Regulators’ Secret Weapon Against Cyberattackers

FINRA found that the firm’s systems were inadequate in light of FINRA Regulatory Notice 05-49, including “whether the member’s existing policies and procedures adequately address the technology currently in use” and “whether the member has taken appropriate technological precautions to protect customer information.” The firm had no written supervisory procedures to ensure that the firm’s most sensitive customer and proprietary information stored on laptops was being adequately safeguarded.

FINRA found Sterne Agee violated Regulation S-P, censured and fined the firm $225,000, and required the firm to conduct an internal review of the adequacy of its policies relating to Regulation S-P, including cybersecurity. Importantly, there is no evidence of customer loss relating to this incident apparent from the AWC order.

Department of Enforcement v. Manhattan Beach Trading Financial Services

In this action, FINRA alleged Manhattan Beach Trading Financial Services (MB) failed to establish and implement anti-money laundering procedures adequately tailored to the firm’s business and reasonably designed to verify customer identity, and to detect and report suspicious account transactions, in violation of FINRA Rules 3310 and 2010. Between May 2010 and September 2010, the firm opened accounts for four persons from an area known to regulators as one in which suspicious activity has occurred on a more frequent basis than other areas of the world. The four customers then engaged in a fraudulent scheme of improperly accessing accounts of unsuspecting customers with accounts at other broker-dealers, and engaged in short-sale transactions. The scheme guaranteed the four customers large profits in their MB accounts and was carried out entirely through MB’s direct market access, or “DMA,” platform.

FINRA found that MB had inadequate written policies and procedures for opening new accounts and the firm did not adequately train its staff to review reports generated by a third-party vendor that MB retained to provide customer identification services (and which would have alerted MB to red flags concerning the four customers). FINRA also found MB failed to flag any trading activity for the four customers as suspicious or recognize that these four customers were on both sides of the trades (through their fraudulent access of unsuspecting customers’ accounts). FINRA censured and fined the firm $125,000.

Department of Enforcement v. D.A. Davidson & Co.

Here, FINRA alleged D.A. Davidson failed to protect certain confidential customer information when it utilized a database server containing account numbers, Social Security numbers, dates of birth, etc., but without adequate safeguards to protect the security of such information, in violation of Rule 30 of Regulation S-P and NASD Conduct Rules 2110 and 3010. The firm employed a public-facing computer Web server that hosted certain firm Web pages. The computer also housed confidential customer information, even though the Web pages were purely informational (and thus not capable of transactions). The database was therefore on a computer with a persistent Internet connection, leaving it vulnerable to attack. The database was compromised when an unidentified third party downloaded the confidential customer information and demanded money from the firm.

The firm took its website down and reported the incident to authorities. FINRA, however, found that the firm did not maintain adequate supervisory systems, including a failure to have finalized written supervisory procedures designed to safeguard customer records, in violation of Rule 30 of Regulation S-P. These failures contributed to the compromise of the confidential information of 192,000 customers. Despite the firm’s remedial efforts, and the fact that no customer losses had been suffered at the time of the AWC, FINRA censured and fined the firm $375,000.

Securities and Exchange Commission v. R.T. Jones Capital Equities Management

The SEC has not pursued registered firms with respect to cybersecurity as frequently as FINRA, but last year instituted an enforcement proceeding against an RIA for violations of Rule 30 of Regulation S-P in connection with a data breach that compromised personal identification information (PII) of the firm’s customers (and tens of thousands of other individuals). In an administrative proceeding against R.T. Jones Capital Equities Management, the SEC found the firm failed to adopt any written policies and procedures reasonably designed to safeguard its clients’ PII as required by Regulation S-P, while maintaining client PII on its third-party hosted Web server. Although no known customer losses have occurred as a result of the data breach, the SEC censured R.T. Jones, ordered the firm to cease and desist from committing or causing any violations or future violations of Regulation S-P, and fined the firm $75,000.

What FINRA Expects From Firms

FINRA has recently laid out its expectations for cybersecurity best practices into eight principles-based categories:

Governance and Risk Management for Cybersecurity. Firms should establish and implement a cybersecurity governance framework that supports informed decision making and escalation within the organization to identify and manage cybersecurity risks. Effective practices include:

• Defining a governance framework to support decision making based on risk appetite

• Ensuring active senior management- and, as appropriate to the firm, board-level engagement with cybersecurity issues

Cybersecurity Risk Assessment. Firms should conduct regular assessments to identify cybersecurity risks associated with firm assets and vendors, and prioritize their remediation. Effective practices include establishing and implementing governance frameworks to:

• Identify and maintain an inventory of assets authorized to access the firm’s network and, as a subset thereof, critical assets that should be accorded prioritized protection

• Conduct comprehensive risk assessments

Technical Controls. Firms should implement technical controls to protect firm software and hardware that stores and processes data, as well as the data itself. Effective practices include:

• Implementing a defense-in-depth strategy

• Selecting controls appropriate to the firm’s technology and threat environment

Incident Response Planning. Firms should establish policies and procedures, as well as roles and responsibilities for escalating and responding to cybersecurity incidents. Effective practices for incident response include:

• Preparation of incident responses for those types of incidents to which the firm is most likely to be subject, e.g., loss of customer PII, data corruption, DDoS attack, network intrusion, customer account intrusion or malware infection

• Eradication and recovery plans for systems and data

Vendor Management. Firms should manage cybersecurity risk that can arise across the life cycle of vendor relationships using a risk-based approach to vendor management. Effective practices to manage vendor risk include:

• Performing pre-contract due diligence on prospective service providers

• Establishing contractual terms appropriate to the sensitivity of information and systems to which the vendor may have access, and that govern both the ongoing relationship with the vendor and the vendor’s obligations after the relationship ends

Staff Training. Firms should provide cybersecurity training that is tailored to staff needs. Effective practices for cybersecurity training include:

• Defining cybersecurity training needs requirements

• Identifying appropriate cybersecurity training update cycles

Cyber Intelligence and Information Sharing. Firms should use cyber-threat intelligence to improve their ability to identify, detect and respond to cybersecurity threats. Effective practices include:

• Assigning responsibility for cybersecurity intelligence gathering and analysis at the organizational and individual levels

• Establishing mechanisms to disseminate threat intelligence and analysis rapidly to appropriate groups within the firm; for example, the firm’s risk management and front-line information technology security staff

Cyber Insurance. Firms should evaluate the utility of cybersecurity insurance as a way to transfer some risk as part of their risk management processes. Effective practices include:

• For firms that have cybersecurity coverage, conducting a periodic analysis of the adequacy of the coverage provided in connection with the firm’s risk assessment process to determine if the policy and its coverage align with the firm’s risk assessment and ability to bear losses

• For firms that do not have cyber insurance, evaluating the cybersecurity insurance market to determine if coverage is available that would enhance the firm’s ability to manage the financial impact of cybersecurity event

What to Do Now

It is clear that firms will need to make cybersecurity a focus, if they have not already, and contribute a large amount of human and monetary resources to ensuring the safety of customer and firm information. Not all firms are alike, however, in terms of their cybersecurity concerns. What is most important is that firms analyze their particular cybersecurity needs and develop principles-based supervisory procedures — in writing — to address those needs. When dealing with regulators (and customers alike), documentation of firms’ efforts to adhere to laws, rules and regulations governing the securities industry is absolutely crucial. Just as “location, location, location” may be the mantra of the real estate industry, “documentation, documentation, documentation” should be the mantra of investment firms with respect to cybersecurity. Firms will also need to continually re-evaluate their cybersecurity needs and measures, updating as necessary.

— Read “6 Big Hack Attacks Targeting Financial Data: 2016” on ThinkAdvisor.