The unexpected poses the biggest cybersecurity risks, as recent breaches have highlighted. Wealth managers, like other industry participants, must recognize the vulnerabilities presented by vendors, employees, and clients. Cybercriminals often exploit these unexpected weaknesses rather than directly attacking a company’s cyber defenses. This emphasizes the need for a layered protection strategy that addresses the different points where humans intersect with technology.
In terms of vendors, it is crucial to thoroughly vet their cybersecurity policies and procedures. No vendor should be allowed to connect a device to company systems. Additionally, physical access to company offices should be restricted for vendors, especially in areas where devices holding sensitive information are present. It’s important to note that access controls are rendered ineffective if employees, especially executives, continue to save passwords insecurely.
The lax personal online behavior of both employees and clients also creates numerous opportunities for cyber breaches. Weak passwords on personal email accounts can be easily hacked, leading to phishing emails that compromise a firm’s systems. Moreover, poorly secured social media accounts provide cybercriminals access to a wealth of personal information, enabling them to target victims and generate fraudulent transactions. Cybercriminals have even been able to clone voices and images from social media videos, posing as clients or employees to carry out fraudulent activities.
Furthermore, the presence of smart home technology in employees’ and clients’ homes can make them attractive targets for cybercriminals. These devices, if breached, can serve as entry points to compromise other connected devices, including work devices. Cybercriminals can steal passwords or infect these devices with malware, causing significant damage.
Despite investments in cybersecurity defenses and staff, wealth managers still face vulnerabilities. It is important to address these vulnerabilities by implementing additional layers of security. However, relying too heavily on cyber insurance can be problematic. Policies may include specific exemptions and ambiguous language, making it challenging to file successful claims. Employee error, the primary cause of breaches, is often excluded as a basis for a claim. Ultimately, relying on cyber insurance after a breach means the damage has already been done.
Wealth managers must accept and embrace the need to change how they run their businesses to prioritize cybersecurity. Costs will increase, technology will become more challenging to use, and regulatory bodies like the SEC will closely monitor organizations’ cybersecurity efforts. Those who proactively take steps to reduce the likelihood and frequency of breaches will be better equipped to navigate the evolving cybersecurity landscape.
In conclusion, the unexpected poses significant cybersecurity risks for wealth managers. Vendors, employees, and clients present vulnerabilities that cybercriminals can exploit. Implementing a layered protection strategy and prioritizing the cybersecurity of all stakeholders is crucial. While cyber insurance is important, it should not be solely relied upon. Instead, wealth managers should focus on mitigating risks and preventing breaches to minimize damage and protect their businesses.
