UK insurers leaving holes in cyber defences as remote working takes hold, survey finds

Only half of UK insurance companies have carried out a cyber risk assessment since home working took hold in the pandemic, with 44% admitting they have inadequate cyber threat visibility and detection systems to protect employees operating remotely, according to a new survey by cloud service protection experts Doherty Associates. The survey also found that 25% of UK insurance firms cannot guarantee security on every device used out of the office, despite the fact that one in five said a major cyber or data breach could cost their business anywhere from £10m to £50m or more. The report detailing the survey results – ‘Who Moved My Moat? The cyber security risks of home and hybrid working – what finance and law firms need to know’ – considers the cyber and data security practices of 750 UK insurance firms and underwriters, as well as 500 employees, since the start of the pandemic. A third of firms feel their IT environment is more vulnerable to a cyber or data breach with employees working outside the office, yet 58% expect the hybrid office to stay. “Unfortunately, attacks are common in the insurance and underwriting sector, particularly in this current climate of remote working, and the difference between how many firms are detecting breaches compared to the reality of them occurring does suggest that firms need better cyber defence postures that give greater visibility and detection to keep their remote workforce safe,” commented Doherty Associates’ CEO Terry Doherty. The report reveals that 52% of the insurance firms and underwriters polled have yet to experience a cyberattack or data breach since transitioning to remote working in March 2020’s UK lockdown. A quarter of employees, however, said they have been the victim of a data breach or caused one themselves since working remotely. Doherty Associates says this suggests that employees are not reporting all incidents. One in seven employees have experienced a phishing attack or similar cyberattack and 46% admitted to emailing confidential client information or unencrypted attachments. A third of employees in the insurance and underwriters sector surveyed said they’ve had no cyber awareness training since the first lockdown. More than two thirds admitted to ignoring virus security scan requests or computer update alerts to safeguard their company’s systems and sensitive data. Some 82% confessed to using a combination of work and personal devices when working from home, with 53% admitting to saving confidential corporate information to personal devices. Only 13% of firms have put a block on personal devices for work use. “Operating a remote workforce in the cloud has many benefits, including greater flexibility, diversity and lower overheads, but it’s critical to ensure that teams continue to operate safely, securely and are fully compliant with FCA and GDPR regulations wherever they are working from. With the government’s roadmap out of lockdown underway, employers are starting to plan for when restrictions ease, with many reporting that hybrid working is here to stay. With employees working outside of the office, using a blend of personal and company devices, firms no longer have a single ‘front door’ to protect but a multitude of entry points to secure against cybercriminals. This is why it’s critical for firms to have excellent cyber hygiene,” said Mr Doherty. He advised companies to carry out a cyber risk assessment at least every six months, which includes penetration-testing to uncover any critical vulnerabilities or compliance issues. “They should also ensure that all devices have multi-factor authentication, so employees keep their identity secure while working remotely. And they should build in comprehensive cyber awareness training for every employee, especially if they’re working outside of the office for the first time. Restrict use of personal devices and ensure that no company information is shared via personal cloud storage platforms, where documents can easily be forgotten and just as easily hacked,” Mr Doherty added.

UK insurers leaving holes in cyber defences as remote working takes hold, survey finds

Want to read this article?

Read Next

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Want to read this article?

Read Next

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Related Articles