Data breaches and cyber-attacks in the insurance industry are growing at an alarming rate as hackers grasp the value of data collected by insurance companies, yet many insurance organisations do not understand the risk they are exposed to. When you consider the information collected by insurance companies, the level of sensitivity and the value it can bring if sold – it is extortionate – yet, this information is often sat insufficiently protected. Insurance companies need to start asking the right questions in regards to its information and its security and instigate a risk based approach to accurately assess the imminent threats to the company and the industry.

The biggest problem presently facing insurance companies is slow incident detection. More often than not, cyber-attacks sit undetected for weeks at a time making them much harder to solve. An organisation’s ability to respond to an attack on critical systems, such as a network, database or appliance, holds considerably greater importance today more than ever. A quick and efficient response will determine the source, extent and cause leading to minimisation of potential damage. Software solutions such as IBM’s QRadar Provides near real-time visibility for threat detection and prioritisation, delivering surveillance throughout the entire IT infrastructure and can help decrease the risk of a cyber incident but alone cannot protect an organisation from the cybersecurity risks.

Although implementing sophisticated systems can help decrease your external threats, insurance companies often forget about the internal threats, especially human error. Mitigating a cybersecurity risk is not all about the systems you have in place but also the awareness your employees have of what constitutes a cybersecurity risk and how it should be handled. Insurance companies are risking their business, reputation and customer base on a daily basis by not fully training staff to distinguish an incident. Simply training your staff into cybersecurity and incident response can lower the risk of human error and unauthorised access and assist in quick detection to allow for the incident to be isolated and resolved.

But how do insurance companies make the decision to invest in incident response, SIEM and other technologies?

Every business must adapt to changing market conditions, future technological change and inevitably changing threat landscapes. What this means is that insurance companies must make intelligent, business decisions based on risk. Insurers need to implement processes to drive the adoption of leading practices and enterprise-wide acceptance of cyber risk culture. By conducting detailed risk assessments (within all service lines and departments),  mitigation needs should be considered as part of a new cybersecurity incident response strategy. The risk appetite versus the risk tolerance needs to be calculated and then a correct action can be taken. Embracing a risk based approach allows for the insurance companies to be proactive rather than reactive, allowing for a quicker and smoother response and alerts them to risks that may have never been considered.

With the value of data rising quickly and the skills of hackers increasing by the day, now is the time to begin facing these risks. Without accurately analysing and addressing cyber risks, organisations leave themselves and their customers exposed. Insurance companies hold some of the most sensitive information about individuals and mitigations that match the risk of losing this data are essential. Awareness of these risks is one thing, but accurately addressing them is the main step.

At Smarttech247, we understand the commercial priorities and imperatives of our clients and their customers, and the challenges insurance organisations face from evolving threats and regulations. If you want to find out more, contact our security experts today.