Hackers Keep On Trying To Breach Insurers Security

Why do hackers do what they do? Clauson played part of a 60 Minutes interview with alleged high-profile hacker Kevin Mitnick, who was said to have broken into the systems of more than 35 major corporations and other organizations, causing an estimated $300 million in damages. Mitnick, who was eventually caught and convicted, was recently released from prison. In the interview, he described his hacking activities as "a hobby."

Clauson said he had also sent two of his employees to the Defcon Hackers Conference in Las Vegas last July to gain information about activity in the hacker community. Among the 5,000 attendees, he noted, one-third to one-half were "white hats"–individuals like his colleagues who were there to learn.

The highest threats, he added, come from the "cracker/hackers"–people who are seeking to learn more about hacking and to prove themselves among the hacker community. "Their mission is to cause damage and to do it anonymously," said Clauson.

At the convention, participants would set up networks and try to defend them, while other participants tried to hack into them. "Our guys set up a network and got broken into," he admitted.

"Frankly," stated Clauson, "[the insurance industry] is pretty lacking in security. The best thing we can do is network together."

At Mutual of Omaha, Clauson said, the security plan involves prevention of attacks, detection of intrusions, response and, where necessary, recovery. A "crucial" part of the security plan is to establish a security policy, he added.

With the growing movement toward electronic signatures, insurers systems must also provide for authentication of the signer, authorization of the transaction and "non-repudiation," said Clauson. Biometrics–technology that uses biological characteristics such as fingerprints or retina scans to identify an individual–may play a part in signature validation.

The non-repudiation issue, Clauson explained, means being able to prove that a person did actually authorize the electronically signed document, especially if he or she later denies it.

According to Bill Oldenburg, co-presenter in the Information Security session, legislation is one of the primary drivers behind the move toward increased security in the industry. This includes the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act on financial security, he noted.

In addition, said Oldenburg, the e-business environment itself is fueling the need for security. "Even if youre not a major player, you have to have some e-business out there to survive," said Oldenburg, information services manager, I/S security control, for Mutual of Omaha. "You need a Web site and that brings up security issues."

When it comes to customers personal data, said Oldenburg, integrity (assurance that the data hasnt been changed since it was entered into the system, unless authorized), availability and confidentiality are critical. He stressed the importance of putting electronic communications policies in place in order to keep data safe.

Measuring the risk from outside attacks involves a combination of the value of assets, threats against those assets, and vulnerabilities to attack, Oldenburg explained. While this risk is mitigated by any safeguards a company puts in place, it can also change with changes in any of the components. "The risk dictates the precautions," he noted.

It is essentially an organizations business requirements that drive the need for security, said Oldenburg.

Reproduced from National Underwriter Life & Health/Financial Services Edition, September 17, 2001. Copyright 2001 by The National Underwriter Company in the serial publication. All rights reserved.Copyright in this article as an independent work may be held by the author.

Copyright 2001 by The National Underwriter Company. All rights reserved. Contact Webmaster