Cyberattacks Are Underreported. Is Your Firm Ready?

Yet while cybersecurity represents a real and present danger to the industry, the majority of breaches are handled without being publicized. Thus, there’s a widespread awareness problem, and breaches that come to light may not accurately represent the pervasive threat. Adds Brice: “The dirty little secret is that one in four asset managers have been the victim of some form of cyberattack. Because those breaches are kept tightly under wraps, the vast majority of firms are unaware of the scope and severity of the problem.”

Implementing a formal cybersecurity plan along with rigorous technical and operational controls is crucial to combating cyber crime, says Doug Preveza, Director, Alaric Compliance. Prior to joining Alaric, Preveza worked with an investment advisor that encountered a breach similar to WannaCry.  Someone at the firm clicked an email link that encrypted the firm’s server.  Even with fewer than 50 employees, the firm had compliance controls such as nightly backups in place so, fortunately, lost only a day’s worth of work. 

Registered financial firms must implement these kinds of controls, along with a formal cybersecurity policy, signed by a principal or senior executive of the firm, and reviewed on at least an annual basis. This policy should outline the following activities, performed on an ongoing basis — instead of after an attack:

• Training and Education
• Technical Security Control Assessment
• Cyber Risk Assessment
• Critical Third Party Assessment
• Incident Response Plan

In the absence of a cybersecurity program and strong commitment from management to adhere to it, breaches can happen more easily. When they do, senior management must try to identify the source of the problem. “A firm must have the right corporate culture prior to a breach, because like any other operational issue, a cyber breach can quickly become a blame game,” Preveza explained. 

In addition to the obvious reputational impact, equally significant financial impact related to the legal, cyber forensic, and remedial efforts tend to consume every organization after a breach becomes public.  

Indeed, if an SEC-registered firm falls victim to a cyberattack, the firm is at risk on numerous costly fronts: 1) the registrant can lose firm and client data and assets; 2) the firm can be charged and fined by regulators for noncompliance with relevant cybersecurity rules, such as Reg S-P and Reg S-ID;  3) the firm can be sued by investors for loss of their data and 4) the firm’s bottom line can be irreparably damaged.

On the other hand, firms with a solid cybersecurity plan can mitigate the repercussions of a breach and rebound more quickly. In the event of an attack, proper planning can go a long way for registrants that might hope for the best, but must plan for the worst. Even if attackers succeed in their attempts, having a comprehensive cybersecurity plan in place allows firms to provide tangible evidence that they were doing everything possible to try and reduce risk for their firm and clients.