In recent months, several financial advisory experts and industry oracles sounded the alarm that advice and planning are not exempt from the rise in cyber breaches seen in other areas of the financial services industry — and in fact, they may be more under the gun than banks, larger investment firms, or credit unions.
Several of the presenters at last month’s Financial Advisor Summit echoed the idea that financial advisers must review their IT security practices more critically and carefully, especially as so many of them are working remotely and may have more lax security procedures and access.
“Financial advisors are still at high risk for phishing attacks that are being used to harvest credentials or install malware or ransomware on the company’s network,” says Mike Morris, principal with Wipfli LLP, a financial consultancy. “Our successful phishing tests against financial advisers show that their users are still a high threat to their organization. Given that users typically reuse passwords for different websites, this creates a larger risk to the application infrastructure used at these advisor firms.”
Another reason why financial advisers are in such a sensitive position in regard to their IT security? Since financial advisers typically review the entire swath of a customer’s financial investment holdings, they are privy to a wider swath of account numbers and financial data. And, as Morris points out, they are even more likely to rely of third-party providers, creating another access point through which cybercriminals can worm their way in.
“Financial advisers typically lean heavily on their vendors to protect the applications and network from cyber threats,” Morris says, adding that as such, the financial advisers typically are not as “tuned-in to the threats that could impact them.” And, as with other areas of financial services, the human employee is typically the weakest link--nine times out of 10, a financial adviser’s company employees are going to be the ones that cause the breach.
Gary McAlum, senior cyber analyst with the TAG Cyber and a former senior vice president and chief security officer for USAA, points out that from their own perspective, financial advisers’ IT security has been “strong” and getting stronger. And yet, he admits that smaller independent advisory boutiques may experience more risk, since they do not have the deep pockets and the breadth of resources to invest. “If you underestimate the threat, it will bite you,” he adds.
Nick Santora, CEO of Curricula, points out that, “Hackers are targeting financial advisers and their firms as they are a gateway into the funds, investors, and portfolio companies that they are connected with.”
“We’ve seen countless headlines about how an employee was the victim of a successful phishing attempt that led to a compromised online account then a data breach resulting in ransomware,” Santora says. “This is just the beginning of endemic ransomware and continues to prove that anyone is vulnerable to an attack.”
This is part one in a three-part series that examines the specific security challenges facing financial advisers, and the approaches they can take to protect networks and data amid unusual times. Check back this week for more reporting.
