Protect your insurance agency website against cyber attacks
Cyber attacks are on the rise, so it’s no surprise that cyber insurance continues to be one of the fastest growing areas of the insurance industry. For insurance agencies, there are two sides to this coin, the opportunity for growth related to cyber insurance and the potential for a malicious cyberattack against your own agency’s website. How can you make your insurance agency website more secure and limit your exposure to a cyberattack or breach?
The basics
- Install SSL. This is a required step for all websites!
- Update your software frequently. This includes your operating environment, coding, theme, plugins, etc.
- Use complex passwords. All passwords for the access of all users to your website must be complex. It is often best to use the computer generated passwords provided by your system.
- Educate your users. Take the time to ensure that all employees and contractors understand cybersecurity best practices, including preventing phishing emails and other hacking emails.
- Use antimalware solutions. Invest in anti-malware solutions to perform continuous analysis and prevent malicious attacks.
Advanced
- Strengthen your server. Server hardening is a set of techniques used to improve the security of your server. For example, you should manage access to the server, minimize the external footprint (including hiding key files from public view), patch vulnerabilities, restrict administrator access, and minimize user access permissions.
- Using parameter queries to mitigate SQL injection attacks.
- Multi-factor authentication must be used for login security. MFA is a great addition to your security protocol, and authenticator apps like LastPass, Microsoft Authenticator, and Google Authenticator are easy to use. They reside on your smartphone and allow you to enter a 6-digit code to validate the secure login.
- Add a firewall. Most hosting environments offer a firewall option and you should take advantage of it. For example, most hosting organizations offer an optional firewall to help prevent hacking attempts. These are an inexpensive addition and should be standard. Note that you will need to change your DNS A record when you add a firewall.
- Protect yourself against XSS attacks. Cross-site scripting (XSS) attacks can inject malicious JavaScript into your insurance agency web pages, which can change browser page content or potentially steal information. The best defense is to limit how and what JavaScript is executed on the page. For example, your website may prohibit the execution of non-hosted scripts (do not allow inline JavaScript).
- Manually accept comments on the site. Do not allow comments to post automatically, this reduces spam and script attacks.
- Use captcha. Every form should have a captcha, and in case of cookie compliance captcha issues, create a required field that requires the user to decide something. For example, 5+4=___).
- encrypt data. If you are capturing information of any kind, or as a general security measure, encrypt your data while it is at rest.
Preventing cybersecurity breaches is important to both agency managers and clients. Make sure your insurance agency website is protected!