SEC risk alert calls on advisory industry to do more to shore up cybersecurity

Advisory firms given more details on how examiners want systems protected from hackers

Aug 8, 2017 @ 2:04 pm

By Liz Skinner

+ Zoom

Financial advisory firms are getting more advice from federal regulators on steps they should be taking to protect their information systems from hackers.

Advisory firms need to do a better job of following their stated cybersecurity policies and they should correct all the vulnerabilities that periodic tests reveal, according to results from a new round of cybersecurity examinations by staff at the Securities and Exchange Commission.

Advisers also need to do a better job of keeping the firm's security patches up-to-date, the new SEC exam risk alert said. It contained findings from 75 cybersecurity exams of advisory firms, broker dealers and funds conducted from September 2015 through June 2016.

"The staff observed that a few of the firms had a significant number of system patches, that according to the firms, included critical security updates that had not yet been installed," the staff of the Office of Compliance Inspections and Examinations wrote.

The importance of timely installation of security patches was highlighted earlier this year when the "WannaCry" ransomware attack hit more than 200,000 computers in 150 countries, encrypting computers and demanding $300 to release each computer. The malware spread through a bug in an old Windows version that Microsoft had issued a "critical" patch to fix two months earlier.

(More: Cyberattack should prompt advisers to ask their IT professionals hard questions)

The attack in May was especially damaging because it had a mechanism to spread through the network, infecting other computers that hadn't been updated. The SEC issued an alert specific to the issue of ransomware soon after the massive hack.

Another area where firms should improve is in maintaining response plans for addressing data breaches and letting clients know about material events. Less than two-thirds of advisers have these plans in place, the alert said.

The SEC alert also said broker-dealers were not doing as good a job as advisers and funds at having formal procedures for verifying customers' identities when clients request electronic transfers.

(More: Passwords to become passé as more firms back biometrics)

Federal regulators generally have been less prescriptive than some states when it comes to giving financial services firms detailed requirements for protecting their systems from attacks. Colorado recently implemented new rules requiring annual assessments, use of secure email, including digital signatures and encryption, and New York also has set specific rules for financial institutions.

"The SEC hasn't been very specific about what it wants firms to do on cybersecurity," said Justin Kapahi, vice president for solutions and security at External IT. "I think we'll see a lot more states follow Colorado's lead."

In the new alert, the SEC said the firms with robust cybersecurity protections reviewed the effectiveness of their security solutions with penetration tests, tracked access rights of employees, had formal patch management policies, made training mandatory, and established data access controls for mobile devices that used passwords and software that encrypted communications, among other steps.

0
Comments

What do you think?

View comments

Recommended for you

Featured video

Events

3 tips when hiring millennials

Advisers want to add young talent, but ask if they want to add millennials and most will begin to squirm. Hunter Hart, and Marc Schliefer of Equity Planning Inc. disspell some myths and misconceptions of hiring millennials.

Video Spotlight

The Search for Income

Sponsored by PGIM Investments

Recommended Video

Path to growth

Latest news & opinion

Morgan Stanley sees slower fee-based asset flows on fiduciary rule delay

Flows to advisory accounts, while still higher than the start of 2016, dropped off more than 20% from Q2 and were the lowest in a year.

How adviser salaries stack up to other jobs

Median compensation hovers just under $100,000 on the low end and reaches nearly $300,000 for bosses.

Finra ranking brokers in effort to crack down on industry's bad apples

All 634.403 reps have been ranked based on factors such as prior regulatory disclosures, disciplinary actions and employment history.

How to save retirement planning from tax reform

Losing big deductions, even in lieu of a larger standard deduction, may cause taxes to rise in retirement.

Advice firms in a tricky financial position

As revenue growth dips and salaries rise, nearly 90% of firms are at or near capacity.

X

Subscribe and Save 60%

Premium Access
Print + Digital

Learn more
Subscribe to Print