Prudential turns to AI to secure computer networks

over 5 years ago by Lucy Cinder

Prudential turns to AI to secure computer networks against cyber attacks

Prudential, the UK’s largest listed insurer, is turning to artificial intelligence to protect its computer networks in the US, Asia and Africa from malware hackers and internal threats

Financial services group Prudential is setting up security operations centres in Asia and the US that will allow it to monitor potential security threats on more than 100,000 devices on its networks.

The company, the UK’s largest listed insurer, is rolling out artificial intelligence (AI) driven software that can identify unusual activity on its computer networks and automatically isolate hacking or malware attacks across its IT networks in more than 14 countries.

The project will allow security analysts in two operations centres in Asia and the US to respond to potential hacking, malware or insider threats around the clock.

Prudential plc, a life insurance and financial services company with annual revenues of $94bn in 2019, plans to deploy technology developed by Darktrace, a Cambridge University spin-off, across Asia and Africa before the end of the year.

The company, which demerged from its UK M&G insurance operations in October 2019, is focusing on developing its business in Asia – which accounts for more than half its profits – and the US.

Tony Reed, assistant vice-president for cyber security delivery and incident response at Prudential plc, said the project will give Prudential’s security analysts a picture of threats across the company’s entire computer networks for the first time.

Reed said that Darktrace’s self-learning software, known as “the enterprise immune system”, will reduce the time security analysts have to spend trying to interpret unusual events on the network by half.

The software has proved itself in Prudential’s US operation, Jackson National Life Insurance, which manages assets of $260bn, over the past five years.

“We are able to react faster because we are finding things faster. We are saving a tonne of analyst time,” Reed said in an interview with Computer Weekly. “Something that would normally take an analyst anything from an hour to two hours to dig into is instantaneous.”

When Reed joined Jackson from HP in 2015, Jackson’s chief information security officer, Guillermo Guerra, tasked him with the job of bringing the company’s security levels up to the level of maturity expected of a large financial institution.

“Even back then, the attacks were getting harder to find. They were attacking faster than you could keep up with. So we needed a tool where we would not be relying on the human element,” he said.

It was difficult for security analysts to track what systems Jackson’s clients were logging into, what devices were talking to each other, and what data was coming in and out of the company, said Reed, but Darktrace’s software offered a solution.

“Having the ability to monitor the entire network 24 hours a day, and actions taking place without an analyst having to go in and do research and spend a couple hours on it, made the choice pretty easy,” he said.

Jackson’s IT team installed network probes and software to monitor 35,000 devices on the company’s internal networks with assistance from Darktrace’s engineers.

Active back-ups

One of the complicating factors was that the insurance company used two ‘active-active’ datacentres to keep simultaneous back-ups of its critical data.

It took time for Darktrace to learn which devices in one datacentre should be talking to which corresponding devices in the second datacentre.

The software, said Reed, more than covers the cost of its annual subscription by cutting the time it takes the company’s 14 security analysts to investigate incidents.

“Even if I had doubled the staff, I wouldn’t be confident that we would see everything and stop everything that we’re doing today. Humans just can’t learn that quickly,” he said. “So it pays for itself every year just in that.”

Even five years ago, a data breach could have cost the company millions of dollars in repair costs, providing crediting monitoring to its 700,000 clients and working with regulators.

“Switching from a perimeter defence model to an AI model was the biggest [and quickest] way we saw to eliminate or reduce the risk of having a security event,” he said.

Learning on the job

In January 2019, Prudential’s US business introduced Darktrace’s Antigena software, which is able to identify potential security threats and cut them off within seconds of detecting them.

The software works by learning how the company’s network and staff normally operate so that it can identify unusual behaviour that might indicate malware or an insider attack from someone who is able to access computer systems within the organisation’s firewall.

Reed is using the software to detect email threats which he estimates account for over 90% of attacks directed against companies. For example, if the Antigena software spots large files of data being sent out of the company, it can intervene to prevent it.

The software is faster, said Reed, than having to submit a ticket to a network specialist, by which time it may be too late.

So far, the insurance company has not experienced any major external attacks. But it has been able to stop an internal incident that could have led to customer data leaving the company and might have required the company to pay for credit monitoring services for the clients affected.

Once Darktrace software is running in Asia and Africa, Reed plans to introduce a “follow the sun” programme to monitor the security of the company’s networks worldwide.

This will replace the current model which requires Jackson’s security analysts to work 12-hour shifts in both the US and Malaysia.

This shift-work system is not ideal, as very little activity takes place on the US or Asian networks after business hours, said Reed.

“It is super quiet [at night]. So a lot of times we’ll tell them ‘Go look at this alert’ or ‘Take this training’ if nothing happens,” he said.

In the future, security analysts in the US will monitor the company’s network traffic across all locations during the day US time, before handing over to a security operations centre in Malaysia.

Darktrace’s software is used by 3,000 organisations including BT, First Great Western, Metro Bank, Ocado, TSB and William Hill. The company signed a partnership deal with McLaren Racing in February.

source computerweekly

Industry: Cyber Security