All posts by : Steve Miller

In many ways, technology is a boon for the  insurance industry. It has allowed  brokers to continue providing coverage to their clients as brokerages have adopted a new hybrid remote work strategy. 

But with technology comes risk. Ne’er-do-wells are lurking behind every virtual corner. And, without proper security awareness and the right data protection strategy, you and your clients’ information could end up in the wrong hands (just ask Garmin).

Independent insurance brokerages need to take action to ensure every piece of data is safeguarded not just from theft but also harm. Luckily, by embracing the right security awareness and teaching your team about data protection best practices, you can minimize the risk of a cybersecurity attack (short on time? jump right to the tips!).

Security Awareness: What Are You Protecting?

Before you dig into the steps you can take to bump up your cybersecurity, it’s critical to understand what you’re securing. Independent insurance brokerages have access to a slew of information, much of which is incredibly sensitive.

First and foremost, you’re responsible for protecting your clients’ data. Failing to protect your clients’ financial information correctly comes with devastating consequences. That’s why securing client data has to be a priority.

Additionally,  insurance brokerages have payment information, which is something any hacker would love to get a chance to exploit. Your systems also hold operational data, which, while not necessarily confidential, is critical to your business.

Many  insurance brokerages also have data they’d rather keep private. Company secrets like pricing details and trade agreements aren’t something you want released out into the world.

Finally, there is a mountain of personal identity information. Along with contact details and demographics for your clients, you also have personnel records for you and any employees.

Overall, there is a lot worth protecting. That’s why security awareness and data protection is so vital.

Who Are the Bad Guys (And How Can You Stop Them)?

Now that you understand what you’re safeguarding, let’s take a look at the bad guys you’re defending against.

Malware

One of the biggest baddies around is malware, or malicious software. This category encompasses a wide variety of threats, including worms, trojans, and a range of other viruses. Often, these relatively tiny clumps of code can be incredibly damaging. Some may create backdoors into your systems, allowing unauthorized personnel to reach your data. Others may cause catastrophic damage, erasing, or scrambling information.

Ransomware, a subset of the malware category, is an attack-type on the rise. With these, the malicious software seizes control of your computer, database, or network, encrypting the information and locking you out. Hackers then demand a ransom, usually in the form of cryptocurrency, to decrypt your data and give you back control.

Stopping malware should always be a priority. Luckily, best practices like installing antivirus software and keeping it up-to-date makes a big difference. Similarly, a robust firewall can prevent unauthorized traffic from reaching your systems.

Finally, backups are a powerful tool. By backing up regularly, even if your data is damaged in an attack or seized by ransomware, you haven’t lost everything. You have an accurate, recent copy of your information, allowing you to rollback if the need arises.

Phishing

Phishing attacks are all about trickery and deception. The hacker tries to deceive a company employee into handing over login credentials, personal information, brokerage data, financial details, and more.

A classic form is an email or text message that tries to convince the recipient to click on a link or download an attachment to resolve some kind of issue. The trick is, that link doesn’t go to a legitimate site. Instead, it’s a fake designed to steal the person’s credentials or other information. With attachments, it’s a way to download malware.

Some phishing attempts can be incredibly sophisticated. They may feature spoofed email addresses, making it look like the message came from a person or company the recipient knows and trusts. The body of the email may look legit, featuring well-known logos and other hallmarks of the real thing.

However, there’s usually something amiss about the message. Maybe the spelling or grammar isn’t quite right, or the domain on the email address is off. The content not being tailored to the recipient – such as saying “account holder” instead of addressing the person by name – could also be a clue.

Security awareness and training is crucial for every employee, particularly when it comes to combatting phishing attacks. It ensures everyone knows how to spot the signs of a suspicious email or text message, ensuring they won’t interact with suspicious links or give information to someone who shouldn’t have it.

Lack of Secure SSL/TLS

While not technically a kind of attack, a lack of secure SSL/TLS is an issue. SSL/TSL (secure socket layer/transport layer security) protocols mean the website connection isn’t secure. Data moving between that page and the recipient isn’t encrypted, making it vulnerable to interception and theft.

Never send sensitive information – such as personal identity information or financial details – through a site that doesn’t have SSL/TLS in place. If you do, a hacker could intercept the packets, snagging your data while it’s in transmission.

5 Tips to Protect Your Clients’ Data, as Well as Your Own

As an  insurance brokerage, data protection must be a priority. Not only are their regulations that make certain steps a must, but failing to keep your clients’ data protected can harm your reputation and potentially leave you open to litigation.

Make sure you take the right steps to secure your system and embrace these 5 best practices plus a bonus tip that every brokerage should implement today. 

• 1. Update your computers, applications, and antivirus software regularly
  2. Choose strong, unique passwords, and change them regularly
     1. Use password managers when necessary, and always say “yes” to two-factor authentication procedures.
  3. Consider switching to digital payments and eliminating paper checks from your workflow. This one simple action can reduce the risk of clients’ personal data being mishandled or misplaced.
     1. Follow all PCI-mandated data protections when handling or accepting payments.
  4. Reduce your use of other paper in the office, particularly documents with sensitive client data on them.
  5. Be skeptical about any unexpected email, particularly those containing links or attachments, or that are asking for sensitive data.
  6. *BONUS Always… always… ALWAYS backup your data. It’s a final safeguard, allowing you to revert back if something goes awry.

While security awareness and data protection practices require some effort, they are worth it. Ultimately, you are what stands between hackers and yours and your clients’ data. So, make sure to take every precaution. In the end, it’s a much easier road than the one you’d have to take after an attack.