SEC risk alert calls on advisory industry to do more to shore up cybersecurity

Advisory firms given more details on how examiners want systems protected from hackers

Aug 8, 2017 @ 2:04 pm

By Liz Skinner

Financial advisory firms are getting more advice from federal regulators on steps they should be taking to protect their information systems from hackers.

Advisory firms need to do a better job of following their stated cybersecurity policies and they should correct all the vulnerabilities that periodic tests reveal, according to results from a new round of cybersecurity examinations by staff at the Securities and Exchange Commission.

Advisers also need to do a better job of keeping the firm's security patches up-to-date, the new SEC exam risk alert said. It contained findings from 75 cybersecurity exams of advisory firms, broker dealers and funds conducted from September 2015 through June 2016.

"The staff observed that a few of the firms had a significant number of system patches, that according to the firms, included critical security updates that had not yet been installed," the staff of the Office of Compliance Inspections and Examinations wrote.

The importance of timely installation of security patches was highlighted earlier this year when the "WannaCry" ransomware attack hit more than 200,000 computers in 150 countries, encrypting computers and demanding $300 to release each computer. The malware spread through a bug in an old Windows version that Microsoft had issued a "critical" patch to fix two months earlier.

(More: Cyberattack should prompt advisers to ask their IT professionals hard questions)

The attack in May was especially damaging because it had a mechanism to spread through the network, infecting other computers that hadn't been updated. The SEC issued an alert specific to the issue of ransomware soon after the massive hack.

Another area where firms should improve is in maintaining response plans for addressing data breaches and letting clients know about material events. Less than two-thirds of advisers have these plans in place, the alert said.

The SEC alert also said broker-dealers were not doing as good a job as advisers and funds at having formal procedures for verifying customers' identities when clients request electronic transfers.

(More: Passwords to become passé as more firms back biometrics)

Federal regulators generally have been less prescriptive than some states when it comes to giving financial services firms detailed requirements for protecting their systems from attacks. Colorado recently implemented new rules requiring annual assessments, use of secure email, including digital signatures and encryption, and New York also has set specific rules for financial institutions.

"The SEC hasn't been very specific about what it wants firms to do on cybersecurity," said Justin Kapahi, vice president for solutions and security at External IT. "I think we'll see a lot more states follow Colorado's lead."

In the new alert, the SEC said the firms with robust cybersecurity protections reviewed the effectiveness of their security solutions with penetration tests, tracked access rights of employees, had formal patch management policies, made training mandatory, and established data access controls for mobile devices that used passwords and software that encrypted communications, among other steps.

0
Comments

What do you think?

View comments

Recommended for you

Featured video

Events

What's driving volatility and what's ahead?

Will there be another rate hike? How could it impact markets in 2019. Ed Rosenberg of American Century breaks it down and has all the answers.

Latest news & opinion

2019 is a key year for Social Security

Those turning 66 this year are the last group eligible for the spousal claiming strategy.

Look for more changes at Cetera Financial Group

CEO Robert Moore's resignation signals further adjustments at the IBD network.

10 top scams targeting seniors

Phone calls to a Senate committee hotline show trends in frauds perpetrated against seniors.

Robert Moore, Cetera CEO, stepping down for health reasons

Chairman Ben Brigeman will serve as interim chief executive while a search for a permanent CEO is conducted.

The AMT is no longer a problem for many clients

With income thresholds higher and a lower SALT deduction after tax reform, the AMT will realistically only apply to wealthy Americans with out-of-the-ordinary tax events.

X

Hi! Glad you're here and we hope you like all the great work we do here at InvestmentNews. But what we do is expensive and is funded in part by our sponsors. So won't you show our sponsors a little love by whitelisting investmentnews.com? It'll help us continue to serve you.

Yes, show me how to whitelist investmentnews.com

Ad blocker detected. Please whitelist us or give premium a try.

X

Subscribe and Save 60%

Premium Access
Print + Digital

Learn more
Subscribe to Print