Recently, the Insurance Regulatory and Development Authority of India (IRDAI) has formed a working group committee to revisit its information and security guidelines amid the exponential increase in cyberattacks across the globe in the wake of covid-19.

In many ways, the insurance operators are perhaps one of the most exposed entities to cybercrime. You may ask, Why. This is due to the large amount of money and the data that they operate with, which inevitably attracts cyber-criminals like bees to honey. Further, insurance companies are now using digital channels to strengthen their relationship with customers and offer new products/services. Insurers are building ecosystems, storing large amounts of personal data about their clients. Mobile apps are becoming increasingly sophisticated. Insurers are also tracking data found on other smart devices of the customers such as smartwatches to evaluate risks better and to offer customized rates.

The insurance sector is under pressure to embrace innovation and modernize its systems. The use of technology is undoubtedly changing the insurance industry. However, this trend means that insurers will need to become even more vigilant about cybersecurity. While digital innovations provide competitive advantages to the insurers, they also introduce the risk of cyber-attacks.

Key Cyber Threats for Insurance Industry:

1. Social Engineeringe. psychological manipulation of people into performing actions or divulging confidential information
2. Data Breaches or Exfiltratione. any unauthorized movement of data
3. Phishing Emails designed to get victims to interact and establish a rapport
4. Identity Theft that allows the criminal to steal money from any credit card companies or lenders who extend credit based on the fake identity
5. Cybercrime as a Service (CaaS) including Malware/Ransomware as a Service

How Can Insurers Mitigate Cybersecurity Risks?

• Ensure secure access to data by means of zero trust policy including two-factor authentication (TFA). By integrating TFA with your applications, attackers are unable to access your accounts without possessing your physical device needed to complete the second factor.
• Prevent misuse of privileges by means of Privileged Access Management (PAM) and Privileged Identity Management (PIM). This will help to ensure that hackers are not able to exploit privileged accounts within your IT ecosystem.
• Increase cybersecurity awareness of your customers as well as employees. Training them about safe online computing, strong passwords, social engineering and more, will help your organization to create a first line of cyber defense and prevent unintentional breach of sensitive business data.
• Adopt a multi-layered defense strategy. Cybersecurity is not just about building a firewall around your database. It should go much further to protect you and your customers from all types of risks by considering every aspect of an attack.
• Monitor user activity by means of user activity monitoring (UAM) solutions that track end user behavior on devices, networks, and other company-owned IT resources. Such tools help to detect and stop insider threats, whether unintentional or with malicious intent.
• Use data encryption where sensitive information is encoded and can only be accessed or decrypted by a user with the correct encryption key.
• Develop an incident response plan to ensure that your organization is prepared to detect, respond to, and recover from a cyber incident. The objective is to recover as quickly as possible.
• Put in place a Business Email Compromise (BEC) shield. BEC is a growing threat to businesses in every type of sector. AI-enabled email security & fraud prevention tools can recognize and flag fraud attempts that would otherwise surpass common spam filters.
• Focus on network security i.e. taking preventative measures to protect the underlying networking infrastructure from unauthorized access, misuse, malfunction etc. A good network security system helps business reduce the risk of falling victim of data theft and sabotage. It also ensures that shared data is kept secure.

Wrapping up

Cyber-attacks on insurance companies can be devastating given the sensitive nature of data that insurance companies collect from their customers. Besides the financial costs and damage to brand’s reputation caused by cyber-attacks, insurers can also expect penalties from regulators if they fail to adhere to cybersecurity protocols. Thus, insurers need to proactively develop strategies to mitigate cyber risks. Insurance companies should not look at technology as an inhibitor due to the cyber risks associated with it. They should look at technology as an opportunity to create a secure digital ecosystem to cater to the needs of the modern customers.

Lastly, the insurers should not neglect cybersecurity considering it to be a costly or a complex affair. They must realize that the cost of negligence is always higher than the cost of measures taken to bolster cybersecurity!