Cloud Security Challenges in Modernizing Insurance Operations with Multi-Tenant Architectures

Abstract

Modern enterprises have embarked upon a tide of application modernization to leverage the promise of agility and lower costs in modern, cloud-based and multi-tenant architectures. While some application migration efforts focus only on a lift-and-shift approach, others contemplate bigger changes to take advantage of drastically newer technologies both in core business logic, as well as in supporting systems such as underwriting, claims, policy systems, etc. In this context, security considerations must permeate all aspects of the architecture, including secrecy, authentication, access control, accountability and audits, correctness, availability, data integrity, encryption, and loss prevention, logging security, network security, packet filtering, risk assessment, key management, certificates, storage security, system configuration, disaster recovery, attack tools, crypto, virtualization, firewalls, IDS/IPS, and zapping. Further, based on the challenges of security for multi-tenant architectures and of cloud security, we enumerate and describe the specific security recommendations to take into account while architecting multi-tenant architectures and note the gaps that cloud vendors offer.

From the perspective of the stakeholder’s sweet spot, a multi-tenant architecture permits hosting entities to share devices, networks, and storage, gain economies of scale with lower costs, and efficiently service a large set of clients. Cloud offerings promise economies of scale as well as lower prices, allowing insurers to compete more effectively. Lower costs and speed of provisioning infrastructure allow smaller companies and start-ups to arise quickly and rapidly penetrate markets with innovative products. With a level playing field, insurers need differentiated product offerings to compete, enable innovation, and drive growth. At the same time, financial services are some of the most regulated industries, and insurers must be good stewards and protectors of their customers’ most personal and sensitive data. Insurance companies have long invested in security infrastructure to protect themselves. The migration to the cloud for lower costs must not come at the expense of reduced data protection.