Security used to mean locking the doors when the last person left the office. But just as premises protection has evolved to include cameras and remote monitoring stations, encoded security badges, and biometric locks, network security has also changed. Basic firewall perimeter defenses, virtual private networks, digital certificates, directory services, and other technological means are designed to help insurers stay one step ahead of hackers, malicious users, and even cyberterrorists. In fact, as insurers extend business functionality to the Webproviding policy and billing information, quotation and application, and account managementthe need for robust network security technology has never been greater.

One of the most fundamental, yet problematic, areas of security for all businesses is perhaps the most basicauthenticating the user. In an anonymous electronic environment, and with both security and privacy concerns to consider, how can insurers be certain about the true identity of their Web site users?

The primary focus of e-commerce security right now is the actual communications path, says Jeff Carley, network security specialist and chief technology officer of Engedi Technologies, Inc. The Web server will authenticate the connection to the end user using a PKI [Public Key Infrastructure] certificate that the [insurer] will send using SSL [Secure Sockets Layer], which says, This really is XYZ Companys site, to the end user. Thats great, if you just want the consumer to be confident the information being sent is really sent to XYZ Company. But before it sends or receives information, the insurance company needs to be sure Im Jeff Carley before it divulges information to me. There needs to be authentication.