How Financial Advisors Can Protect Their Firms from Cyber Crime

Author Name | 07/31/2024

In the past year, cybercrime inflicted more than $10 billion in damages on U.S. businesses, with projections suggesting global costs could soar to $10.5 trillion by 2025. Ransomware alone is expected to result in $265 billion in annual losses by 2031, a staggering increase from the $325 million spent on ransomware in 2015, according to Cybersecurity Ventures. Furthermore, IBM reports that the average cost of a data breach hit a record high of $4.88 million in 2024, and 40% of data breaches involved data stored across multiple environments.

We recently saw a worldwide cyberattack on July 19th, 2024, with a software update from CrowdStrike, which triggered widespread outages internationally. This update led to significant conflicts with the Windows operating system, causing instability and crashes. The issue disrupted operations across several sectors, including aviation, banking, IT, and other critical infrastructures.

Another factor to consider in cyber security is the rising advancement of Artificial Intelligence (AI). Independent financial advisors need to have heightened awareness of weaponized cyber schemes that are seizing organizational data that could put advisors and their clients at risk.

Below are the most popular growing cybersecurity threats and some suggestions for how financial advisors can keep firm and client data secure:

Phishing & AI Phishing Attacks:

Phishing involves deceptive emails or messages that trick recipients into revealing sensitive information or downloading malicious software.

With AI tools on the rise, phishing attempts have become more effective.

How to prevent phishing:

Stay vigilant on email and conduct regular training to recognize phishing attempts. Between the volume of traffic and the vast accessibility of the internet, your most vulnerable system is email. Phishing attacks are some of the most common ways hackers try to capture credentials and other sensitive information.

Embrace multi-factor authentication (MFA). In 2021, Kestra Financial introduced a policy requiring all systems containing firm or client data to utilize MFA. This provides an added layer of security by requesting multiple pieces of evidence from the user before granting access. MFA should be enabled on all key systems, including CRM, VPN, and - most importantly - email.

Get your passwords in order and make them strong. Using weak or easy-to-guess passwords across multiple systems can easily expose sensitive information. Consider a password management tool, such as LastPass or Keeper, to stay organized and secure.

Voicemail phishing has increased since 2023, with perpetrators utilizing AI to duplicate voices. Using geolocations to verify communications and strong multi-factor authentication can mitigate this cybercrime.

Ransomware:

Ransomware encrypts a victim's data, demanding payment for decryption. Criminals leverage stolen customer data to blackmail a bank’s clients, threatening to expose sensitive information either publicly or on the black market.

How to mitigate ransomware:

Regularly back up data, use endpoint protection solutions, ensure software and systems are up-to-date, and segment networks to limit the spread of ransomware.

Malware:

Malware includes viruses, worms, and trojans that can damage or take control of systems.

Protection from malware:

Employ antivirus software, perform regular system scans, avoid downloading untrusted software, and restrict user permissions.

Social Engineering:

This involves manipulating individuals into divulging confidential information.

Protection from social engineering:

Conduct regular cybersecurity awareness training, implement strict verification processes, and maintain a culture of skepticism regarding unsolicited requests for information.

Insider Threats:

Threats from within the organization, whether intentional or accidental.

How to deter insider threats:
Monitor user activities, enforce strong access controls, conduct background checks, and continuously evaluate employees.

Tips for Independent Advisors to Maintain Data Safety

Protect sensitive information:
Encrypt sensitive data during transmission and while stored to prevent unauthorized access.
Secure Cloud Services:
Choose reliable cloud service providers that offer strong security protocols.
Regular Audits and Assessments:
Regularly perform security audits and vulnerability assessments to discover and fix potential security gaps.
Access Controls:
Enforce stringent access control policies to limit who can access sensitive data.
Incident Response Plan:
Create and maintain an incident response plan to swiftly handle any security breaches.
Compliance with Regulations:
Follow financial industry regulations such as GDPR and CCPA that require stringent data protection measures.
Vendor Management:
Assess and monitor the security practices of third-party vendors to ensure they meet your security standards.

With financial services being one of the most highly targeted industries for cyber-crime, we are continuously improving and enhancing our security measures, so your business and client information is as safe as possible. Learn more about preventing cybercrime for small businesses from the documentation on the Cyber Security & Infrastructure Security Agency website.