SEC risk alert calls on advisory industry to do more to shore up cybersecurity

Advisory firms given more details on how examiners want systems protected from hackers

Aug 8, 2017 @ 2:04 pm

By Liz Skinner

+ Zoom

Financial advisory firms are getting more advice from federal regulators on steps they should be taking to protect their information systems from hackers.

Advisory firms need to do a better job of following their stated cybersecurity policies and they should correct all the vulnerabilities that periodic tests reveal, according to results from a new round of cybersecurity examinations by staff at the Securities and Exchange Commission.

Advisers also need to do a better job of keeping the firm's security patches up-to-date, the new SEC exam risk alert said. It contained findings from 75 cybersecurity exams of advisory firms, broker dealers and funds conducted from September 2015 through June 2016.

"The staff observed that a few of the firms had a significant number of system patches, that according to the firms, included critical security updates that had not yet been installed," the staff of the Office of Compliance Inspections and Examinations wrote.

The importance of timely installation of security patches was highlighted earlier this year when the "WannaCry" ransomware attack hit more than 200,000 computers in 150 countries, encrypting computers and demanding $300 to release each computer. The malware spread through a bug in an old Windows version that Microsoft had issued a "critical" patch to fix two months earlier.

(More: Cyberattack should prompt advisers to ask their IT professionals hard questions)

The attack in May was especially damaging because it had a mechanism to spread through the network, infecting other computers that hadn't been updated. The SEC issued an alert specific to the issue of ransomware soon after the massive hack.

Another area where firms should improve is in maintaining response plans for addressing data breaches and letting clients know about material events. Less than two-thirds of advisers have these plans in place, the alert said.

The SEC alert also said broker-dealers were not doing as good a job as advisers and funds at having formal procedures for verifying customers' identities when clients request electronic transfers.

(More: Passwords to become passé as more firms back biometrics)

Federal regulators generally have been less prescriptive than some states when it comes to giving financial services firms detailed requirements for protecting their systems from attacks. Colorado recently implemented new rules requiring annual assessments, use of secure email, including digital signatures and encryption, and New York also has set specific rules for financial institutions.

"The SEC hasn't been very specific about what it wants firms to do on cybersecurity," said Justin Kapahi, vice president for solutions and security at External IT. "I think we'll see a lot more states follow Colorado's lead."

In the new alert, the SEC said the firms with robust cybersecurity protections reviewed the effectiveness of their security solutions with penetration tests, tracked access rights of employees, had formal patch management policies, made training mandatory, and established data access controls for mobile devices that used passwords and software that encrypted communications, among other steps.

0
Comments

What do you think?

View comments

Recommended for you

Featured video

INTV

Proposal to delay the DOL fiduciary rule is a turning point

Senior reporter Mark Schoeff Jr. and managing editor Christina Nelson discuss the Labor Department's latest move and what it means for the future of the regulation and the firms preparing for it.

Latest news & opinion

Fidelity wins arb case against wine mogul but earns a rebuke from Finra

In the case of investor Peter Deutsch, Fidelity doesn't have to pay any compensation, but regulator said firm put its interests ahead of his.

Plaintiffs win in Tibble vs. Edison 401(k) fee case

After a decade of activity around the lawsuit, including a hearing before the U.S. Supreme Court, judge rules a prudent fiduciary would have invested in institutional shares.

Advisers get more breathing room to make Form ADV changes

RIAs can enter '0' in some new parts of the document before their annual filing next year.

Since banking scandal, Wells Fargo advisers with more than $19.2 billion leave firm

Despite a trying year, the firm has said it will sweeten signing bonuses for veteran advisers.

Is LPL's deal sweet enough for NPH's 3,200 reps and advisers?

They will have to decide if the signing package they are being offered by LPL makes sense. A lot is hanging in the balance.

X

Subscribe and Save 60%

Premium Access
Print + Digital

Learn more
Subscribe to Print