Insurers are in the clouds – Newspaper Kommersant No. 56 (7501) dated 04/03/2023

A number of insurance companies (ICs) are moving to cloud-based data solutions, which helps reduce costs and accelerate business scaling. The Central Bank, for its part, promises to facilitate the transfer of business to the cloud. But experts warn of the risks of data breaches, the number of which is constantly growing in Russia.

Renaissance Insurance (included in the top 20) announced the transfer of work with data to Yandex Cloud. “We are transferring our entire infrastructure to the cloud, which includes various information systems and client services,” explained Ilya Frenklakh, vice president of Renaissance Insurance. It is planned to transfer data processing to the cloud by 2024. This is not the first example among insurers: at the beginning of 2022, IC Yugoria completely transferred its infrastructure to the cloud.

ICs in the cloud can store client files, CRM databases, up-to-date statistics and models, explains Andrey Barkhota, an independent expert. According to him, savings from transferring data from a corporate server to the cloud can be 15-35% of the cost of maintaining the data storage infrastructure. For large insurers, this is tens of millions of rubles a year, says Mr. Barkhota.

Andrey Yazykov, First Deputy General Director of IC Yugoria, notes that cloud technologies allow companies to quickly scale up as their business grows. This allows you to speed up the work of the site, applications and services, which can make interaction with customers more convenient, adds Olga Basova, senior director for ratings of insurance and investment companies at Expert RA.

However, most large companies are in no hurry to move to cloud infrastructures.

So, SOGAZ told Kommersant that this was due to the information security policy and compliance with the law on the processing of personal data, including special categories. RESO-Garantia does not plan to move data to the cloud. VSK considers it possible to transfer only GPU computing to the cloud. Soglasiya, Rosgosstrakh, AlfaStrakhovanie declined to comment. In “Ingosstrakh” and “Energogarant” did not respond to requests from Kommersant.

Using clouds can be risky, experts confirm. When storing and transferring data in the clouds, certain threats can arise, in particular, misconfiguration and untimely change control, lack of a cloud security strategy, weak identity, key and access management, explains Anton Velizhaninov, Senior Information Security Engineer at Jet Infosystems. RTM Group CEO Evgeny Tsarev believes that transferring entire services to third-party providers is dangerous and “fraught with consequences.”

At the same time, providers are not responsible for incidents. According to Mr. Tsarev, this moment is not defined by law. “Obviously, in most cases, a cloud service provider will not want to be bound by the obligations to process personal data,” explains Viktor Rykov, a lawyer for KA Pen & Paper. “His service is to provide sufficient storage capacity.”

The task and responsibility of a cloud provider is to help users find a suitable profile for using the platform and teach them how to use the tools in the best way, says Alexander Chernikov, commercial director of the Yandex Cloud cloud platform. “At the same time, fighting the transition to the clouds is like fighting progress,” notes Danila Chezhin, Product Director at Servicepipe. “The process cannot be stopped, it is important to make it safe.”

The Central Bank intends to soften restrictions on the use of clouds. The regulator is working to create legal conditions for IT outsourcing and the use of cloud services by financial organizations, they assured. It is planned, explained in the Central Bank, in particular, to remove legal restrictions on the mode of processing certain information.

Julia Poslavskaya