SEC risk alert calls on advisory industry to do more to shore up cybersecurity

Advisory firms given more details on how examiners want systems protected from hackers

Aug 8, 2017 @ 2:04 pm

By Liz Skinner

Financial advisory firms are getting more advice from federal regulators on steps they should be taking to protect their information systems from hackers.

Advisory firms need to do a better job of following their stated cybersecurity policies and they should correct all the vulnerabilities that periodic tests reveal, according to results from a new round of cybersecurity examinations by staff at the Securities and Exchange Commission.

Advisers also need to do a better job of keeping the firm's security patches up-to-date, the new SEC exam risk alert said. It contained findings from 75 cybersecurity exams of advisory firms, broker dealers and funds conducted from September 2015 through June 2016.

"The staff observed that a few of the firms had a significant number of system patches, that according to the firms, included critical security updates that had not yet been installed," the staff of the Office of Compliance Inspections and Examinations wrote.

The importance of timely installation of security patches was highlighted earlier this year when the "WannaCry" ransomware attack hit more than 200,000 computers in 150 countries, encrypting computers and demanding $300 to release each computer. The malware spread through a bug in an old Windows version that Microsoft had issued a "critical" patch to fix two months earlier.

(More: Cyberattack should prompt advisers to ask their IT professionals hard questions)

The attack in May was especially damaging because it had a mechanism to spread through the network, infecting other computers that hadn't been updated. The SEC issued an alert specific to the issue of ransomware soon after the massive hack.

Another area where firms should improve is in maintaining response plans for addressing data breaches and letting clients know about material events. Less than two-thirds of advisers have these plans in place, the alert said.

The SEC alert also said broker-dealers were not doing as good a job as advisers and funds at having formal procedures for verifying customers' identities when clients request electronic transfers.

(More: Passwords to become passé as more firms back biometrics)

Federal regulators generally have been less prescriptive than some states when it comes to giving financial services firms detailed requirements for protecting their systems from attacks. Colorado recently implemented new rules requiring annual assessments, use of secure email, including digital signatures and encryption, and New York also has set specific rules for financial institutions.

"The SEC hasn't been very specific about what it wants firms to do on cybersecurity," said Justin Kapahi, vice president for solutions and security at External IT. "I think we'll see a lot more states follow Colorado's lead."

In the new alert, the SEC said the firms with robust cybersecurity protections reviewed the effectiveness of their security solutions with penetration tests, tracked access rights of employees, had formal patch management policies, made training mandatory, and established data access controls for mobile devices that used passwords and software that encrypted communications, among other steps.


What do you think?

View comments

Recommended for you

Featured video


The biggest drivers in wealth management today

What's shaping the future of financial advice? After 10 years of MarketCounsel Summits, Brian Hamburger explains what's changed in the past decade and what stands ahead for adviser technology and regulation.

Video Spotlight

Help Clients Be Prepared, Not Surprised

Sponsored by Prudential

Recommended Video

Path to growth

Latest news & opinion

Tax update: Brady says sales tax deduction in final bill

Taxpayers will be able to deduct state income taxes or state sales taxes in addition to property levies — up to a $10,000 cap.

Critics say regulation hasn't curbed overly rosy projections for indexed universal life insurance

They say rule didn't go far enough and more stringent measures may be necessary.

Broker, retirement groups make last-minute pleas to change tax legislation

Pass-through provisions are target of groups representing employee-model brokerage firms, as well as retirement plan advisers.

House and Senate reach tentative compromise for tax overhaul

Lawmakers still need to get a cost analysis of their agreement, so it's not yet definite, according to a source.

Advisers' biggest fears for 2018

What keeps advisers up at night.


Subscribe and Save 60%

Premium Access
Print + Digital

Learn more
Subscribe to Print