Cybersecurity should be on every advisor's mind. The unfortunate byproduct of advances in technology is that cybercriminals have new opportunities to commit their crimes. Some cyberattacks are very sophisticated, but many are still fairly basic attempts that, with 20/20 hindsight, you can clearly see how you could have better protected your firm and your clients. So how do you ensure that your firm is on guard for the cybersecurity battle before an event?
If the responsibility for your firm's overall cybersecurity efforts resides with the IT company that supports your firm, you need to rethink your approach. Your IT provider can never be close enough to the business to be the primary leader of your cybersecurity efforts. Your IT provider may fulfill a significant role in cybersecurity, but you should have someone on staff to lead your cybersecurity program. This individual needs to be committed and passionate about serving in this role. It can't be a "when I have time" type of job. Staying on top of the latest cyberattack news and sharing this information with your firm's employees requires consistent effort and focused time. It is very unlikely that your firm will be the first victim of any specific type of cyberattack. Awareness is one of your first lines of defense.
It is probably a safe assumption that you know who has keys to your house or the code to your security system. Do you have the same level of knowledge of your IT systems and network? For example, who is allowed to log in to your network remotely? Ideally, the remote group should be a select group of employees. The more remote employees you have, the more attention this area requires.
Furthermore, your firewall should produce audit reports that detail when and how often certain users are logged in to your network. This is critical information, especially if it identifies unusual activity.
Another important area includes the permissions employees have on your network and on their own computers. Do they have administrator access? If they do, it means they or anyone who gains access to their computer can essentially do whatever they want on the computer and possibly on your network. Be sure there are some levels of controls in place.
Another critical defense against cyberattacks is being on guard and suspicious of any email that doesn't appear right. We are all well aware of cyberattacks that use email spoofs from a variety of domain names. Cybercriminals know they are more successful when they use an address that is familiar to their victim. The challenge here is making sure your employees understand that a domain name in an email may look as though it is from a familiar source or even your own email network. Every single email that includes an attachment or link — regardless of the source — requires thorough evaluation prior to clicking the link or opening the attachment. I know that you have heard this before, but unfortunately, successful spoofing attacks still occur every day. If that happens to you, your next best defense is your anti-virus software, so be sure it is up to date.
