Security in a New Age

Technology alone is never going to be sufficient to eliminate online risk. But it is a good starting point for ensuring that your systems and data have basic protection. One first step is to perform a gap analysis, comparing your present risk management approach to your desired security state. For many advisors, it’s best to retain the services of a professional IT security consultant to perform this analysis. Barring that, at least arm your firm with the basics such as firewalls, antivirus, anti-spam, and anti-spyware software, as well as security-aware Web browsers. Use encryption technologies on your laptops and other mobile devices. Keep your tools and systems updated by regularly checking with your vendors for the latest security patches or by setting your systems to update automatically.

Also consider using emerging technologies that create additional layers of protection. One example: two-factor authentication, enabled by tokens or cards displaying a sequence of numbers that change periodically and must be entered along with the user name, password, and a PIN number to log into a system. A data thief not in possession of the token will find it much harder to hack into a computer, even if critical passwords have already been compromised. Schwab Institutional provides authentication cards free of charge to advisors, and other custodians have similar programs. While these cards do necessitate an extra step in your employees’ processes, they can greatly reduce the chances that a fraudster will steal login credentials and leave you in the difficult position of having to explain to a client that their personal information has been compromised. One option to consider would be to order authentication cards for your first line of defense–your traders–and then roll them out to the rest of your firm at a later date.

Risks and Policies

Even if you employ these extra measures, you also need to implement security-related procedures and policies throughout your firm that enable business while keeping a handle on risk. Those policies should include best practices such as:

Controlling access. Every person in your office with a password to your system is a potential exposure point for a security breach. Therefore, instead of providing general access to every employee, limit access based on their roles and needs. For example, trading authority should only be given to those staff members who need it. Likewise, when an employee quits or leaves the firm, have a procedure in place to disable his or her access credentials. Periodically audit the list of employees with access credentials, making changes and deletions as needed. Unused and inappropriate credentials represent a point of risk for your firm.

Manage passwords. Require complex passwords with a combination of letters and numbers instead of using easily guessed passwords (such as those based on birthdays or children’s names). Then change those passwords every 90 days.

Manage remote access. It may be convenient to get work done at your corner coffeehouse, but it’s also potentially dangerous. That’s why the same security tools you have on your office computers need to be installed on all company laptops, PDAs, and other remote devices, as well as on any home computers that might be used for business.

Additionally, ensure that strong encryption is used without exception by anyone at the firm logging in using unsecured networks while traveling, and prohibit conducting business on public computers at hotels, Internet cafes, and wireless hot spots–or on any computer that has questionable security protection.

Appoint a security overseer. A security “point person” within your firm can serve as the central point of contact for managing issues regarding data security, and ensuring that policies are enforced. This person should be responsible for tasks such as allocating access to your network and to the protected Web sites of your various custodians and broker/dealers, managing and updating passwords, and ensuring that log-in credentials are deleted when an employee leaves. The point person doesn’t need to be tech-savvy, but does need to be a highly trusted and well-organized employee or partner.

Revisit regularly your security measures. Online data thieves’ techniques are still evolving rapidly–which means that you can’t simply set and forget your firm’s security software program or policy. All security-related technologies and business practices must be revisited and reviewed on a systematic basis to ensure that nothing is falling between the cracks. In that way, security is no different from any other business process at your firm.

Cultivate your common sense. As members of the Internet community, we all have a thing or two to learn about vigilance, and our online posture must evolve along with the threats (see “Don’t Do It” sidebar).

There’s no question that keeping up with the evolving online threat is difficult. You have to take greater responsibility for how your firm leverages the Internet, and you have to make an effort to learn how to operate in such a way that the criminals’ tricks will usually fail against you.

In case this seems too hard, be reassured: the lock on your front door doesn’t compare to the guns, guards, and gates protecting Fort Knox. But the basic steps you take to protect your home and your family are almost always good enough for the bad guys to look elsewhere for victims.

Most important, do the best you can and seek opportunities to keep informed. By implementing best practices and technologies that continually improve your level of protection, you’ll be able to help minimize risk and protect the business you’ve worked so hard to build.