Tech Is Both An Enemy And An Ally

The tools include maintaining the physical security of IT resources, firewalls in various IT systems, data encryption, controlling access for particular users, and user authentication technologies, said the study. Other protective technologies include virtual private networks (VPNs increase security by controlling access and encrypting data), IT inventory controls, automatic log out and file deletion for PCs and mobile computers, and intrusion detection systems.

The study also notes that many failures in IT systems are not due to faulty or inadequate security technology, but to improper use of such technology. "Training employees, distributors and other individuals on their roles in maintaining secure IT systems and the penalties (e.g., dismissal) for failure to maintain these corporate policies is critical," says the study.

David ONeill, vice president, e-business solutions, at Zurich North America in Baltimore, agrees that foolproof security for computer systems does not exist. "I havent seen anyone thats told me theres an absolute guarantee and theyre gonna bet the ranch on it," he observes. "Theres no ultimate mousetrap as yet."

He also agrees that while security breaches can come from inside or outside an organization, exposures often come about as a result of inside events.

"Zurich got hit with Nimda [a virus]; the code doesnt lie," he notes. That happened because "someone went into a HTML e-mail application at Zurich." Such applications include Web-based e-mail systems like Yahoo!, Hotmail, and America Online, he says.

"We learned from our mistake," ONeill says. "Weve disabled HTML e-mail" within the company.

Another vulnerability may be the fact that a company uses an application service provider (ASP) to access certain software programs via the Internet, ONeill points out. "ASPs arent as careful with security as companies," he states, "but the client takes the earnings per share hit" when a breach occurs. "When we insure a company, we check the ASPs for security as well, and we underwrite them.

"Change is constant. Viruses are coming out daily. Vulnerabilities are found often. We want our clients to have security, intrusion detection, and guarantees from their ASPs," states ONeill.

Echoing those sentiments, the LOMA study concludes that "a well-designed data privacy, IT security, and disaster recovery program can lower the risk of a financial services organization incurring significant losses from these exposures."

Reproduced from National Underwriter Life & Health/Financial Services Edition, September 2, 2002. Copyright 2002 by The National Underwriter Company in the serial publication. All rights reserved.Copyright in this article as an independent work may be held by the author.