How to Fight the Cyber War

Externally, assess physical/logical data protection, documentation and communication. Are you able to confirm that they do what they say they do? Familiarize yourself with Service Organization Control reports. These reports provide valuable information on firm postures and practices. Vendors are not likely to convey the details of their cyber defenses. This is understandable. Then what are you looking for?

1. How do vendors connect to our network?
2. What encryption practices do they use? How do they manage credentials?
3. How do they train team members?
4. When are they required by contract to respond to breaches?
5. How do they communicate about breaches?

When we cross the boundary between internal and external, when data moves from rest to transit, are we protecting data through secure email, encryption or by placing sensitive information in a portal or lockbox?

Assessing is largely a function of asking questions and then digging for the answers. However, there is also a "physical" component. Physical evaluations include:

1. External vulnerability:  Is your system vulnerable to exploitation by outside forces? Is your system susceptible to the know Common Vulnerabilities and Exposures (CVE) Entries? This testing involves pinging your firewall with these culprits to look for weaknesses.
2. Penetration testing: Can your system be exploited using these same CVE Vulnerabilities.
3. Internal vulnerability: Is your system already compromised internally or potentially vulnerable to exploitation?

We monitor a series of reports that emanate from several sources to keep tabs on our defenses. These reports are dedicated weekly and monthly compliance tasks. We are looking for anomalies and inconsistencies in these reports. We continuously refine what we look for and the reports we use.

• Address

Brutal honesty in your assessment only makes sense as you contemplate how to harden your defenses against the enemy. Don't cheat yourself by doing less than a thorough assessment. Address the weaknesses identified by your evaluation.

• Hardware and configuration issues.
• Practices: policies, procedures, protocols.
  • For example: Are employees authenticating clients on the phone? Are employees verifying instructions received by email?
  • Wire transfers.

Ask

What if…

• Your controls fail?
• Your hardware fails?
• You are victim of a ransomware?

Answers to your questions ultimately bring you full circle to assessing what you've learned. Keep asking the questions and seeking appropriate answers. Document what you know and what you are doing.

Asking "what if" also entails developing your response to these various scenarios. Determine who you need to contact and when. Think thresholds such as internal and external IT professionals, legal counsel, law enforcement agencies, partners and, of course, impacted clients.

Your incident response plan (IRP) will vary based on the problem. How you respond is critically important to your clients as well as to regulators.

Don't be overwhelmed by the complexity of cybersecurity. While the relative frequency of large-firm breaches is scary, smaller firms can't wish the threat away or hide from the reality of this constant battle. While we do rely on external expertise, we remain at the center of arranging and maintaining our defenses against cyber threats.

This approach is not advocating a lack of depth, but simply tackling the problem in increments we can absorb. Nor is this to diminish the need to adhere to accepted standards or protocols.

Dig deeper with each iteration as your knowledge and confidence grows. Most importantly, stay engaged and avoid sticking your head in the sand out of fear or paralysis.

Timothy P. White, CFP, is managing director at Johnson & White Wealth Management, LLC, located in York, Pennsylvania. You can reach him at [email protected].