None

The Business Case for Improved Password Workflows within the Real-Time Environment

A Report of the ACT Real-Time Management Work Group

February 19, 2009

Executive Summary

The current disparity of carrier handling of passwords within the real-time environment is reducing the benefits of real-time workflows and is discouraging some agency employees from using Real Time. In this report, the ACT Real-Time Management Work Group makes the business case for changes in carrier and vendor password handling in the real-time environment based upon new password workflows that some carriers and vendors have already started to implement.

Real-time tools in the agency management system or comparative rater create several opportunities for agencies to handle passwords more securely and efficiently, provided the agency has implemented the proper user authentication and security controls in its systems, employee procedures, and physical perimeter. The report lists the many “Pros” of handling passwords in a real-time environment, but also outlines the current “Cons” which are adding inefficiency to real-time workflows and discouraging some agents from using Real Time.

The work group then makes several recommendations for improvement in the handling of passwords in the real-time workflow – most of which are currently being implemented by some carriers and vendors. The recommendations include:

Eliminating the requirement that the agent re-enter the password during real-time transactions
Using more complex, “non-expiring” passwords specifically for real-time transactions
Extending the time period for password changes to annually specifically for real-time transactions
Providing advance notice of needed password change
Implementing password synchronization so that the password can be updated within the workflow of the real-time request without the real-time transaction erroring out
Implementing similar password handling changes in those situations where the passwords associated with token exchanges expire
Creating a new real-time transaction that allows agency administrators to delete users with carriers and to receive a response back from the carrier confirming the deletion.

The work group presents carriers and vendors with several recommended options in recognition of their varying systems capabilities and security policies. As a result, agents are likely to experience differences in the options their carriers and vendors implement. The work group encourages each carrier and vendor to implement the set of recommendations that will provide their agents with the greatest improvement in their password handling, consistent with the carrier’s and vendor’s capabilities and policies.

Current Agency Environment

Real Time is a major advance in agency workflow that is increasingly being adopted by independent agencies and carriers because it represents a major advance in “ease of doing business” for both parties. However, the current disparity of carrier handling of passwords within the real-time environment is reducing the benefits of real-time workflows and is discouraging some agency employees from using Real Time.

In this report, the ACT Real-Time Management Work Group makes the business case for changes in carrier and vendor password handling of passwords in the real-time environment based upon new password workflows that some carriers and vendors have already started to implement.

The work group understands that carriers have different security policies and that each has to balance achieving agent ease of doing business with security needs. The work group, however, believes that its recommendations can create a “win-win” for carriers and agencies by both increasing agency ease of doing business and the security of agent-carrier transactions.

A necessary predicate to the work group’s recommendations is that the individual agency has implemented the proper user authentication and security controls in its own systems, employee procedures, and physical perimeter. In addition, the particular agency management system or comparative rater vendor needs to have implemented the proper user authentication and security controls in its system.

Industry requirements (such as the Payment Card Industry (PCI) Security Standards for credit card merchants) as well as state or federal privacy laws and regulations could limit the applicability of the work group’s recommendations with regard to some transactions. As is always the case, each organization will make an independent determination as to how such requirements will impact its business processes.

The work group understands that ACT and the industry are exploring digital identity technologies that could create single sign on for agents that would be trusted by multiple carriers for agent authentication. These digital identities are beyond the scope of this work group and report. We are focused on improvements in password handling that can be implemented today in the real-time environment.

Real-Time Workflow

Real Time is the ability for the agent to click on a button from a client file in the agency management system or comparative rater for immediate access to carrier information on that client. The transaction may be a quote, billing inquiry, claim inquiry/loss run, policy view, endorsement or a request for information. This approach provides a single workflow for agent servicing or quoting.

Real Time implementation is making great gains within independent agencies and is saving them significant time. A major agency survey conducted by the Real Time/Download Campaign in January, 2008 found that:

54% of agencies with agency management systems are now doing real-time inquiries
55% are doing real-time endorsements
43% are doing personal lines real-time rating through the agency management system or comparative rater
18% are doing commercial lines real-time rating through the agency management system or comparative rater
50% of the agencies using Real Time for personal lines are saving 31 minutes or more per day per employee and an additional 45% are saving up to 30 minutes per day per employee
26% of the agencies using Real Time for commercial lines are saving 31 minutes or more per day per employee and an additional 50% are saving up to 30 minutes per day per employee.

User ids and passwords for real-time transactions are maintained in the real-time tool in the agency management system. This information may be maintained by the individual user or the agency administrator, depending on the agency.

When a real-time transaction is performed, the user id and password are passed with the transaction to allow login to the carrier and a result is returned. This result could be a PDF or other document with the information, or the user is navigated directly to the appropriate screen on the carrier Web site to view the information or complete the transaction. Real Time tools also permit the agency to do a general login to the carrier Web site without the need to re-enter the user id and password.

The Pros & Cons of the Current Real Time Environment

Pros

Carriers know that the agency is the source of real-time transactions that flow from the agency’s management system and that employees performing these real-time transactions have already been authenticated by the agency management system.
The security aspects of real-time transactions have been worked out between the vendor and the particular carrier, and the password information is sent in an encrypted manner from the agency system to the carrier as part of the real-time transaction.
The agency is responsible for managing the users on its agency system who are performing the real-time transactions.
Real Time implementations provide the agency with the additional measure of control to store carrier password information in a manner that is accessible to only the agency administrator. Some agencies have begun to withhold access to carrier passwords to employees for security reasons, requiring them to use the real-time tool to access carrier Web sites. This restriction gives the agency a much higher confidence that when an employee leaves the agency, he or she will not be able to access carrier Web sites while the carriers are being contacted to turn off access.
Employee use of Real Time helps avoid the security risks that result when agency employees keep carrier Web sites open all day.
Real Time enables the agency to create “activities” in their system that track every real-time transaction that employees perform – again providing an invaluable agency management tool. Employees working directly on carrier Web sites may perform multiple transactions for different clients and forget to take the additional steps of documenting each one of these transactions in the agency management system so that the agency has an audit trail.

The first three “Pros” for real-time transactions listed above argue for carriers differentiating between the security risks posed by real-time transactions and transactions performed by agency employees directly on carrier Web sites. The work group believes that carriers should award real-time transactions coming from these approved vendor systems a higher degree of trust than direct Web site transactions and a different approach to the handling of passwords, provided the agency has implemented the proper user authentication and security controls in its own systems and processes as discussed in the “Current Agency Environment” section above.

Cons

Some carriers require the agent to re-enter the password during real-time transactions rather than relying on the password that is sent as part of the real-time transaction. Such prompts for additional entry of passwords eliminate a significant efficiency gained from using Real Time and discourage users from using the tool rather than going directly to the carrier Web site.
When an agency employee’s real-time password expires, the user must access the Web site of the carrier and reset the password by entering the user id, password, and new password. Then the user or agency administrator must access the real-time set up of the agency management system to update the password. Following this second step, the user goes back to the client screen and starts the real-time transaction over again from the start. This carrier Web site and real-time tool password update process can take the agent 5-10 minutes to accomplish before being able to start the real-time transaction again. If the agent is with a customer at the time, this delay creates a bad customer experience.
Given the inefficiency just described, when an agency employee’s real-time password expires, the employee frequently jumps to the carrier Web site to update the password and then to perform the transaction. The employee often forgets to update the password in the agency’s real-time tool causing the employee’s next attempt to perform a real-time transaction to error out as well, creating significant frustration in the employee’s mind about the efficiency of using Real Time. The level of the employee’s frustration and time loss increases even more when he or she forgets the updated password because of the multitude passwords he or she is dealing with and must request it from the carrier.
Given that the carriers’ password expiration policies vary widely, agency employees often face real-time transactions erroring out for particular carriers because their passwords have expired. In real-time quoting transactions, this might mean that the carrier is not considered for the particular risk. Agency employees often give up on Real Time when they continually face this obstacle and go back to doing the transactions on the carrier’s Web site. If the agency employee gives up on Real Time with a particular carrier, the carrier is at a disadvantage to other carriers whose real-time transactions are functioning smoothly and provide greater ease of doing business to the agent. In addition, the carrier loses the higher security protection that comes with real-time transactions as discussed in the Real Time Security “Pros” section above.
In the current real-time environment, agency employees may be motivated to keep lists of carrier passwords in an insecure manner (sticky notes, spreadsheets) in an effort to keep up with all of the different passwords and varying password expiration policies.
Carriers do not typically give agencies advance notice that their passwords need to be updated. Agents find out when their real-time transactions error out.
Agency administrators do not have an efficient way of using the agency’s real-time tool to send their carriers a message to delete a particular user because they have left the agency. Carrier policies for deleting users vary widely and agency administrators must handle each carrier individually, which is a highly time consuming task. The different carrier policies often create delays in accomplishing the deletion as well as uncertainty as to whether the deletion has occurred – both creating a security risk for the agency.

Work Group Recommendations for Improvement in the Handling of Passwords

The work group presents carriers and vendors with several recommended options in recognition of their varying systems capabilities and security policies. The work group encourages each carrier and vendor to implement the set of recommendations that will provide their agents with the greatest improvement in their password handling, consistent with the carrier’s and vendor’s capabilities and policies.

Carriers should eliminate the requirement that the agent re-enter the password during real-time transactions and instead rely on the password that is sent as part of the real-time transaction.
Several carriers have begun to use more complex, “non-expiring” passwords specifically for real-time transactions. While these passwords are “non-expiring,” the agency and carrier have other security controls in place to protect customer privacy. The most secure approach would be for these more complex passwords to be controlled by and known to only the agency administrator. This recommendation eliminates many of the real-time password management headaches for the agency, except the delete user problem.
If the carrier decides it must continue to expire passwords for real-time transactions, then the carrier should consider extending the time period for these password changes to annually.
The carrier should provide the agency user or administrator (based upon agency preference) with advance notice that the user’s password needs to be changed so that the password can be updated before real-time transactions start erroring out.
If the carrier’s real-time passwords must be changed periodically then the carrier and agency system vendor should implement password synchronization. Password synchronization enables the password to be updated within the workflow of the real-time request without the real-time transaction erroring out. The workflow for password synchronization is provided below.
If the carrier employs a non-expiring token exchange between the agent’s real-time tool and the carrier for real-time transactions, this approach eliminates many of the real-time password management headaches for the agency, except the delete user problem.
If the carrier employs a token exchange between the agent’s real-time tool and the carrier with an expiring password, then the work group recommends the same improvements as for other expiring passwords. (See Bullets 3-5 immediately above.) Token exchange synchronization enables the password to be updated within the workflow of the real-time request without the real-time transaction erroring out. The workflow for token exchange synchronization is provided below.
The work group recommends that the vendors work with the carriers to create a new real-time transaction that will permit the agency administrator to send a message to carriers to delete particular users and return a message from the carrier that the user has been deleted.

Workflow for Password Synchronization

Agency user runs a one-time setup in Real Time to synchronize the user code/password from the company with the agency management system.
This information is passed each time an inquiry, rating option, or other real-time transaction is performed.
When a password expires, the user receives a message after the inquiry or other real-time transaction is initiated.
The user is presented with a reset screen where the new user password is entered. Notes appear to assist in the correct format for that company or vendor (MVR vendor, etc.).
The user id and password are synchronized between the company and the agency management system.
The original real-time transaction request continues as originally requested and the user is able to provide the information to the client.

Workflow for Token Exchange Synchronization

Agency user runs a one-time setup in Real Time to pass a token to each individual user within the agency. This token is used each time to confirm the authenticity of the user for all transactions.
Some companies may have an expiring token, which would require that the token be reset with a new password.
When a password expires, the user receives a message after the inquiry or other real-time transaction is started.
The user is presented with a reset screen where the new user password is entered. Notes appear to assist in the correct format for that company or vendor (MVR vendor, etc.).
The new password is synchronized with the company and the token is updated in the agency management system.
The original real-time transaction request continues as originally requested and the user is able to provide the information to the client.