Platform Automation for Insurance
The insurance portal ran for 7 years without interruption. TLS 1.1 was still active. Application Pools shared one service account. That wasn't negligence, that was the default IIS configuration. Windows environments in insurance companies are rarely misconfigured intentionally. They are exactly as IIS ships, and they stay that way as long as nothing breaks.
What insurance IT actually looks like
Insurance companies typically run a dense Windows Server landscape: broker portals for distribution partners, claims management systems, customer self-service portals, and document management solutions. IIS is the standard web server, not because it was explicitly evaluated and selected, but because it ships with Windows Server and it works.
The operating model is characteristic of the industry: a small team manages dozens of servers. Configuration is manual, starting from the first server that worked at some point and then copied. Hardening never happens because everything runs and nobody has time to touch what shows no errors. Years later, that baseline is what a NIS2 auditor walks into.
Some insurers also run JBoss EAP or other Java middleware stacks for core calculations and product catalogs. These have their own complexity, but the primary audit surface begins at the IIS frontend, because that is the publicly reachable attack surface.
Windows Server / IIS, distribution partner access, rate calculators, application workflows
Internal application, often older IIS version, high data protection scope
Customer-facing, TLS configuration publicly verifiable, possible PCI-DSS scope
DMS systems, App Pool isolation relevant, access control under audit pressure
What PCI-DSS, NIS2 and ISO find in insurance IT
These findings appear regularly in insurance company audits. None of them result from an attack or an operator mistake. They are the default configuration that nobody changed.
TLS Configuration
TLS 1.0 and 1.1 still active. No browser fails. No error appears. But PCI-DSS 4.0 requires TLS 1.2 as a minimum. It is a registry key under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL that was never explicitly set to Disabled.
Security Header Vacuum
IIS delivers no security headers. X-Frame-Options is missing. HSTS is missing. Content-Security-Policy is missing. This is not an administration error, it is the IIS installation default. All headers must be explicitly set via web.config or IIS Manager. They rarely are.
App Pool Sprawl
20 Application Pools, one service account. PCI-DSS requires isolation: each application needs its own account identity. In a sprawl environment, one compromised application directory has access to everything running under the same account.
Request Filtering
HTTP methods TRACE and DEBUG are active. Request Filtering is not configured. Not because anyone left it intentionally, but because it never needed to be configured. For auditors it is a standalone finding: missing restriction to necessary HTTP methods.
Which requirements apply to insurers
NIS2 Directive
Insurers fall under NIS2 as essential entities. Article 21 requires technical security measures, incident reporting within 24 hours for significant incidents, and demonstrable incident response capabilities. Technical measures must be documented and verifiable.
ISO 27001 Annex A
Technical security controls, access control, configuration management: Annex A provides concrete control objectives directly applicable to Windows Server and IIS hardening. Without a documented configuration state, there is no demonstrable conformity toward certifiers and internal auditors.
CIS Windows Benchmark
Level 1 and Level 2 for Windows Server provide concrete hardening requirements that directly cover IIS portals in insurance environments. Registry keys, security policies, update management: a defined baseline instead of individual interpretation. CIS Benchmarks are a recognized reference for auditors.
PCI-DSS (Payment Processing)
Where insurers process payments, TLS minimum standards, network segmentation, and access control apply. PCI-DSS 4.0 mandates TLS 1.2 as the minimum protocol. SChannel registry configuration is the technical lever for compliance.
VAIT (BaFin)
The BaFin supervisory requirements for IT in insurance companies require hardening, documentation, and change control analogous to BAIT for banks. Configuration state must be traceable and auditable. Operational is not the same as documented and hardened.
What lennlay delivers for insurers
Windows Hardening to CIS
CIS Windows Benchmark as a defined baseline. Registry keys, security policies, update management automated and reproducible. Benjamin Strebel (RHCE, Windows specialist, full-time) brings hands-on expertise for Windows hardening projects in insurance environments.
IIS Configuration Standard
TLS protocols via SChannel, security headers via web.config, App Pool isolation, Request Filtering: as an auditable policy, not a manual checklist. Every instance in a defined target state, not a historically accumulated one.
Automated Compliance Scan
PowerShell-based scanner checks Windows and IIS against defined policies. Structured report with findings, severity, and remediation guidance. Auditors get readable evidence, not raw registry exports.
Change History as Evidence
Configuration as code. Every change is a documented commit with timestamp, author, and justification. No manually maintained change log that goes stale on the next team handover.
Lifecycle Management
Windows Server 2012, 2016, 2019: EOL status, patch level, and end-of-support dates captured in a structured way. No reactive scramble when a server passes its patch date, but a planned migration path with a hardening standard for the new platform.
EaaS for Implementation
Engineering as a Service with Benjamin Strebel (RHCE, Windows specialist, full-time) for hardening projects that need to start today. Ansible for Windows, PowerShell DSC, IIS hardening, App Pool isolation, TLS configuration directly in the customer environment.
The Secure Windows Platform Automation and Secure IIS Platform Automation are in the concept phase. There is no delivery commitment at this time. This is how deployment will look when it becomes available. Windows and IIS hardening projects are available today via EaaS with Benjamin Strebel. Reach out to discuss your situation.
Three situations where this becomes relevant
NIS2 Readiness
The NIS2UmsuCG applies. The insurer is classified as an essential entity. Technical measures under Article 21 must be demonstrable. IIS portals and broker systems are under audit pressure without a defined configuration standard in place.
IIS Audit Findings
An external penetration test or internal audit surfaces TLS configuration gaps, missing security headers, or App Pool problems. Remediation is required. The challenge: no configuration standard, no defined target state, no reproducible process for getting there.
Windows Server EOL
Windows Server 2012 R2 reached end-of-life in October 2023. Servers still active on the network. A migration path is needed, including a hardening standard for the new platform. Migrating without a hardening standard reproduces the same problem on new hardware.
Insurance portals under audit pressure? We can assess what is actually configured in SChannel, web.config, and App Pool settings.
Non-binding · No sales pitch · Confidential
