Morgan breach offers universal data security lessons

Client data breaches by a now-fired Morgan Stanley broker offer a glaring heads-up to advisory firms that they need cybersecurity measures that root out internal hacks as well as outside criminals.
Morgan Stanley uncovered the online posting of information about 900 of its wealthy clients last month during routine monitoring. It moved quickly to identify broker Galen Marsh, 30, as the culprit and have the data taken down, the Wall Street firm said earlier this week.
Morgan Stanley said no client was impacted by the actions of Mr. Marsh, whom the firm fired. He allegedly took data regarding 350,000 wealthy clients and was looking online for a buyer of login and password information.
Many advisory firms today would be challenged to prevent such an internal theft.
A lot of firms lack an information security plan that maintains client data in a secure location and restricts it to those who need to access that information, said Gary Davis, Jr., MarketCounsel’s vice president for practice management. Firms need to have such policies as part of their compliance manual, he said.
“Make sure that your firm has a data security plan in place to help manage the privacy of client information and mitigate breaches from occurring,” he said. “No matter what size the firm is, they need to have this in place.”
The plan should be more than just a boilerplate that a firm downloads or that is provided by its custodian, he said. It needs to be customized for the firm’s unique procedures and business practices.
(More: 10 ways advisers can improve their cybersecurity)
Another step firms can take when an employee with access to client passwords leaves the firm is to notify clients they should change their password so there’s no opportunity for that former employee to illegally access that account, Mr. Davis said.
Broker-dealers and custodians typically subscribe to cybersecurity services that monitor online postings, but advisory firms typically don’t have the resources to do that, he said. As part of an adviser’s due diligence, though, Mr. Davis said it’s appropriate for an advisory firm to ask these larger firms about their efforts to safeguard client information.
(More: “SEC exam sweep reveals adviser cyberefforts”)
Joel Bruckenstein, a technology expert and consultant to financial firms, said the human factor “is one of the most difficult to guard against.”
He recommends that firms have strict controls over who is allowed to see client data.
“For someone who had recently been promoted to being an adviser, I don’t see how [Mr. Marsh] could have had needed access to 350,000 client names,” he said in reference to the Morgan Stanley breach. “Best practices would dictate that employees can only see what they need to do their jobs.”