The survey spotlighted several significant concerns, which are outlined below along with the implications for insurers and other financial institutions:

Budget: FS-ISAC members responding to the survey reported an increase in cybersecurity spending, with emerging technologies such as cloud, data analytics, and robotic process automation as top cybersecurity investment priorities. Access control, protective technology, and data security were emphasized as rationales.

Keeping up with transformation: For the last three years, respondents identified rapid IT changes and rising complexities as their top cybersecurity challenge. To help effectively mitigate emerging cyber risks, companies should consider digitally enabling the cyber function within the broader IT service development process. Adopting "security by design" principles during technology development could also help financial institutions create more secure products.

Governance: Cybersecurity is often included as part of the IT function, and CISOs typically report to the Chief Information Officer or Chief Technology Officer at their companies, according to most respondents from large financial institutions surveyed. This reflects the need for close integration of cybersecurity and IT. At the same time, insurers may want to retain a certain level of independence for cybersecurity, which could help ensure risk management decisions are not overshadowed by IT constraints.

Access control: With lines blurring among employees, customers, contractors, and partners/vendors in general, firms should consider implementing "zero trust" principles for access since the organization's perimeter is essentially gone. This means imposing verification requirements on all those looking to access a firm's data or systems from either inside or outside the company.

Adaptation: Finally, many companies will be under pressure to reduce expenses in a recovering economy. However, actions taken to reduce operational costs should be evaluated carefully for their cybersecurity implications. Companies should consider corrective measures to ensure that cost reduction initiatives do not expose them to additional cyber risks, such as insider threats.

Despite the added cybersecurity challenges posed by the pandemic, CISOs should not take their eyes off longer-term goals, which likely include aligning with the company's strategic priorities, managing talent challenges, and addressing external issues such as regulation. Such broad engagement can highlight the value cybersecurity adds to the business.

Special Reports /

Pandemic should prompt insurers to reexamine cybersecurity

Related Stories

Recommended For You