Technology

Why insurers must be on the lookout for ever-opportunistic cyber attackers

Published

2 years ago

March 7, 2022

admin

By Paul Prudhomme, Head of Threat Intelligence Advisory at IntSights, a Rapid7 company

The insurance industry has long been a staple for cyber attacks. Criminals go where the money is, and the sector represents one of the most direct ways to access key personal and financial data that can be used to net an illicit profit.

More recently, insurers have faced even greater risk exposure due to their provision of cyber insurance coverage, particularly when it comes to ransomware. The sector has also seen increased attention from state-sponsored actors seeking personal data to fuel other campaigns.

Why is the insurance sector such a popular target for cyber crime?

Threat actors regard the insurance industry as a valuable source of personally identifiable information (PII) which can be used for a variety of crimes, including identity theft, other types of fraud, and further cyber attacks.

Alongside insurance documentation itself, firms will also have digital copies of items such as passports, driver’s licenses and bank statements that have been used to verify the policy holder’s identity and address. Birth dates are also particularly valuable to criminals, alongside National Insurance numbers, Social Security numbers, and their various international equivalents.

In one prominent example, U.S. insurer Ryan Specialty Group had its employee email accounts breached in April 2021. Customer names, Social Security numbers, driver’s license and passport details, and financial account details were believed to be exposed as a result.

The depth of information held by insurers on behalf of policyholders is also useful to state-sponsored threat actors, providing a large amount of data for human intelligence (HUMINT) operations or signals intelligence (SIGINT) operations.

Insurers that provide cyber insurance also face an elevated threat level. Attackers may seek to compromise their network to unearth policy details and security standards as a way of creating more effective targeted attacks.

The rising threat of ransomware

In addition to data theft, insurers are also targets for ransomware attacks. Ransomware has swiftly risen to become one of the primary cyber threats for businesses in all industries today as an infection can rapidly cripple the organisation by encrypting key files and systems. Criminals are also increasingly coupling ransom demands with data theft, often threatening to leak sensitive information unless additional payment demands are met.

However, insurers that provide cyber policies may again face increased risk from organised cyber criminal gangs and state-backed actors. In one prominent example, the Asian component of global cyber insurer AXA was struck by the Avaddon ransomware last year very shortly after announcing that it would stop reimbursing new French customers that chose to pay ransom demands.

The group responsible may have been seeking to make an example of AXA, as its previous policy of covering ransom payments would make it more likely for victims to pay up to criminals.

Why most stolen data is destined for the dark web

Stolen data is a commodity item in the shadow economy maintained by cyber criminals. Datasets are readily bought and sold on hidden forums and marketplaces on the dark web, with individuals and groups often specialising in selling data rather than using it themselves.

In one example discovered by IntSights security researchers, a Chinese-speaking criminal going by “Rebecca” was selling access to records from Chinese auto insurance companies for $3 each. These records included PII such as names, addresses, and driver’s license numbers.

Threat actors will commonly purchase PII sets from different sources to help facilitate further data theft and fraud. The insurance sector is a favourite target here as automated quote tools can potentially be exploited into revealing more information about customers. Farmers Insurance Group, for example, revealed that in early 2021, attackers attempted to use previously stolen customer names, dates of birth, and street addresses to trick its automated car insurance tool into providing driver’s license numbers.

Criminal groups now often include the threat of data disclosure as part of ransomware attacks. Defiant organisations that refuse to pay up will be punished by having their data sold on the dark web, or sometimes dumped on publicly available open web platforms. The threat aims to pile additional pressure on the victim by creating a high-profile breach that will damage customer trust and attract the attention of compliance regulators.

How can insurance firms protect themselves and their customers?

All firms operating in the insurance sector should be aware that they represent a high priority target to threat actors ranging from opportunistic criminals to highly organised gangs and even state-sponsored groups. Securing the customer data in their care should be a top priority for all insurance firms.

Insurers need to consider the context of their data and how best to protect it. B2C security measures will be significantly different from B2B equivalents, for example, and different subsectors such as auto and health insurance will also have their own security threats and priorities.

Threat intelligence is the most important asset for attempting to understand and mitigate these risks. Having access to a range of data from open and closed web sources will help insurers to build a picture of threats arrayed against them and prioritise their security strategies accordingly.

This includes insight into general trends, such as new attack tactics, malware variants, and software vulnerabilities, and can also reveal direct threats to the organisation. For example, threat intelligence might uncover discussions in a dark web forum about targeting a specific insurer because of their ransomware pay-out policy, or due to an exploit in their automated customer service system.

Effective threat intelligence can also alert insurers to the fact they have been breached by discovering criminals arranging the sale of stolen data. While the firm will still suffer reputational and financial damage, this warning can give them a chance to get ahead of the crisis.

The cyber threat landscape has become increasingly hostile for the insurance sector in recent years. In order to have the best chance of protecting both themselves and their customers, insurance providers should look to implement threat intelligence to understand the context of their data and mitigate threats accordingly.

Up Next

Tackling home insurance fraud with granular claims data

Don't Miss

Four Top Tips for Benchmarking Your Annual Cyber Security Investments

Business

How can law firms embrace automation and revolutionise their payments?

Published

22 hours ago

September 28, 2023

editorial

Attributed to: Ed Boal, Head of Legal at Shieldpay

Once again, AI is dominating international headlines. This time, it’s due to a closed-door meeting this month between tech leaders and US senators to discuss the technology’s regulation.

AI and automation isn’t just for the likes of Big Tech. We’re seeing predictive and automated technologies transform almost every sector and the legal industry is no exception. In fact, recent research from HBR Consulting found that 60% of law departments had implemented a legal data analytics tool last year and more than 1 in 4 indicated they were using AI for at least a single use case.

However, adoption isn’t without its challenges. Reticence remains among some and there’s also the danger of ‘transformation fatigue’ slowing real progress. If law firms want to reap the many benefits of automation – including revolutionising their payment processes – these challenges need to be carefully considered and thoughtfully addressed.

An area of great opportunity

Often seen as conservative, the legal industry has been gradually warming up to the idea of automation and technology.

While some pioneering firms have been quick to embrace automation tools, others remain cautious about disrupting their established workflows. As we navigate this landscape, it’s clear that certain areas of legal services are ripe for innovation.

One area is contract management. The process of drafting, reviewing, and managing contracts has traditionally been time-consuming and prone to human errors. Automation can alleviate these pain points by streamlining the entire lifecycle of contracts, from creation to renewal, thereby enhancing efficiency and reducing risks.

Another promising domain is legal research. Thanks to advancements in natural language processing and machine learning, legal professionals can now leverage AI-powered research tools that analyse vast volumes of legal data to provide accurate insights and case precedents swiftly.

But, while progress is undoubtedly being made, the legal sector still lags other sectors when it comes to innovation.

What’s getting in the way of progress?

This isn’t always down to a resistance to change. Often, it’s a result of firms spreading their resources too thinly across numerous technology initiatives.

Ed Boal

Attempting to tackle everything at once can result in ‘transformation fatigue’, where the benefits of individual innovations get diluted – leading to frustration and slower progress.

Before legal firms embark on digital transformation projects, a critical first step is introspection. Recognising and acknowledging areas where legacy processes and manual tasks still hold sway is paramount to optimising the impact of automation.

For many firms, archaic practices continue to consume valuable time and resources, diverting attention from higher value, billable tasks. One often-overlooked area is payments.

Legal firms play a critical role in complex transactions, from M&A and real estate deals to litigation and arbitration payments. The associated admin and processes represent a drain of firms’ time and resources. Spanning everything from collating stakeholder payment details and verifying payee identity to ensuring compliance with Know Your Customer (KYC) and Anti Money Laundering (AML) regulation, this adds unnecessary stress for lawyers – who would rather dedicate their time and expertise to their clients’ legal needs.

The repercussions of such time-consuming financial processes reverberate throughout the entire organisation. Administrative burden weighs heavily on the team, affecting productivity and ultimately, the bottom line: recent research from Shieldpay, surveying the UK’s Top 100 law firms, found that almost 1 in 3 (32%) say KYC collection and verification checks take 4-9 working days.

At the same time, firms are exposed to significant financial risk which can make handling client funds a costly endeavour. Not only are they penalised with fines if found to be in breach of stringent client account rules but firms are also subject to hefty premiums for Professional Indemnity (PI) insurance. No wonder 73% of all legal professionals and 90% of junior law professionals are concerned about the risks and time costs associated with holding client funds.

Revolutionising payment transactions

In short, manual payment processes are more than just an inconvenience for modern law firms. They can damage relationships with clients – who have come to expect a fast, painless and automated payout experience in a digital world – and impede revenue generation by tying up top talent in an endless cycle of paperwork and (unbillable) admin.

So how can firms take the pain out of legal payments?

Fortunately, new payment technologies have emerged as a formidable ally. Third-party payment providers offering solutions for law firms, such as escrow and paying agent services for specific transactional deals, or more embedded payment solutions such as managed accounts (TPMAs) – i.e. outsourced client account functions – offer secure and instant transactions, while prioritising transparency and automation.

TPMAs operate as an escrow payment service in which the third-party – a licensed external payments partner – receives and disburses funds on behalf of a firm and their client(s).

With advanced encryption ensuring data security, working with a regulated payment partner means legal professionals and their clients can engage in financial transactions with peace of mind – while law firms benefit from improved operational efficiency.

And the advantages don’t stop there. Enhanced transparency builds a sense of confidence and trust, while the elimination of manual data entry and repetitive tasks allows legal professionals to devote more time to legal services and fostering stronger relationships with their clients.

AI and automation has much to offer the legal sector. But its adoption must be carefully planned in order to avoid transformation fatigue that risks stalling progress altogether. With typically shallower pockets than Big Tech giants, it’s important for law firms to focus their efforts on specific areas that could benefit from automation, rather than rush to overhaul their entire way of working, all at once. This controlled phase-out is the key to avoiding adoption frustration, seeing a real impact on profits and productivity and setting firms up for real, lasting change.

Business

In-platform solutions are only a short-term enhancement, but bespoke AI is the future

Published

2 days ago

September 27, 2023

editorial

By Damien Bennett, Global Director, Principal Consultant, Incubeta

If you haven’t heard anyone talking about artificial intelligence (AI) yet, then where have you been? Conversations about AI and its advantages to society have been a key talking point over recent months, with advances being made in the generative AI race and ChatGPT opening a whole plethora of possibilities. Many have highlighted the advantages of AI, but notably it’s ability to create human-like content.

But these discussions have only scratched the surface of what AI is capable of doing. It is for far more than just essay writing, adding Eminem to your rave and photoshopping dogs into pictures.

In marketing, we have been using AI for years, for everything from analyzing customer behaviors to predicting market changes. It’s enabled us to segment customers, forecast sales and provide personalized recommendations, having a huge impact on how our industry works.

It is even, for the more savvy marketers of the world, becoming a key tool in maximizing budget efficiency – which is apt, considering over 70% of CMOs believe they lack sufficient budget to fully execute their 2023 strategy.

Now, as AI becomes more intelligent, the number of efficiencies it can unlock continues to rise. Not only can it help brands get the most out of their available resources and identify any areas of waste, but it can also help highlight new opportunities for growth and maximize the impact of your budget allocation.

The trick, however, is to veer away from the norm of using in-platform solutions with a one-size-fits-all approach and create your own, bespoke solutions that are tailored to your business needs.

Pitfalls of in-platform solutions

In-platform solutions aren’t by any means a bad thing. In fact, built-in AI tools have become increasingly popular, owing to their ease of integration, user-friendly interfaces and minimal set up requirements. They come pre-packaged with the platform, offering the user the ability to leverage AI technologies without the need for in-depth technical expertise or the upfront cost of building a solution from scratch.

However, the streamlined and accessible nature of in-platform AI solutions comes at the expense of complexity and customization. They are designed to serve a broad user base, but for the most part are built using narrow AI solutions with predefined features and workflows.

This makes them great for assisting with common AI tasks, but they lack the flexibility to tailor functionality towards unique business requirements or innovative use cases, limiting the potential efficiencies and cost savings that can be unlocked. Additionally, if a business’ competitors are using the same platform, they are probably using the same AI solution, meaning any strategic advantage gained from these will be reduced.

Bespoke AI solutions, on the other hand, may carry a higher initial investment – but can offer a significantly more attractive ROI over a short amount of time.

Why customized and adapted AI is the key

The difference between bespoke AI and in-platform solutions is similar to that between home cooked food and a microwave meal. Yes, it is more time consuming to prepare, and yes it likely carries more of an upfront cost, but the end result is going to be far more appealing and will carry more long-term value (financially… not nutritionally).

That’s because bespoke solutions, by nature, will have been tailored to address your brands specific needs and challenges. These custom-built tools allow for much greater efficiencies by streamlining workflows across different channels, automating more complex tasks, and providing deeper, more relevant insights.

The increased level of optimization can significantly improve productivity and reduce operational costs over time, offering a higher ROI. The increased flexibility of bespoke AI also allows brands to implement innovative use cases that can significantly differentiate them from their competitors.

The data analyzed can be specifically chosen to match business requirements, as can the outputs of the AI tool, providing a significant advantage when understanding and acting on the insights provided.

Additionally, these tools are, by nature, more scalable. They can be updated, upgraded and expanded as needs change, ensuring they continue delivering value as the business grows. They can also be designed to integrate with any existing IT infrastructure, from CRM systems and databases to marketing platforms and sales tools – leading to more efficient and effective decision-making.

Managing finances with AI

It’s no secret that AI in marketing automation has, and will continue to, revolutionize the way marketing is done. It has a bright, if slightly terrifying, future and can help CMOs to unlock new efficiencies, maximize the impact of their budgets and increase their ROI. And as this technology becomes more advanced, its impact will only increase.

But we already know that…and so does everyone else.

So, in order for businesses to make themselves stand out from the crowd , they must look to fully adopt the power of AI. Creating a customized and unique AI solution could be the way to set yourself apart from your competitors. A bespoke AI tool can provide brands and businesses with features unique to them and their business needs. As a result, companies will benefit from more useful data and better results to make more data-driven decisions for their business. Ultimately, this will help brands to maintain a competitive edge over their competitors, deliver ROI and most importantly optimize their budgets.