ACE Cites Increased Risks in Outsourcing IT Systems

ACE European Group Limited has issued a warning to organizations who outsource their IT systems, which indicates they “are increasing their potential vulnerability to security breaches causing possible long term damage to their business.”

The bulletin said: “ACE has uncovered a lack of awareness amongst many European businesses of the increasing risks which outsourcing poses to their networks. ACE is also aware that there is a degree of uncertainty among many businesses, both as to the level of protection given to their computer systems and the cover provided by their existing insurance policies.”

Shaun Cooper, ACE’s senior network risk underwriter, commented: “Outsourcing presents an additional challenge to the security of IT systems. Outsourcing systems does not mean outsourcing the responsibilities for maintaining security. Businesses are not only dealing with their own employees but with those of a third party, often in another country.

“While technology, such as firewalls and anti-virus software, is part of the solution, technology alone cannot guarantee network security, particularly in an outsourced environment,” he continued, “businesses must look to alternatives, including transferring the risks to insurers, in order to reduce the impact of technology failure, human error or criminal activity.”

ACE cited a survey, which it sponsored, by the Economist Intelligence Unit, which “revealed that more than half of the European companies polled had suffered significant financial damage as a result of IT system failure, including damage or misuse of systems, by staff or contractors, during the previous twelve months.” According to ACE, outsourcing computer operations increases still further the risk of security breaches “as responsibility for the protection of the system cannot be outsourced in the same way.”

The bulletin also pointed to a press release from the National Outsourcing Association (NOA) “responding to allegations that staff in an Indian call center had sold data on UK financial services customers. While the NOA said it was unaware of any trends in security flaws in this type of outsourcing practice, it did point out that security should be of concern to any company and that they must ensure that offshore operations are managed particularly carefully.”

ACE said its “Dataguard Outsourcing Insurance has been specifically designed for companies which outsource their IT systems. It aims to fill the insurance ‘gap,’ offering comprehensive protection against financial loss arising from malicious or accidental incidents to computer networks and telecommunications systems.”

“The success and even survival of many businesses today rests squarely on the security and reliability of their technology systems,” Cooper stressed. “Recent problems at outsourced locations only highlight the need for businesses to take a new approach to IT security, an approach combining both physical and technology security tools with specialized insurance solutions.”