Connect with us

Interviews

Finance Derivative Interview with James Burton senior director of product management at LexisNexis Risk Solution, Insurance, U.K. and Ireland

Published

on

  • What led you to move from the financial services sector to insurance?

I worked as a market analyst and global derivatives trader for three years then moved into banking for close to five years before a brief stint at a data and technology company. The switch to insurance came about for several reasons.

Firstly, the banking sector is relatively mature in its use of data and I could see how transformative data and technology could be for the insurance sector – I wanted to play a part in that.

Secondly, LexisNexis Risk Solutions was still a relatively new brand in the UK insurance market when I joined, although the business had a 40 year plus history in the U.S. The position of head of data analytics was a fantastic chance to work for a business with a clear vision to deliver innovative data and technology solutions to help insurance providers better understand risk.

Thirdly, I could see the massive potential of contributory data solutions in insurance so that the whole market has an opportunity to benefit. Obviously the more contributors you have on board, the more powerful the database becomes. Close to 100% of the motor insurance market is now contributing to our Motor Policy History Database and benefiting from digitised No Claims Discount proof.  We intend to repeat this success with our claims database for home, motor and commercial.

 

  • Are there parallels to be drawn between customer verification processes in banking and those now being used in Insurance?

James Burton

Yes, while insurance providers aren’t subject to all the same Anti Money Laundering and Know Your Customer regulations as lenders, the sector is experiencing high levels of fraud and this has driven innovations in data solutions to validate the applicant, customer or claimant is who they say they are, at speed, at each part of the customer journey.  Solutions such as email address-based fraud risk scores and our unique customer identifier stem from identity solutions that have been used with success in the banking sector.

 

  • How much have the new pricing rules in insurance changed the way insurance providers use data enrichment services?

Insurance providers must now ensure the consumer’s risk is assessed as accurately as possible and in-turn priced fairly, using the same processes and data the insurance provider would use at new business.  As a consequence we are now seeing an increased demand for data enrichment at renewal.  Crucially, insurance providers can now use one point of access to data enrichment rather than calling out to multiple data sources, to allow risk assessment at individual, asset, household and postcode level with intelligence delivered on all individuals associated with the quote in a single transaction.

 

  • What do you believe have been the most exciting innovations in the insurance market in the past year?

The insurance market is constantly innovating in response to the changing needs of customers. The emergence of short-term insurance solutions is a good example and an area we are watching closely.

Clearly the more accurate and actionable data at your fingertips the better you can price a quote – whether for a day’s cover or a year – help customers mitigate risk or settle a claim.

The availability of Advanced Driver Assistance Systems data at quote has also been a big change for the motor insurance market.  Having this data at a Vehicle Identification Number level gives insurance providers a much clearer indication of the risks associated with a specific vehicle.  The availability of this data at the VIN level is a true industry first and one that only grows in importance and value as more cars come fitted with ADAS as standard.

 

  • Fraud is being highlighted as a rising challenge for all parts of the financial services market – how do you think this will play out in insurance specifically and what are the possible solutions?

The pressure on household finances this year has been well documented and insurance providers are all too keenly aware of the environment this can create for fraud at application and claim. Aviva confirmed recently that it had identified fraud on more than 20,000 motor policy applications. Of these, ghost broking accounted for 15% of all the application fraud detected[i]. One of the tactics used by ghost brokers is to buy a cheap policy using fake details with the victim buying the policy listed as a ‘named driver’.

This scheme underlines the importance of validating the identity of named drivers to the same level as main proposers, exploiting the latest advances in swift, front-end fraud detection to flag any links to past fraud and highlight if the information provided for a quote may have been manipulated for a cheaper premium.

At claim, soon insurance providers will have access to a whole raft of data enrichment solutions to better understand risk, including highly granular claim history data gathered from across the market.  This is set to provide a real step-change in understanding the risk of fraud at first notification of loss (FNOL).

 

  • Affordability of insurance is going to be a key concern for the insurance market given the cost-of-living crisis – how can data help insurance providers in this regard?

The insurance sector will be looking at how it can offer greater flexibility and convenience to customers where payment options are concerned, particularly in the case of mandatory insurance. By bringing in insight on premium affordability based on credit data, as part of the quote process, insurance providers can help ensure customers get the correct insurance protection with the option to pay the premium in a way they can afford.

Ultimately, doing the right thing for customers comes down to ensuring you understand their needs as fully as possible at the point of quote and claim.  In this way you can turn what is essentially a mandatory purpose into something individuals really value.  Supporting insurance providers in this regard through data and technology is what we do all day every day.

 

[i] https://www.aviva.com/newsroom/news-releases/2022/05/insurance-claims-fraud-up-by-13percent-in-2021/

Interviews

How MFA can protect the financial sector from the unprotectable

Published

on

By

The financial sector has long been a primary target for threat actors. However, the unique infrastructure of core financial systems means these critical resources often fall outside the scope of standard security solutions.

Multifactor authentication (MFA) is one such solution. We ask Yiftach Keshet, Director of Product Marketing at Silverfort, what are the limitations of traditional MFA to the finance industry, and what can be done to start protecting these unprotectable core systems.

 

Q: What are the security challenges with traditional MFA?

Multifactor authentication (MFA) has become something of a default secondary line of defence against credential theft. Requiring users to input two or more verification factors in addition to their username/password combination makes it much more difficult for threat actors to simply access the network with credentials stolen through phishing or a previous breach.

However, the system is far from perfect and presents several challenges. One issue is that MFA is rarely fully supported by legacy banking infrastructure or command-line access to servers and workstations.

Kerberos and NTLM, two of the most common authentication protocols in on-premises environments, don’t support MFA. As such, an attacker that has infiltrated the network and managed to obtain user credantials will be able to access critical servers without going through the MFA process.

Yiftach Keshet

Alongside this, traditional MFA is usually deployed at the resource level. In a high-scale environment it practically means that full coverage of all resources with agents or proxies will never take place. Additionally,  as businesses continue to grow their digital footprints, the resources required to deploy, configure and maintain MFA quickly increases. This can quickly become unmanageable, particularly in the financial sector where digital transformation has been a leading priority for the last few years.

As a result of these issues, core banking resources are often excluded from MFA protection. This greatly increases the organisation’s risk exposure, as threat actors that make it inside the network may potentially gain full access to critical systems with few effective checks or barriers.

Financial organisations need to change their approach to MFA if they are to close this critical gap in their defences.

 

Q: How can these challenges be overcome?  

The shortcomings of traditional MFA can be overcome with a new model known as Unified Threat Protection. Rather than being applied individually at a resource level, this is an agentless, proxyless approach that natively integrates with the organisation’s Active Directory and Identity and Access Management (IAM) solutions. This means it can be uniformly applied to continuously monitor, analyse and enforce MFA policies across the entire environment.

Because all authentication requests are handled through the organisation’s IAM solution, directly integrating MFA at this point solves the coverage problem. Not only is it far easier to scale MFA as the organisation’s IT footprint expands, but an MFA layer can now also be applied to core banking infrastructure that was previously unprotected.

 

Q: What are the use cases for using MFA to improve safety practices for banking?

There are multiple financial use cases that stand to benefit from the Unified Threat Protection approach to MFA.

The first and foremost of these, is the access to the banking applications that don’t natively support MFA today. This new approach enables them for the first time to obtain the same level of secure access that modern SaaS applications have.

Remote access tools, for example, have become extremely important in the new world of remote and hybrid workforces. However, because standard MFA typically needs to be deployed individually to each endpoint, it is common to find many machines in the environment are not protected, creating a critical attack path for threat actors. The new agentless MFA model can be directly integrated with Active Directory, ensuring that all machines are equally protected, regardless of location.

In another example, admins at financial institutions typically use command-line tools such as PsExec, Remote PowerShell, and WMI for configuring, managing and troubleshooting machines in their environments. However, these same toolsets are exploited by threat actors to spread ransomware and achieve lateral movement. If the authentication protocol of command-line tools is not protected by MFA, attackers can use these tools to access and manipulate the system.

Again, the agentless and proxyless nature of the Unified Threat Protection model closes this gap as all core systems will require MFA, significantly slowing or even completely stopping any threat actor within the network.

 

 

Q: How a bank can bolster their cyber resiliency against ransomware with MFA?

Ransomware has begun to dominate the threat landscape in recent years. Financial organisations have a lot to lose, because a ransomware outbreak rampaging through their core systems could cripple the enterprise and cost millions in lost business and recovery efforts – even before factoring in legal and regulatory impact if customer data is compromised. File shares are a common method for accessing systems and propagating ransomware to increase its impact.

Traditional MFA has proven to be ineffective against the threat of ransomware, as it cannot be applied to file shares managed by a CIFS (Common Internet File System) authentication protocol. However, a Unified Identity Protection MFA can cover this gap as it can apply coverage through Active Directory, regardless of which protocols are being used.

Continue Reading

Interviews

How to cut the cybersecurity risk of M&A

Published

on

By

By Chad McDonald, CISO at Radiant Logic

 

In 2021, merger & acquisition (M&A) activity grew by almost a quarter, with a record-breaking 62,000 deals announced globally. Merging companies is a difficult and complex task, with figures showing that between 70% and 90% of all mergers fail.

When an organisation undergoes a M&A, they not only face economic risk. The external cybersecurity threat level ramps up dramatically, as well as the risk posed by insiders.

Many of the challenges experienced during M&A can be linked to the failure to manage identity. To understand the threat, Radiant Logic surveyed 300 tech executives and found that out of the 27% of respondents who experienced a merger & acquisition in the last year, 44% said it took between 7 and 12 months to enable application access across the integrating entities, and 35% took 13 and 18 months.

So, what can be done to secure identities during M&As?

Chad McDonald

What are the security risks organisations are exposed to when completing M&As?

The merging of two or more companies creates a serious cybersecurity challenge. When organisations undergo M&A, all parties involved must be blended into one new company with the minimum of disruption and downtime. In most cases, access to CRM systems, ERP systems, human resources and proprietary applications are necessary at a minimum to allow the newly merged organisation to achieve a reasonable level of productivity.  At the foundation of all of this lies identity.  Complexity is created at every stage of a M&A, creating gaps and holes for threat actors to exploit. Risk is inevitable.

The M&A process involves the incorporation of vast data estates and disparate policies, infrastructure and applications. Departments must be brought together and synergised so they can communicate with each other and ultimately work together effectively. It is a time of considerable upheaval, which creates risk.

When staff leave the company or switch departments, best practices dictate that their accounts and privileged access will be deleted from the central system of record or locked from use. Because most organisations suffer from some level of identity sprawl, those accounts may remain in periphery systems or within several different communication channels, from emails to other highly critical systems.

These stale and over-privileged accounts are a treasure trove for attackers. Duplicate identities pose a similar risk. When an organisation has large numbers of ghost accounts that have not been accounted for and shut down, it has effectively painted a target on its back.

The ghost identities are a threat to all organisations and often go unnoticed. During a M&A, they will remain undetected for longer, so will pose a greater risk. It has been reported that 47% of ex-employees still have access to business data months after leaving an organisation. When companies merge, the number of stale accounts grows exponentially. Threat actors can use these identity credentials to gain privileged access to restricted areas of the network – where they can cause severe damage.

Why has identity management proved to be a challenge during M&As?

The simple answer is that managing identities is difficult during calm times, particularly due to the challenge over stale and over-privileged accounts. It is time-consuming to find, modify or change user access data. Time-stretched security staff simply do not have the bandwidth to hunt down stale accounts, so the problem compounds over time. The lack of control over the provisioning and de-provisioning of user access also increases the potential risk of suffering a cyberattack.

Managing identities often relies on tedious, manual work. Our research found that 52% of all tech executives find the manual provisioning and de-provisioning of user access to be the most stressful challenge they face in identity and access management (IAM).

During times of normal business operation, it is easy to let small problems snowball into larger ones. During a M&A, the risk becomes even more pronounced and the means to tackle it often dwindle as hard-pressed security staff rush to deal with other problems. But failing to tackle identity can quickly lead to a crisis.

How can security leaders tackle this M&A identity crisis?

To manage the complexity of identities in M&A, CISOs and security admins need to develop a clear understanding of which accounts are genuine and belong to current staff members, and which outdated and must be deleted. This is not a straightforward process, which is one reason we have observed a gap of 12 months or more between the date of a merger and the day when the parties manage to integrate their systems.

The first step is removing ghost or duplicate identities and gaining visibility into all live users. Mapping the web of identities should then be carried out in collaboration with HR and department heads in order to produce a correct headcount. Security leaders must then focus on implementing an IAM framework capable of dealing with the complexity and data volume of M&As.

Radiant Logic’s research found that 67% of organisations have a modern access control and governance solution, but many apps and users are left out. The majority of the current IAM solutions work at the application layer, focusing on unifying applications and systems instead of bringing identity data together. This is particularly problematic when integrating cross-organisational systems because many applications have different data needs, and are often highly-tailored to the distinct requirements of an organisation or department.

How can a single source of identity data help organisations complete M&As?

The most effective solution to the problem of identity in M&A lies in building a unified single source for all identities using an Identity Data Fabric. This approach unifies all identity data across the organisational network, first collecting identities on-premise and in the cloud before mapping similar identities to an abstraction layer, and then blending them into a global user profile to ensure all identities are unique, complete and accurate.

The Identity Data Fabric operates at the data layer rather than an application layer, so will not interfere with the operations of existing applications, instead offering a more effective way of accessing, understanding and managing identity data across the organisations involved in M&A.

Implementing an Identity Data Fabric framework gives security teams total visibility over the entire network, enabling them to identify the access levels associated with each unique user across systems and applications both in the cloud or on-premise. Taking control of identity data will remove some of the turbulence from M&A. Identity Data Fabric can stop identity integration from becoming a crisis, and allow the newly-joined business to focus on what it does best.

Continue Reading

Magazine

Trending

Finance10 hours ago

Hey, Gen Y and Gen Z do you think you can retire comfortably?

By Penelope Gregoriou, technical investment specialist at Alexforbes   Millions of South Africans rely on the money saved in their...

Uncategorized11 hours ago

GDPR: data security four years on

Bruce Penson, the managing director of cyber security and IT support company Pro Drive IT, outlines how GDPR has changed...

Banking11 hours ago

The importance of Customer Experience (CX) for retail banks today

By James Isaacs, President, Cyara   Today’s retail banks face considerable challenges. Open banking initiatives –  that make it easier...

Finance11 hours ago

Getting ready for VAT digitisation: automation is key

Christiaan Van Der Valk, Vice President for Strategy and Regulatory at Sovos, says technology will power real strategic success for...

Banking11 hours ago

Challenging the challenger: Why the digital transformation of traditional banking is key for competing with challenger banks

By Sam Schofield, Senior Vice President: Global Enterprise at Udacity   Monzo and Revolut are only seven years old. Starling,...

Wealth Management12 hours ago

Green with Envy – an Environmentally Conscious Data Center

Mark Fenton, Product Manager, Future Facilities   Environmental considerations are at the top of every business leader’s agenda and an...

Technology12 hours ago

How Digital Adoption Platforms can enhance digital transformation and customer experience in the insurance industry

By Vara Kumar, CPTO & Co-founder, Whatfix   Like many industries, the insurance sector was prematurely hastened towards digitalisation due...

Business20 hours ago

Why do Traders Need a Managed Service Partner?

Jeff Mezger, Vice President of Product Management, Financial Markets, TNS   Does your financial institution have the understanding, resources, talent...

Business21 hours ago

The FCA will take immediate action on customer vulnerability; here’s how firms can prepare.

Author: Jonathan Barrett, CEO and Co-Founder at Comentis   Identifying and supporting vulnerable clients has become a priority for financial...

The Green Revolution In Investing - Sustainable Investing The Green Revolution In Investing - Sustainable Investing
Business1 day ago

How fintech is key to empowering climate action

Attributed to: Rory Spurway, CEO & Founder of CarbonPay   As human activity continues to have a significant impact on...

News2 days ago

Fractional NFTs- A Positive Impact on the Market

Non-Fungible Tokens (NFTs) have been making headlines for quite some time now. The phenomenon is getting a lot of attention...

Technology2 days ago

Are cyber insurance and incident response budgets the same thing?

Dominic Trott, head of strategy – UK, Orange Cyberdefense   Cyberattacks on businesses increased by 13% in 2021 compared to...

Business2 days ago

Ticketing modernization: the key success factors for an outstanding deployment

Arnaud Depaigne, Product Manager, Smart mobility, Fime   Technology has transformed the way we pay, and transport ticketing has been...

Finance2 days ago

How to increase the growth of crypto apps in a challenging market environment

By Alexandre Pham, Vice President, EMEA at Adjust   Crypto and digital assets became one of the hottest tech topics...

Business3 days ago

Businesses must adapt to meet customers’ evolving payment needs

Nathan Shinn, Founder and Chief Strategy Officer, BillingPlatform   From the lingering impact of the COVID-19 pandemic, through to the...

Banking4 days ago

Carbon Neutral and Net Zero: The New Disrupter-in-Chief

Authored by Jason Matteson, Director of Product Strategy, Iceotope   When we think of market disruptors we typically think of...

Business4 days ago

Balancing risk management with a seamless customer experience

By Andrew Davies, VP, Global Market Strategy, Financial Crime Risk Management, Fiserv   For quite some time, measures to mitigate...

Business4 days ago

The need for blockchain to be interoperable and why it matters

By Kai Waehner, Field CTO and Global Technology Advisor at Confluent   In mid-2022, it would be fair to say that...

Interviews4 days ago

How MFA can protect the financial sector from the unprotectable

The financial sector has long been a primary target for threat actors. However, the unique infrastructure of core financial systems...

Business5 days ago

Why a three-step framework can help financial advisers support their most vulnerable customers.

Author: Tim Farmer, Co-founder and Clinical Director at Comentis   We are witnessing a vulnerability epidemic. With the Financial Conduct...

Trending