The insurance industry is continuing to leverage Web technologies to drive business in several ways:

• Reach new markets through social media and price shopping applications
• Enhance customer experiences through Web claims and multifunction mobile applications
• Increase process efficiencies on backend systems allowing customers to input information updates, policy changes and more.

The speed of this new business technology is not without risk and is drawing the attention of cyber criminals. There is no need to repeat headlines reporting data breaches; the risks we all face are well known.  What is not well known is what to do about it.

As motivations for cyber intrusion move from "script kiddies" to organized crime, so have the targets moved further into our systems. When once we protected networks, today we protect data.  The key to getting to that data is primarily though the applications themselves. Application security still remains a tactical matter rather than a strategic concern.  Studies have shown that 80 percent of Internet vulnerabilities are found in Web applications, and 49 percent of Web applications contain vulnerabilities of a high risk level—most of which are due to misconfigurations or programming errors. 

There is a common misconception that having an updated firewall and anti-virus software is enough protection. Although a firewall will stop bad traffic from coming into the network, today's threats are far more sophisticated and imbed the attack to flow within the rules of the firewall. Much of today's malware gets into a network through the front door on portable storage, such as a thumb drive, or when syncing a mobile device, thus circumventing the firewall. This malware will often "phone home" to connect back to a command and control server to attach itself to a botnet. Such traffic originates inside the network so the firewall allows it. Conversely, without a firewall, a network would literally be compromised in a matter of seconds, so they are required—but they're not enough.