Freely subscribe to our NEWSLETTER

Today, Prudential Insurance and the other global heavyweights in the insurance industry use robust security strategies to protect sensitive data. Unfortunately, persistent threat actors will target certain companies and look for gaps in their security architecture until they find a weak spot and steal whatever they want like schoolyard bullies.

While details of last week’s Prudential attack are scant, it is highly likely that their identity system was compromised providing hackers with access to a treasure trove of personally identifiable information on employees, customers, business strategies and other sensitive information.

Organisations need to have an assumed breach mindset because threat actors will eventually breach most of their targets if they are persistent enough. Having a backup and recovery plan in place is an essential part of improving operational resiliency. And preparing in peacetime is the key. In cases of ransomware, if you find out about the attack because you have received a ransom note, it is too late. Mature IT organisations plan for, document, and rehearse scheduled systems maintenance; why wouldn’t you devote more effort to a widespread cyberattack? You cannot just pay your way out of ransomware and hope that the wolves will not circle back to you.

Securing identity systems is one of the most crucial components in an organisation’s risk management program. And when Active Directory and Entra ID, services within the identity system are compromised, the hackers have been given the keys to the kingdom and are free to siphon vast amounts of proprietary data.