Tag Archives: security

Posted on

Consortium Works on Password Solution

Google, PayPal, Equifax, VeriSign, Verizon, CA, and Booz Allen Hamilton have formed a nonprofit company to oversee the development and exchange of online identity credentials on Web sites as a way to help with the user ID and password problems we all face.

The goal of the Open Identity Exchange (OIX) is to create a “trust framework” and certification program that lets organizations and individuals exchange digital credentials and know what identity, security, and privacy assertions are behind them. In addition to the single sign-on convenience, the credentials could be compelling because they let people be authenticated without being identified.

Separately, Microsoft is also working on creating a better way to implement online IDs. These initiatives are helpful and timely, because the current method of identifying individuals through IDs and passwords needs to change. It is too complex to manage—and when complexity increases, security decreases.

Posted on

Protect Client Data

On September 1, 2009, Portland insurance agent Robert Spruill of Brooke Auto Insurance consented to a Cease and Desist order from the Oregon Department of Insurance. Spruill had not properly disposed of business records that contained sensitive client information.

According to the order, “On or before April 28, 2009, Spruill discarded over 1,000 insurance business records and/or other documents related to insurance transactions of Brooke Auto and Brooke Corporation into an unlocked garbage dumpster.”

“At the time he discarded the documents, Spruill had not developed reasonable safeguards to protect the security, confidentiality, and integrity of the personal information or data collected or acquired in the course of conducting his business, including disposal of that data.”

In his defense Spruill said that when he inquired of local police and the state of Oregon insurance division back in the fall of 2008, no one told him that discarding these records was wrong. Spruill was hit with an $11,000 fine. Fortunately for Spruill, $8,500 of that fine was suspended as long as he complied with the requirement of creating and implementing a client security policy for his agency.

It may seem obvious that you should never discard unshredded documents into an open and unlocked dumpster at the back of your office. Still, don’t be too smug. Do your producers have unencrypted laptops that are left in locked cars that could be stolen? Could employees take home files with sensitive client information in them even though doing so is against company policy?

Information is the most radioactive element in today’s agencies. If leaked, it can cause serious repercussions to an agency’s reputation and brand, loss of revenues, loss of customers, regulatory or legal action, and damage to employee relationships. In the last 10 years, the need for information security to be integrated into the overall risk management of every organization across the globe has increased tremendously.

The insurance industry deals with sensitive and personal client information. Client records contain data that include financial information, medical histories, birth dates, driver’s license numbers, and Social Security numbers. Such confidential data has to be protected at all times—during storage, access, and transmission—or the organization risks serious losses.

More than 88% of all data breach cases involve employee negligence. In 2008, data breach incidents cost U.S. companies $202 per compromised customer record. These costs include civil and regulatory penalties, administrative expenses, legal liability, defense costs, and cost of future business due to loss of customer confidence. Not only that, according to Factiva, a Dow Jones company, media coverage of companies that suffered an information security breach accounted for more than half the stories written about those companies.

Seventy percent of customers state they would consider moving their business if they became victims of a data breach. Clients today expect strong security practices from all companies they do business with. The way a business copes with these expectations decides whether the company survives or not.

Client data security should be a concern for every agency, regardless of size. Check out The Anderson Report on Client Data Security for some tools to help you start or enhance your security process

Posted on

Agency Computer System Security Deters Thieves

I received this story from a college student and wanted to pass it along.

“A week ago, an insurance agency office was burglarized and it appears that the burglars were looking only for personal data. They stole computer monitors, but left the CPUs and hard drives. But in the neighboring attorney’s office, they stole the computers. Reason: The lawyers had not secured their data but the agency had a super tight security system… difficult passwords, high-end encryption, the works. Their security guy said that the burglars tried to get into the system, but failed on every attempt because of the security system.

“The moral of the story: The agency dodged the bullet. They didn’t lose any client data, so they don’t have the time and expense (and loss of reputation) involved in telling their clients of a breach. The lawyers, on the other hand, are in the soup.

“It’s scary to think that people are now breaking in to only steal data. Equally scary to think that there are hundreds of agency computers, servers, flash drives, and laptops out there with little or no security. I know it’s been written about, but agents need to be reminded of the serious penalties for not dealing correctly with a data loss (in Michigan, it’s up to $750,000). Also, since this is a problem for our customers as well as agencies, we need to be selling insurance to protect against the consequences.”

Posted on

New ACT Webinar

Protecting Independent Agent Clients with Secure Email Using TLS (Transport Layer Security)

Protecting clients’ and prospects’ personal information is becoming an increasingly important issue. Most insurance agencies do not currently take any steps to protect or encrypt information that they send by email to a third party. Unsecured email and attachments are like sending an open postcard through the mail. State privacy, security, and data breach laws are increasingly requiring that email transmissions, including sensitive consumer information, be encrypted.

The Agents Council for Technology (ACT) recommends independent agents and carriers implement TLS email encryption wherever possible to protect the sensitive client information being emailed between agents and carriers and even agents and major clients, such as commercial lines applications. TLS is available on most up-to-date in-house email servers (such as Microsoft Exchange and Lotus Notes).

ACT has developed a new webinar to encourage agencies to implement secure email and to use TLS to do so. The first 30 minutes of this webinar is designed for agency business leaders and the second 30 minutes will get into a more technical discussion regarding implementation of TLS on Microsoft Exchange servers. The webinar will take place on Tuesday, June 23 at 1:30-2:30 PM EDT. It will be presented by Jim Rogers, Director of Distribution Technology, The Hartford and Tim Woodcock, President, Courtesy Computers.

There is no charge for agents or others to attend these webinars. After you log on to the Internet session, you will be able to listen to the audio through your computer headset or speakers. If you would prefer, you will also be provided with a toll number you can call to listen to the audio.

Register for the June 23 session of the webinar (1:30-2:30 PM Eastern time) now.  After registering you will receive a confirmation email containing information about joining the webinar.

Posted on

Encrypting Personal Data

The state of Massachusetts has passed a new law that goes into effect May 1, 2009, that requires businesses that “own, license, store, or maintain personal information” on customers to encrypt that data, especially on portable devices such as laptops. That responsibility is extended from the primary business to contractors, such as telemarketing firms, and it extends to transmissions on wireless devices such as BlackBerries.

This law is more comprehensive than most other laws currently on the books. The law takes the view that companies have wide leeway to collect data—such as Social Security numbers, driver’s licenses and financial account numbers—as long as they don’t cause overt harm to the consumers. The Massachusetts law is reflective of European law, which places more restrictions on data collection. The legislation is similar to HIPAA rules that govern the way medical information is protected. The Massachusetts law extends its encryption mandate to portable devices including flash drives, CDs, and cell phones. The problem is that encryption technology is not available for all of these devices.

Even businesses that have no facilities or personnel in Massachusetts should anticipate being subject to this new regulation if they maintain any personal information on a Massachusetts resident.

Firms that operate in the state, or with businesses in the state, are now required to designate an employee to maintain a security program. That worker must identify all paper and electronic records that contain personal information, and the devices that house that data. The security program has to include processes for granting and withdrawing employee access to sensitive information, developing authentication processes, assigning passwords, maintaining firewalls and malware protections, training employees, and creating discipline procedures for employees who violated the security rules.

Nevada also has a law that took effect January 1 that requires encryption of any personal information that leaves the computers of the original collector and passes electronically to another entity. But that law does not address laptops and portable devices.