Cyber Terrorism: Is the Insurance Industry Prepared?
A sampling of insurers in an exclusive survey by the Insurance Information Institute and Tech
Decisions indicates companies have beefed up their security after 9/11. Other security studies
also show theres cause for concern.
BY JOHN SPAGNUOLO

Cyber terrorism was a major concern of the IT world long before September 11, 2001. But the events of that day made companies more aware of their vulnerability to terrorism of all kinds. As firms continue to adopt and rely on more sophisticated technologies, their exposure to potential cyber attacks grows.

The Insurance Information Institute (III), in conjunction with Tech Decisions, conducted an exclusive survey of a sampling of insurance companies regarding cyber security and the insurance industry. Respondents represented carriers totaling nearly 25 percent of the property/casualty premiums written in the United States. The goal of this survey was to find out how 9/11 affected the way companies view the potential threat of cyber terrorism and what actions they have taken to protect themselves.

One hundred percent of respondents agreed the threat of cyber terrorism is real. When asked what area of their computer systems they were most concerned with, 57 percent cited their back-end systems. The remaining 43 percent were most worried about their Web site. Concerns about e-mail came in last, with no companies considering it the main focus of their worry.

When asked if they had added any security-related funding to their budgets for 2003, 63 percent of respondents answered yes, and two-thirds said their company had added new measures to safeguard their computer systems after 9/11. Commenting on these results, Robert Hartwig, chief economist at III, says, Increases in IT security expenditures in the insurance industry mirror increases in most other industries. Insurers were upgrading IT security infrastructures well before September 11th in response to the increased threat from malicious attacks.

Examples of measures taken include:
employee education;
increasing security protocol;
adding encryption hardware and software;
improving monitoring systems to detect intrusions; and
upgrading anti-virus programs and operating systems to latest versions.

Hartwig explains insurers are determined to keep ahead of the IT security curve because of their fiduciary responsibility to millions of policyholders and because not doing so eventually would make them more vulnerable to attackwhether from cyber terrorists or mischievous teenagers.

Measures Taken

Eighty-nine percent of respondents have implemented new measures regarding disaster preparedness as a result of 9/11, including:
integrating crisis management teams;
updating business-continuity plans;
adding back-up data centers;
conducting more frequent disaster-recovery testing;
focusing on the preparedness of business partners;
making more frequent risk assessments; and
conducting analyses of critical staffing, data, and equipment.

When asked if they had a staff person in the IT department assigned to security risk, all respondents answered yes. On average, 82 percent of these employees jobs are dedicated to this function. Seventy-eight percent said they did not rely on outside consultants for security.

While most companies consider themselves prepared for a major cyber attack, some commented that smaller insurance companies may not have as many resources as they do to contribute to cyber security.

Other Cyber Statistics

The chances of any company becoming a victim of a cyber attack are not small. According to CERT Coordination Center, a federally funded research and development center operated by Carnegie Mellon University that tracks Internet security problems, the number of incidents reported rose by 377 percent between 2000 and 2002, increasing from 21,756 to 82,094. An incident may involve one site or possibly thousands of sites. CERT also indicates the number of potential system vulnerabilities has in-creased by 379 percent, reaching a total of 4,129 in 2002. Possible effects of a cyber attack include denial of service, unauthorized use, loss/ misuse of data, and loss of public confidence regarding an organization.

The Computer Security In-stitute (CSI), in cooperation with the Computer Intrusion Squad
of the San Francisco Federal Bureau of Investigation (FBI), released the results of its 2002 Computer Crime and Security Survey. Respondents included 503 computer security practitioners in U.S. corporations, government agencies, financial institutions, medical institutions, and universities. According to CSI, the findings confirm the threat from computer crime and other information security breaches continues unabated and that the financial toll is mounting. Ninety percent of respondents (primarily large corporations and government agencies) detected computer security breaches within the last 12 months, and 80 percent acknowledged financial losses due to computer breaches. Forty-four percent (223 respondents) were willing and/or able to quantify their financial losses, reporting $455,848,000 in financial losses.

The population of intruders that pose a threat to a network grows each day. Todays intruders are different from those of 10 years ago. A hacker does not have to be a sophisticated programmer to be able to harm a computer system. Intruders now can use the Internet to educate themselves, and they have access to easy-to-use tools that allow them to do large amounts of damage in short periods of time. Intruders can be professional criminals, international terrorists, industrial spies, teenagers, and perhaps even an employee.

Financial institutions under Federal Trade Commission (FTC) jurisdiction currently are required to secure customer records and information. As part of the implementation of the Gramm-Leach- Bliley Act, the FTC has issued the Safeguards Rule that requires financial institutions to develop a written information security plan that describes their program to protect customer information. According to the FTC Web site, the plan must be appropriate to the financial institutions size and complexity, the nature and scope of its activities, and the sensitivity of the customer information it handles. Each financial institution must:
designate one or more employees to
coordinate the safeguards;
identify and assess the risks to customer information in each relevant area of the companys operation and evaluate the effectiveness of the current safeguards for controlling these risks;
design and implement a safeguards program and regularly monitor and test it;
select appropriate service providers and contract with them to implement safeguards; and
evaluate and adjust the program in light of relevant circumstances, including changes in the firms business arrangements or operations, or the results of testing and monitoring of safeguards.

Resources

CERT Coordination Centeran organization that responds to Internet security problems. Its staff members provide technical advice and coordinate responses to security compromises, identify trends in intruder activity, work with other security experts to identify solutions to security problems, and disseminate information to the broad community. It also analyzes product vulnerabilities, publishes technical documents, and presents training courses. (www.cert.org)

Computer Security Institute (CSI)an association of in-formation security professionals. It has thousands of members worldwide and provides a wide variety of information and education programs to assist practitioners in protecting the information assets of corporations and governmental organizations. (www.gocsi.gov)

Information Analysis and Infrastructure Protection (IAIP)a directorate of the Department of Homeland Security, which includes the former National Infrastructure Protection Center along with four other government entities. This effort brings representatives from U.S. government agencies, state and local governments, and the private sector together in a partnership to protect our nations critical infrastructures. (www.dhs.gov)

Insurance Information Institute (III)recognized by the media, governments, regulatory organizations, universities, and the public as a primary source of information, analysis, and referral concerning insurance. (www.insurance.info)

John Spagnuolo is director of new media at New York-based Insurance Information Institute.

CLAIMS TOOLS
Risk Managers, Brokers Assisted by Travelers e-CARMA Tool

Travelers introduced the latest enhancements to its risk management resource, e-CARMA, which will deliver 18 standard reports, as well as point-and-click report analysis that enables risk managers and brokers to select specific data such as location and accident-analysis codes to produce customized reports.

New to e-CARMAs standard report set are claims inventory, lost time summary and detail, loss stratification, and loss limitation reports that offer additional analytical tools to e-CARMA users. Risk managers and brokers can identify trends by using the Loss Analysis Drill Down, e-CARMAs data-mining feature that permits drill down by location and accident type.

Matthew Carden, vice president, risk management information services for Travelers, says, This latest evolution is further evidence of our commitment to the kind of customer-driven product development and service that enables Travelers insureds to quickly recognize and address key claim trends.

Also, e-CARMA offers report scheduling capability, automated claim alerts, and a relational database, as well as making the most current claims information instantly available. The scheduling function allows users to submit a report request once for the report to run automatically monthly, quarterly, or yearlyand notifies users by e-mail that their reports have been run and their information is viewable. Customer-set claims alerts immediately notify users of sudden and significant activity on new and existing claims. The e-CARMA relational database permits seamless customization to meet the customers specific needs.

Safeco Introduces Online Commercial Lines Tool

A new online resource available to commercial lines agents for Safeco can help agents calculate replacement costs and actual cash value for all types of commercial buildings. Called BVS- Commercial, the tool uses specific commercial property characteristics and localized material and labor costs to calculate building valuations. Agents can generate basic reports by completing five fields: ZIP code, occupancy, number of stories, gross floor area, and construction type. More detailed, customized valuations are also available.

Our new valuation tool provides Safeco agents with an excellent indication about insurance-to-value, but its
not intended to replace professional appraisals, says Mike Schack, the assistant director of automation for Safeco Business Insurance. Marshall & Swift/Boeckh developed the product to replace Safecos paper guide. The information can be accessed through the companys agents-only Web site.

The system includes drawings, diagrams, and definitions from a drop-down help menu. It can generate and print or e-mail detailed professional reports that show the breakdown of all construction materials and other data that impact the correct amount of coverage needed.

WHOS USING WHAT

West Bend Mutual Insurance Co. has selected Afni Insurance Services to develop an interface between IVANS Transformation Station and West Bends billing inquiry system. This will provide access to billing data for agency management systems. Afni also was selected by Progressive Insurance to connect the carriers billing information with Afnis CSR24 policyholder self-service module.

American Medical Security Group (AMSG), a health-benefits provider, has selected Zix Corp. to provide enterprisewide e-messaging protection services for AMSGs 570,000 members. In addition, Blue Cross and Blue Shield of Kansas selected Zix to help comply with HIPAA security guidelines.

UnumProvident has announced a partnership with Global IQX to use ConnectInsure, a Web-based quoting service that will allow insurance professionals to conduct online quotations and enrollment transactions. UnumProvident provides income-protection insurance through the ConnectInsure Web site.

RBC Liberty Insurance has reached an agreement with COSS Development Corp. in which COSS will develop and deploy desktop and Web-based point-of-sale technology solutions for RBCs Liberty Life Insurance and Liberty Insurance Services.

Protective Life Corporation and Union Central Life Insurance Co. have each licensed a custom data-integration solution from Innovative Systems, Inc., called i/Lytics SECURE. The solution will help the insurers comply with the mandates of the USA Patriot Act.

Great American Life Insurance Co. and AMS Services, Inc., have completed Great Americans insurance program for social services agencies and nonprofit organizations using PS4 Plus. AMS also has released a list of carriers that have adopted TransactNOW to support billing and claims inquiries. The list of carriers includes Chubb Group of Insurance Companies, Encompass Insurance, The Hartford Financial Services Group, Kemper Auto and Home, Progressive Insurance, Safeco Property and Casualty Insurance Companies, The St. Paul Companies, and Travelers Property Casualty.

Ohio Casualty Insurance Co. has begun rolling out inquiry functions using IVANS Transformation Station from the IVANS Insurance E-Commerce Solutions Division. The system works through three different agency management systems used by Ohio Casualty agents. Ohio Casualty also has installed Mitchell Internationals Web-based claims workflow solution for automobile physical damage claims.

AmFed Companies, a workers compensation provider, has chosen the Example Platform product suite from Duck Creek Technologies that will give AmFed the ability to build and maintain its own rating and issuance system.

Blue Cross & Blue Shield of Rhode Island has deployed the Simply Smart business process management software from Pegasystems to improve customer-service quality and to personalize customer interactions.

Equitable Life of Canada has signed a software licensing agreement with Whitehill Technologies, Inc., to use Whitehills Enterprise software to enhance the way system-generated policyholder documents are produced and distributed.

Safeco Insurance Corp. has reached an agreement with InsuranceNoodle to distribute Safecos small commercial insurance products to more than 3,600 independent commercial insurance agencies using the InsuranceNoodle platform.

Fortis Benefits Group has gone live with a multichannel intake and claims management system from FINEOS Corporation called FINEOS Disability Claims Manager, which will allow multiple people to view and work on claims at the same time.

Tryg, the largest insurance company in Denmark, has selected Computer Sciences Corporation to manage Trygs IT operations.

Guardian Insurance has signed a contract agreement with Patni Computer Systems in which Patni will supply Guardian with IT support for new life and annuity products, gap analysis, and IT systems installation.

First Insurance Co. of Hawaii, Ltd., is running live with PROMOS Technology, a personal auto real-time transaction-based system based on ACORD XML standards. PROMOS is a product from SpeedBuilder Systems.

Sage Life, a South African insurer, has signed a licensing agreement and implemented Amarta Life Fast Start, a product of Sherwood International.

Co-operative Insurance Companies has licensed the imaging and workflow solutions from AcroSoft for use in the insurers claims department.

Korean Re and China International Re have signed membership agreements with inreon to take part in the reinsurance industry online marketplace operated by inreon.

Unitrin Specialty Lines Insurance has signed a licensing agreement with Fiserv Advanced Insurance Solutions (AIS) to use the Fiserv AIS claims workstation for Unitrins nonstandard automobile, motorcycle, and personal watercraft insurance products.

Farmers Insurance Group has entered into agreements with Trumbull Services LLC. and Credit Collection Services (CCS). Farmers will use the Subrosource subrogation software from Trumbull. The CCS agreement provides Farmers with subrogation recovery services.

Columbia Insurance Group has selected Thazar to provide the insurer with enterprisewide business intelligence through its INSsight product.

The Phoenix Companies Inc. has licensed Product Profiler from Computer Sciences Corporation, the software companys first product definition software based on a new industry standard that integrates with annuity systems.

Kemper Auto and Home announced the certification of application service provider IBQ Systems for real-time XML rating of Kempers products through the IBQ SEMCI interface.

RISK MANAGEMENT
Tool Helps Hartford Customers Determine Accident Losses

There are more than just the obvious costs involved in a workplace accident, and a new cost-estimation tool, Losstimator, developed by The Hartford, helps insured companies track all expenses associated with accident claims. The obvious costs include medical expenses and salary for injured employees and repairing or re-placing any damaged property. But Brian Hayes, executive technical consultant at The Hartford Financial Services Group, estimates indirect costs account for the majority of an accidents costas much as four to 10 times the direct expenses.

Losstimator helps businesses understand the total cost of a workplace accidentincluding indirect expenses. The insurer introduced the tool at the Risk & Insurance Management Societys (RIMS) national conference in April. Businesses often overlook a variety of costs, especially indirect costs, when considering the total value of a workers compensation claim, says Hayes. Weve created the Losstimator to help quantify all the costs associated with a workplace accident so that they can be easily understood by financial professionals and used in determining the resources to put into safety and other loss-prevention programs.

Indirect costs of an accident can in-clude time spent investigating and reporting the accident, loss in productivity of co-workers who are distracted by the accident, or the need for additional training to help fill in for the injured worker. In these tough economic times, showing financial professionals exactly how much a workplace accident can ultimately cost makes it easier to justify the expense of accident prevention, says Hayes.

Flexibility is an important benefit of the Losstimator. Risk managers or business owners can adjust the modeled information, creating company-specific scenarios to meet their needs. Once the data is entered, the Losstimator will estimate either the cost of a single accident or an entire accident year. Depending on the users preference, cost calculations can be based on an estimated aggregate of accidents that occur in the industry or on actual costs from a specific incident at that company. Additionally, accidents are classified as low, medium, or high severity, allowing a variety of scenarios to be modeled. The Losstimator then estimates indirect costs, including those associated with the injured worker, co-workers, lost profit, property, and other general and administrative costs.

The Losstimator estimates indirect costs based on the number of worker hours lost. These include costs associated with the injured worker, co-workers, management, property, and general costs, such as lost profit from site closure and legal fees.

It is important to have a good loss-control program in place to help manage risk, says Hayes. The Losstimator can help quantify total costs and demonstrate the financial gains effective risk management programs can provide.

WEB SITE
Easy Access to Detailed Contract Info

Pacific Lifes annuity Web site has been enhanced to provide brokers, agents, and other registered representatives with detailed contract information. Pacific Life hopes the Web site will unburden representatives from unwieldy books

of business and allow them to target specific client groups. The new features are located in the contract management section of the annuity Web site at www.pacificlife.com.

Phil Teeter, vice president of technology for the annuities and mutual funds division of Pacific Life, believes the en-hancements will make doing business on the Web site easier and more time efficient. Financial professionals committed to providing superior service to their clients while expanding their business will find these upgrades invaluable, he says.

The Web site will allow sales reps to sort their variable annuity books by the date the contracts were issued. This allows the reps to identify which clients have become eligible to add optional features to their contracts. The scheduling tool also allows the representatives to plan any client communication in advance of the eligibility date.

Improved filtering features allow reps to search for variable contracts that contain multiple investment options, filter their contract list by the type of plan in which the client is invested (such as an IRA or a tax-sheltered annuity), find clients enrolled in automatic withdrawal programs, and track the status of exchange and transfer business.

Representatives also can go to the Web site to review and service contracts, access product information and performance statistics, download forms and sales tools, and obtain portfolio manager information.

UPDATE
Lloyds Platform Rolling Out Under New Name

Project Blue Mountain, the insurance operating platform developed by Lloyds, has found its first takers in the form of four London-based insurers and two international insurance brokers. In addition, when the product is rolled out later this year, it will do so under the brand name Kinnect. This will take place when the business begins live operations.

The insurers that signed letters of intent are ACE European Group, Amlin, Beazley, and Wellington. Marsh and Willis are the two brokers. Ashok Gupta, CEO of Project Blue Mountain, says, We will work closely with these six companies to help them implement more efficient processes and to fine-tune our own offering.
Project Blue Mountain/Kinnect is an international venture sponsored by Lloyds to enable commercial lines trading partners to communicate risk data electronically for quicker and higher-quality business completion, more productivity, and profitability by offering a secure business platform.

Business process is a long-standing problem for the global insurance industry, says Gupta. We believe we are part of the industry solution. Recent letters of intent reflect we now have a working platform able to deliver significant benefits in improving the effectiveness and efficiency of data transfer between established trading partners.

Special Reports /

News, insights, innovations.

Related Stories

Recommended For You