the increasing use of third-party vendors, and the growing security skills gap have made it increasingly challenging to secure their systems against targeted attacks. Insurance providers now face an average of 113 targeted breach attempts every single year – a third of which are successful.
An abundance of data
When purchasing insurance, consumers and businesses are required to surrender contact information, financial information, and even health information to the insurance provider, all in the initial query phase. Consumers are often advised to shop around to find the best insurance deal, meaning their personal data is often shared with multiple insurance companies.
The pressure to innovate systems and infrastructure only increases the amount of data that insurers need to hold. Modern-day consumers demand services all day every day via apps, customers want to streamline processes by filing claims digitally, and IoT-connected devices are employed by insurers to help measure consumers’ risk and detect fraudulent claims. All these systems continuously collect, hold, and use policy-holder data.
This abundance of data makes insurance companies a major target for malicious actors, as well as making the consequences of a breach severe. A 2020 survey of insurance industry security professionals found that the protection of massive amounts of PII was the top security consideration for insurance companies.
Internal and external threats
The use of third-party vendors within the insurance industry is on the rise, with 88% of insurers and claim leaders now using a third-party provider for at least one component of their digital transformation. This can make organizations highly vulnerable to cyber threats, with hackers able to use malware to access data through a third party’s systems. In March 2020, Chubb, one of the largest property and casualty insurers in the US, became the target of a cyber attack that involved unauthorized access to data held by a third-party provider. No official details were disclosed, but security researchers believe that the firm was hit by a ransomware attack that breached both customer and employee data from Chubb.
The cybersecurity skills gap within organizations is a huge threat to the insurance industry. The worldwide shortage of cyber professionals has left many businesses understaffed and undertrained in security essentials, increasing the likelihood of successful phishing and social engineering attacks on the organization. Health insurance provider Anthem suffered the biggest data breach in the history of healthcare when 78.8 million records were stolen in 2015. Hackers accessed this data through a spear-phishing campaign that manipulated employees into handing over data, eventually resulting in Anthem paying over $100 million in damages and legal settlements.
Inadvertent disclosure of sensitive information also poses a security threat. The First American Financial Corp. incident in 2019 saw 800 million personal and financial records exposed on the insurer’s website. This sort of negligence not only puts an insurance company’s clients at risk but can also damage the business’ reputation, deterring potential customers and destroying the trust that existing customers have in the insurer.
Reducing cyber risk for the insurance industry
For the insurance industry to avoid the severe financial and reputational damage that follows a data breach, organizations need real-time analysis and threat monitoring, with cybersecurity baked into business systems and infrastructure. To ease the threat detection process for security staff who are already stretched thin, security solutions must be easily manageable, frictionless, and designed to avoid any performance degradation. Insurance firms also need to consider the huge number of cybersecurity standards and frameworks they are required to comply with, including the GDPR, CCPA, HIPAA, and NYDFS.
Centripetal’s CleanINTERNET service creates a Zero Trust environment by applying advanced cyber threat intelligence. CleanINTERNET aggregates, correlates, and manages cyber threat intelligence from over 3,000 threat feeds and uses AI to identify potential new threats as they develop. By leveraging the expertise of the global threat intelligence community, CleanINTERNET alleviates the burden of cyber threats and reduces the amount of SIEM and firewall alerts that consume cybersecurity teams by up to 70%, allowing internal teams to focus on the unknown rather than the known. Centripetal’s Zero Trust inspection of threat traffic provides an elevated standard of cyber protection to businesses of all sizes, all while enabling compliance with the relevant security frameworks and saving millions that would be spent on multiple separate threat feeds.
