Avoiding inside jobs on the cybersecurity entrance

As cyber threats proceed to evolve, insurance coverage corporations face an growing threat not simply from exterior attackers however from inside their very own ranks. Insider threats – whether or not from present or former workers, contractors, or others with entry to delicate info – pose a novel problem to cybersecurity efforts.

Insider threats are an usually missed however vital cyber threat for insurance coverage corporations, in response to Sean Plankey (pictured), international chief of cybersecurity software program at WTW. Whereas exterior cyber assaults incessantly make headlines, insider threats – stemming from people with entry to inside programs and knowledge – will be equally or extra damaging because of their privileged data of inside processes. These threats pose critical cybersecurity dangers to insurers, requiring efficient mitigation methods to attenuate potential hurt.

Plankey stated that insider threats contain cybersecurity dangers from people who’ve, or as soon as had, licensed entry to an organization’s programs, knowledge, or bodily premises. This group contains present or former workers, contractors, and different events with insider data.

Insider threats will be both intentional, pushed by monetary achieve, revenge, or ideological motives, or unintentional, the place negligence or social engineering compromises safety. Within the insurance coverage sector, delicate buyer info, proprietary algorithms, and monetary knowledge are in danger, with insider threats manifesting in varied methods, akin to unauthorized entry to databases or manipulation of monetary information.

A 2024 Verizon Information Breach Investigations Report discovered that 35% of knowledge breaches had been attributable to insiders, highlighting the prevalence of this problem throughout industries, together with insurance coverage.

Plankey famous that insurers are significantly weak as a result of huge quantities of private and monetary knowledge that workers and contractors deal with. The misuse or unauthorized disclosure of such info can result in identification theft, fraud, and vital monetary losses, each for the insurer and its clients.

There have been notable circumstances the place insider threats impacted insurance coverage corporations. For example, in 2018, a former worker at a significant insurance coverage agency was convicted of stealing confidential shopper knowledge, together with Social Safety numbers and different delicate info. The worker supposed to commit identification theft and tax fraud, inflicting reputational injury for the insurer.

In one other case, a claims adjuster altered claims information to inflate funds, resulting in substantial monetary losses earlier than the fraud was uncovered. These incidents illustrate how insider threats can exploit weaknesses in insurers’ programs.

To mitigate these dangers, Plankey emphasised the significance of proactive and multi-layered cybersecurity methods for insurance coverage corporations. Key measures embody implementing entry controls primarily based on the precept of least privilege, the place workers can solely entry info mandatory for his or her roles.

Common monitoring and auditing of system exercise can detect uncommon habits early, whereas worker cybersecurity coaching is essential in fostering consciousness of finest practices and the implications of insider threats.

Enhancing knowledge safety by encryption and knowledge loss prevention applied sciences, together with usually updating safety protocols, are additionally important steps in lowering the danger of insider threats. Insurance coverage corporations, Plankey suggested, should take these precautions to guard delicate info, safeguard monetary belongings, and preserve buyer belief.

Whereas insider assaults within the insurance coverage trade could also be underreported because of confidentiality issues, the potential for monetary and reputational injury underscores the necessity for sturdy cybersecurity measures.

By implementing complete safety controls and fostering a tradition of cybersecurity consciousness, insurers can higher defend towards insider threats and defend their belongings in an more and more digital world.

What are your ideas on this story? Please be happy to share your feedback beneath.