Key lines of defence in brokerage cyber security

Insurance brokers face potential cyber threats every single day. One simple click on a malicious link in an email or website can result in a cyberattack with the potential to cripple a brokerage.

Awareness is the first line of defence in cyber security. Insurance brokers are prime targets for cyberattacks as they handle large amounts of personal identifiable information (PII) and sensitive commercial data. And, of course, they facilitate financial transactions. These are all things that cyber criminals are looking to exploit.

“We are concerned about the current cyber risk landscape in Canada,” said Luc Ouellet (pictured left), director of digital distribution at Intact Insurance, with responsibility for Intact’s Cyber Task Force Program. “Over the past year, we’ve seen an increase in criminal cyber activity targeting insurance brokers, with the two main vehicles being ransomware and social engineering.

“We’re take cyber security very seriously and we’re also very mindful of the responsibility we share with brokers to improve cyber security in the insurance industry and to protect Canadian PII.”

Read next: Standardized vs. bespoke: Room for both in commercial insurance

A strong cyber security culture is only possible with support and buy-in from brokerage principals. Ouellet advised that brokerages avoid relying solely on one employee or team with technical IT skills, or to delegating responsibility for cyber security to an external vendor. He encouraged brokerage principals to take ownership of their firm’s vulnerabilities, and to encourage and model security awareness and risk mitigation from the top down.

One brokerage to work hard on that is The Standard Insurance Brokers, a 125-year-old firm providing personal and commercial insurance solutions to communities in Northwestern Ontario, Manitoba, and Saskatchewan.

“Cyber awareness is of the utmost importance to our brokerage,” said Jordan McDonald (pictured, right), chief operating officer, The Standard Insurance Brokers. “We understand the threats that are out there. Being proactive in our approach is key to our business continuity.

“We believe we have invested in the right protection to reduce the chances of a cyber incident occurring. Additionally, we have a Cyber Incident Response Plan that we test annually to make sure we are ready in case an incident occurs.”

The Standard Insurance Brokers runs monthly phishing tests on its employees, testing their ability to spot malicious emails, links, and attachments. If an employee fails a test by clicking on the rogue link, they are assigned additional cyber security awareness training, McDonald explained. Additionally, each phishing test is followed by a post-mortem where employees are educated on how the phish could have been detected and avoided.

“I personally believe that a training session where you go over cyber security threats is a start, but more hands-on training is necessary,” said McDonald. “We have found that real-world examples of phishing help to model a cautious behaviour among our employees.

“Our Help Desk now receives requests to review legitimate emails because people are fearful of clicking on either a phishing test or a real phishing email. I highly recommend investing in a system that tests your staff on their ability to identify phishing emails. It will certainly help create security awareness in your brokerage.”

Read more: Fighting inflation: Brokers are a business’s first line of defence

Beyond employee training, Ouellet advises brokerages to incorporate multi-factor authentication (MFA) into their operations, as is now the norm for data-sensitive businesses. Intact Insurance recently implemented MFA into the Intact Portal for brokers, adding more security to the system. To access the portal, brokers now enter a code, unique each time, in addition to their login and password.

Both Ouellet and McDonald also stressed the importance of tried and tested back-ups to restore systems and data after a cyberattack.

“When was the last time you tested your back-ups, and are you sure they would survive a ransomware attack?” McDonald prompted. “If you use a third-party IT provider or your broker management system is hosted by your vendor, have the conversation with them about how often they test your back-ups. Ask your IT team what they would do if every one of your workstations was locked by a ransomware attack.”

Unfortunately, even with the best cyber security controls in place, it is no longer a matter of “if” a cyberattack will impact an insurance brokerage, but “when,” according to Ouellet. Knowing how to respond to an incident in an efficient and compliant manner is critically important.

“We’ve seen situations where brokerages have not been able to recover properly after a ransomware attack, because they either did not have adequate cyber insurance coverage, or they did not have the proper processes and back-ups in place to restore their businesses,” Ouellet told Insurance Business.

“Most insurance brokerages across Canada are small to medium-sized businesses, so they can really lead by example and ask themselves the same questions they’re asking customers, such as: ‘Do I have enough coverage to pay a ransom? Do I have enough coverage to communicate with clients and fund credit monitoring for them after a breach?’ Doing this exercise for their own business will help brokers learn how to advise other business owners about their needs.”

A cyber secure brokerage network will help to protect Canadian consumers and businesses. Ouellet said this is something that insurers and brokers must work towards together by sharing resources and spreading awareness of cyber security best practices.