Insurers prefer outsourcing to equipment upgrades

To solve the problem of updating and expanding, as well as import substitution of their equipment fleet, large insurers have taken the path of using external cloud technologies. This allows serious savings and reduces the risks of supplying low-quality equipment as part of parallel imports. The Central Bank supports the approach and has even developed a corresponding bill that expands the capabilities of the financial sector to migrate to the cloud. But information security experts point out the risks of such a strategy.

As part of updating and import substitution of equipment, large insurance companies are beginning to increasingly use the services of third-party data centers instead of their own infrastructure, according to a Kommersant survey. Thus, Ingosstrakh is considering cloud technologies for quick MVPs (a minimally functional product that the company releases to the market). Rosgosstrakh began to analyze and consider the possibilities of transferring a number of services to Russian clouds on the principles of SaaS (cloud software delivery model). VSK transferred only GPU computing to the cloud (high-performance multi-threaded systems, see Kommersant on April 3).

The insurance company, one of the five largest, clarifies that it is considering cloud service providers using domestic equipment and can provide the regulator with certificates of components being included in the Ministry of Digital Development register.

Data processing centers (DPCs) confirm the growing demand for outsourcing solutions from insurers. “We regularly receive requests from representatives of large insurance companies,” says 3data PR Director Dmitry Prede. According to him, insurers want to receive various services from colocation (placement of equipment in data centers) to migration to cloud services in a “single window”.

According to experts and market participants, refusing to build your own data centers allows you to save money. Independent expert Andrey Barkhota notes that the costs of large insurers for direct import substitution can amount to up to 30% of the company’s annual operating income, while outsourcing is “a much more affordable option.”

In addition, for large market participants, purchasing equipment through tenders in the current realities carries risks. “The problem of parallel import is that we exist within the framework of law 223-FZ in terms of procurement,” explains Kommersant’s interlocutor at a top-10 insurance company. “Now any individual entrepreneur importing equipment can participate in the tender. Within the framework of the trading platform, we cannot reject a participant who provides a minimum financial offer. But we don’t know what they will bring; it could be refurbished equipment.” However, AlfaStrakhovanie and Rosgosstrakh clarify that, along with using cloud solutions, they purchase equipment themselves, including through parallel imports.

The Central Bank recognizes outsourcing of information technology and cloud services as “one of the possible import substitution options” for insurers. Banks currently have almost no such opportunity, since they work with bank secrecy and are classified as objects of critical information infrastructure (see Kommersant of October 16). At the same time, with the participation of the Bank of Russia, a bill has already been developed aimed at ensuring legal regulation of outsourcing of IT and cloud services when used by financial organizations, the Central Bank reported.

But this strategy also has disadvantages. According to SafeTech commercial director Daria Verestnikova, “when you do not manage the infrastructure yourself, there are always risks.” “Including through the data center itself or a neighbor on the rack,” adds Kommersant’s interlocutor from among the information security experts. At the same time, information security experts note that migration to the cloud is now safer than two or three years ago: “Protection against DDoS attacks is usually included in the basic tariff, and for an additional fee you can add protection against bot attacks or application-level attacks “

Yulia Poslavskaya