Ransomware racket
As the insurance industry increasingly relies on digital technologies and data-driven processes, cybersecurity has become a paramount concern.
To navigate the evolving threat landscape and protect sensitive information, insurers must stay abreast of current trends, emerging threats, and best cybersecurity practices.
FAnews recently spoke to Musawenkosi Khumalo, Cyber Insurance Underwriter at iTOO Special Risks about the latest developments and strategies shaping cybersecurity within the insurance sector.
Current trends in cybersecurity
Khumalo highlighted key trends in cybersecurity for the insurance sector. Emerging technologies like AI, machine learning, and blockchain are being integrated to enhance cybersecurity, while cyber threats such as ransomware and phishing attacks are becoming more sophisticated. Data privacy concerns are also gaining prominence, prompting a focus on incident response planning and resilience strategies to mitigate cyber incident impacts.
There is a growing emphasis on advanced persistent threats (APTs), which are prolonged and targeted attacks aimed at infiltrating networks and stealing sensitive information covertly over time. The cyber insurance market is responding to these evolving risks with expanded coverage options, enhanced underwriting criteria, and risk-based pricing models. Policies increasingly cover ransomware payments, recovery costs, and business interruption losses. Global market leading insurers are utilising AI, blockchain, and predictive analytics for threat detection and automated response, while blockchain technology is seeing increased adoption for secure, decentralised transactions and data protection.
Emerging cyber threats to watch
Khumalo highlighted several emerging cyber threats that insurers need to be vigilant about: supply chain attacks, zero-day vulnerabilities, cloud security risks, and AI-powered attacks. He noted that threat actors are increasingly targeting supply chains to compromise multiple organisations through a single point of entry. Zero-day exploits, which have no available patch, are also a growing concern.
Additionally, Khumalo emphasised the risks associated with the rising adoption of cloud-based infrastructure and services, making organisations more susceptible to threats like cloud misconfigurations and account compromises. Cybercriminals are leveraging AI and machine learning to automate and enhance their attacks, including the use of deepfake technology to create convincing fake audio and video content.
Defending against ransomware attacks
As ransomware attacks surge, insurers are enhancing defences through improved risk assessments, underwriting processes, and continuous monitoring. Khumalo explained, “Insurers are improving risk assessment and underwriting to evaluate policyholders' cybersecurity posture and resilience against ransomware.” They offer comprehensive risk management services, including cybersecurity training, vulnerability assessments, and tailored incident response plans to prevent, detect, and respond to attacks.
Collaboration is crucial in fighting ransomware, with insurers, cybersecurity firms, and industry groups working together to share threat intelligence and best practices. Khumalo stressed the importance of raising cybersecurity awareness through educational programs, workshops, guides, and awareness campaigns. Insurers provide training on identifying phishing attempts, securing data, and responding to incidents, complemented by cyber risk assessments and consultations with cybersecurity firms offering advanced tools and services.
Addressing supply chain cyber risks
The interconnected nature of the insurance ecosystem makes supply chain cyber risks a significant concern. Insurers are refining their risk assessment methodologies to better evaluate these risks. This includes conducting comprehensive cybersecurity audits, detailed questionnaires, and risk surveys, and using advanced analytics tools to model potential cyber risk scenarios.
Khumalo noted, “Insurers are conducting thorough audits of both the insured and their supply chain partners to identify vulnerabilities.” They provide access to 24/7 incident response teams and recommend regular security audits and penetration testing to detect and address vulnerabilities. Insurers also emphasise regular cybersecurity training for employees to reduce human error leading to breaches.
Regulatory developments and compliance
Regulatory developments and compliance requirements are shaping cybersecurity practices in the insurance industry. Khumalo noted that South Africa's Protection of Personal Information Act (POPIA) has heightened data protection focus, with the Information Regulator issuing fines, increasing client concerns.
To ensure compliance, insurers are implementing robust data protection policies, appointing Information Officers, and conducting regular audits. Khumalo highlighted, “Insurers are investing in cybersecurity frameworks to protect against threats and developing incident response plans covering detection, reporting, and mitigation.”
Writer’s Thoughts
As the insurance sector adapts to the complexities of a digital world, proactive measures in cybersecurity are essential for safeguarding both the industry and its clients. By embracing innovative technologies, enhancing risk assessment protocols, and fostering collaboration, insurers can not only defend against current threats but also build a resilient framework that anticipates future challenges. Please comment below, interact with us on Twitter at @fanews_online or email me - [email protected]
