Is insurance industry data really safe in the cloud?

Last month, according to South Australia’s Premier Rob Lucas, “almost everyone” employed by that state government likely had their personal details, including bank accounts and tax file numbers, breached during a cyberattack.

The ransomware attack was against Frontier Software, a company that provides the government’s payroll services. Frontier uses both cloud and on-premise software and storage options.

For insurance companies, could cloud storage and software be a potentially fatal flaw?

“Frazer Walker has had discussions at executive and board level on the risks and benefits of cloud services and how that fits within an insurer’s risk appetite,” said Ian Chisholm (pictured above), a partner at the Sydney-based management and technology consultancy.

Chisholm, an IT expert in the insurance and banking sectors, said it’s about trade-offs between cyber risks and operational and financial risks.

The World Economic Forum recently released its Global Risks Report 2022. Cyber threats featured quite prominently. Carolina Klint, risk management leader, Continental Europe, Marsh, highlighted that cyber threats are now growing faster than the ability to eradicate them permanently.  This in turn is making it clear that neither resilience nor governance are necessarily possible with “credible and sophisticated cyber risk management plans,” she said.

During the 2020-21 financial year, the Australian Cyber Security Centre (ACSC) said there were over 67,500 cybercrime reports, an increase of nearly 13%, with estimated losses of more than $33 billion.

“I think it’s a really good question,” said Nigel Fellowes-Freeman (pictured immediately above) CEO of the insurtech Kanopi Cover, as he considered whether the cloud is too much of a security risk for insurance companies.

“I think, generally, when you break most of them down a lot of cyberattacks are the result of password failures, rather than infrastructure failures. So, it’s the configuration of the setup versus actually the infrastructure itself not being secure,” he said.

Fellowes-Freeman said that cloud is a very broad term. There’s a public cloud where everyone shares the same data centres.

“But when you want to get really secure you can use a private cloud. So that’s a cloud environment just configured for you, with only your data on it and only access for your organization,” he said.

Apart from storage, there are all the other benefits that come from cloud computing, including speed, flexibility and affordability, he said.

However, if an insurance company wanted to use a private or hybrid cloud, execution would be key, said Fellowes-Freeman.

“It has to be executed really well,” he said.

On the security side, Fellowes-Freeman said it would be hard to match the security effort of the big cloud providers.

“There’s a really, really big investment from these cloud providers like AWS (Amazon Web Services) and Microsoft in security and data protection,” he said.

Richard Kimber (above), CEO of Daisee, the Australian AI (artificial intelligence) software company, agreed with Fellowes-Freeman. He said the cloud services provided by the big players are very secure.

“We haven’t seen any widespread, successful attacks on any of those providers and I think that’s because the security controls are numerous and multi-layered,” he said.

Kimber thinks the cloud is a lot safer than it’s portrayed in the media. He also said many of the successful cyberattacks are the result of targeting individuals rather than directly breaching cloud security systems.

“There are always going to be vulnerabilities, but it’s a matter of making sure the right controls are in place,” he said.

Chisholm said one big reason insurers are increasingly moving from self-hosting to private and/or public cloud services for their core insurance applications is cost.

“They are much more cost-effective than running your own private data centres, as most insurers did in the 1980s-1990s,” he said. “The costs of owning and operating these large, high-cost assets to the standard now required by regulators, and to meet customer expectations, is prohibitive for most organisations,” added Chisholm.

Chisholm said data centres also require “a small army of IT staff” and around the clock operation which is beyond the capacity of most insurers.

“Keeping those skillsets current and at an appropriate level of redundancy would stretch organisations’ staffing and training budgets,” he said.

There’s also the range of services offered by cloud providers including artificial intelligence, machine learning and Internet of Things data processing.

“Insurers need to focus on their core business and value creation. Being experts in operating data centres is not part of that,” he said.

However, he said, this does come with a new set of risks.

“Namely, having your computer network attached to the internet,” he said.

Chisholm said that’s why regulators, such as APRA, have mandated prudential standards for all financial services institutions to manage internet and technology supply chain risks.

“APRA is well aware of the risks for institutions around customer data assets and has been promoting tripartite risk reviews with CPS 234. Most organisations are to complete the reviews by Sept 2022,” he said.