How To Protect Your Data From Being Hacked

Data Security and the Cloud

TABLE OF CONTENTS DATA SECURITY AND THE CLOUD EXECUTIVE SUMMARY PAGE 3 CHAPTER 1 CHAPTER 2 CHAPTER 3 CHAPTER 4 CHAPTER 5 PAGE 4 PAGE 5 PAGE 6 PAGE 8 PAGE 9 DATA SECURITY: HOW DOES THE TAKE ADVANTAGE OF PROVIDE THE BEST DATA SECURITY BEST TOO IMPORTANT TO IGNORE CLOUD KEEP MY DATA SAFE? DATA CENTRES DATA PROTECTION PRACTICES 2

EXECUTIVE SUMMARY Today, stories of major data breaches have dominated the media, from lost CDs containing 25 million child records from the HM Revenue & Customs to hackers accessing 77 million customer records, including credit card information, through the Sony PlayStation Network. In this era of Big Data, financial and personal information becomes a target with information sold to the highest bidder. Companies that fail to protect themselves lose money, customers and their reputation. For all industries, data security is a critical component of business strategy and health. You must consider data security if any of your employees are physically connected to the Internet or other public data networks, regardless of size and scope of operations. Utilising the cloud to integrate the latest security technology is one way to ensure your business receives high-level data protection. This ebook provides an overview of data security and best practices you can employ to keep your data safe. 3

CHAPTER 1 DATA SECURITY: TOO IMPORTANT TO IGNORE Data security refers to protective digital privacy measures that are applied to prevent unauthorised access to information assets such as computers, databases and websites. With the proliferation of digital data, it s a top concern and priority for businesses of all sizes, in all industries. Take into consideration these facts about data security: > > 87% of small businesses experienced a security breach last year 1 > > The average cost of the worst security breach for small organisations was between 35,000 and 65,000 2 > > 250,000 laptops are stolen in the UK each year 3 1 More Small Businesses Hit By Cyber Attacks. 23 April 2013. 2 Ibid. 3 Cloud Direct Blog. 19 November 2014. 4 Data Breach: Is Your Business at Risk? Commercial Risk Insurance. If a cyber attack or breach occurs at your business, consider the Data Protection Act and potential fines you could incur from the information commissioner (ICO). While financial loss can eventually be regained, loss of reputation and customer loyalty can be permanent. Four in 10 customers will consider leaving a company if their information is lost or stolen. 4 As a trusted advisor, your client relationships go beyond just risk management services you provide; your clients expect you to safeguard their personal information and privacy. You cannot afford to be unprotected. 4

CHAPTER 2 HOW DOES THE CLOUD KEEP MY DATA SAFE? At the most basic level, the cloud is a delivery mechanism for IT services over the Internet, allowing you to receive information technology such as applications, data and security as a service. Traditionally, many businesses, including insurance brokers, purchase hardware and software, and operate it themselves or with the help of an outside company. The cloud provides an alternative option, and represents a shift from the traditional way in which brokers view IT. More and more companies are running some or all of their critical business applications in the cloud, and enabling clients to connect with them online. In almost all cases, client data is just as safe or safer in the cloud than in inhouse agency systems. In fact, most data breaches involve on-premises data centre environments. So how does the cloud environment work? The cloud environment includes secure data centres that control computing operations. These remotely-accessed centres are home to the servers that host software and process, store and protect data. Data and applications remain centralised in the data centre facility while users operate in a virtual atmosphere through a wired or wireless Internet connection. With the cloud, there is no longer a need to store or back up data to removable media such as flash drives or CDs that can be lost or stolen. In an online environment, information can be accessed on a laptop, tablet computer or smartphone anytime, anywhere an Internet connection is available. Users have more access through more devices in more locations. This kind of 24/7 on-demand service is a central component and provides a significant advantage. 5

CHAPTER 3 TAKE ADVANTAGE OF DATA CENTERS Most insurance brokers do not have the resources, expertise, time or money to match what data centres provide. Besides providing data security, data centres themselves are physically secure sites, staffed 24/7 with additional monitoring through video surveillance. These strict security standards require levels of redundancy and other measures that cannot be duplicated in typical offices. In addition to the increased efficiencies and data protection that Applied TAMOnline delivers, we re becoming more productive with remote access to the system. STEPHEN VALE Branch Manager Cleddau Insurance Limited 6

When choosing a data centre option, be sure it measures up to these standards: > > 99.9% uptime > > Tier 3+ facility, as defined by the Uptime Institute > > AES-256 data-at-rest-encryption (DARE) > > 128-bit, bi-directional, packet-level encryption > > Regular auditing against SSAE16 SOC 2 standards > > Automatic antivirus and software updates > > Site redundancy for backup > > Built-in firewall and intrusion prevention system > > Nightly backups > > Automatic download of broker data Maintaining critical business information in a secure data centre provides an extra layer of data protection. In addition, your business benefits from implementing more efficient data management and data access processes. Often, with a cloud-based system, applications and supporting software update automatically, so your business continually runs the latest software versions without incurring delays or extra expenses that may be required for manual updates. 7

CHAPTER 4 PROVIDE THE BEST DATA PROTECTION For insurance brokers, one of your most valuable assets is your client data. When physical damage occurs affecting your business and clients in the area, you must respond. Servers and tapes can be damaged, but in the cloud, the data is safe and accessible. Consider data security as part of your business continuity plan. Any number of problems can compromise business data, from theft of sensitive customer information, to natural disasters and cyber attacks. Online solutions can assist in mitigating risks and keeping your business up and running should your business operations be interrupted. Physical and electronic security deliver data protection beyond what any individual company can offer, as well as providing minimal downtime due to scheduled upgrades. If your company s internal computers or offices become inaccessible, online solutions are readily available from any secure Internet connection. 8

CHAPTER 5 DATA SECURITY BEST PRACTICES There are a number of precautions you can take to ensure better data security. Your business cannot afford to take chances with security. If your company s data is lost, the cost to recover or recreate it can be insurmountable. When developing a data security plan, remember these best practices. > > Encrypt your data Encrypting data helps to prevent the accidental loss of sensitive or protected information, including data classified as Personally identifiable information (PII). A Secure Sockets Layer (SSL) certificate is also important to secure your site, encrypting the communication between the user and the website. For secure remote access, you should also set up a virtual private network (VPN) security measures to standardize security software across your business. > > Use network-based security hardware and software Use firewalls, gateway antivirus, intrusion detection devices, honey pots and monitoring to screen for denial-of-service (DoS) attacks, virus signatures, unauthorised intrusion, port scans, and other over the network attacks and attempts at security breaches. 9

> > Protect outbound data Transport Layer Security (TLS) email encryption should be used for outbound emails, especially when emailing sensitive information. Data loss prevention (DLP) is a strategy for making sure that end users do not send sensitive or critical information outside the corporate network. Consider creating a DLP strategy for your business. > > Secure your technology against viruses and malware It is important to run antivirus software on your computing assets, such as desktops, laptops and tablets. Programs can be run at regular intervals to scan for viruses. It s critical to continue to patch your operating systems and all third party software, as well as keep your antivirus software up to date. > > Vulnerability management Periodic vulnerability assessments evaluate the effectiveness of security control solutions. You should conduct periodic vulnerability assessments of critical systems, those systems exposed on the Internet, or as determined by legal, regulatory or compliance requirements. This includes running internal and external vulnerability scans often. > > Educate your users It is essential to create a culture of security and ensure all employees are aware of the data security plan. Encourage them to create strong passwords that are frequently changed. Staff should remember to always lock or log out of the system when away from their computer and be careful when selecting unauthorised Wi-Fi networks. Data security should be a part of every business strategy and technology program. By following these best practices, you are taking steps to safeguard your data and your business reputation. Learn more about the cloud and data security and discover how Applied can be your data security partner. 10

CONTRIBUTORS This ebook was prepared by Applied Systems, Inc. About Applied Systems Applied Systems is a leading provider of software that powers the business of insurance. Applied is recognized as a pioneer in agency and brokerage management systems and data exchange between agencies, brokers, carriers and their clients. Automating the insurance lifecycle for more than 140,000 insurance professionals, 12,000 agencies and brokerages, and 350 carriers worldwide, Applied enables millions of people around the world to safeguard and protect what matters most. 2015 Applied Systems, Inc. All rights reserved. This document is provided for information purposes only. It is intended to give timely, but general, information on the subject matter covered herein, and the contents of this document are subject to change without notice. Prior results and case studies mentioned in this document do not guarantee a similar outcome on any particular situation in the future. You should consult with an attorney or other professional service provider with respect to how the matters discussed herein affect and relate to your own business affairs. This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether express or implied. Applied Systems and its affiliates specifically disclaim any liability with respect to this document and no contractual obligations are formed either directly or indirectly by this document. Any statements made herein are not a commitment to deliver any material, code or functionality, and should not be relied upon in making purchasing decisions, except as provided for in a separate software license agreement. The development, release, timing and availability of any products, features or functionality described herein remain at the sole discretion of Applied Systems and its affiliates. All other names of products and published works identified herein may be the trademarks or otherwise proprietary material of their respective owner. Applied Systems UK Invicta House Trafalgar Place Brighton BN1 4FR For more information visit appliedsystems.co.uk 11