Remaining cyber secure is key for fund managers and their investors and they need to know the cybersecurity position of their vendors writes James Williams.
To help managers reduce the cyber risks of using third parties, firms such as Duff & Phelps assess every third party who is either storing, processing or transmitting sensitive data on behalf of the fund and then look to ascertain exactly what that third party is doing from a security perspective.
An example such as the Panama Papers scandal involving Mossack Fonseca, the world’s fourth largest offshore law firm, reveals the vulnerability of fund managers, in particular private equity groups who rely on law firms to protect sensitive deal information.
Factor in that the SEC is increasingly imposing financial penalties on investment firms who fail to adequately protect personally identifiable information, not to mention the 4 per cent charge on total annual turnover that firms will be hit with under the General Data Protection Regulation in Europe next year, and vendor due diligence has become a primary focus for all concerned.
Speaking recently on the cyber preparedness of investment firms at an event hosted by Global Fund Media on 16 March in London, Eldon Sprickerhoff, founder and chief security strategist for the cybersecurity services company eSentire Inc, said that a few years ago, if you asked firms what protection they had in place, most would say firewalls, antivirus software and that was about it.
“Much has changed since then, partly due to regulation,” said Sprickerhoff. “Firms realise this is not just a technical consideration, there is considerable planning and policy that goes with it and they realise that cyber attacks are getting increasingly sophisticated.”
The advances in cloud technology have gone a long way to addressing that laissez-faire attitude recognised by Sprickerhoff. Broadly speaking, investment firms fall into two camps; those who still use their own on-site infrastructure and those who have migrated onto the cloud to use a hosted solution. Such is the level of investment made by firms on the cloud that oftentimes, managers are getting access to advanced levels of cybersecurity technology without even realising it.
“We’ve incorporated a number of in-demand security features to protect and support the end user,” says Mary Beth Hamilton (pictured), Vice President of Marketing at Eze Castle Integration, which operates the Eze Private Cloud. “We utilise a tool called Duo for multi-factor authentication that is delivered to a client’s mobile device to log securely into the cloud. We also provide secure file sharing capabilities using a tool called Varonis DatAnywhere, which is just as convenient as a tool like Dropbox, but provides more security and control of files.”
“Clients still using on-premise infrastructure are the ones that require quite a bit of re-education as to what’s happening in today’s market. A lot of people think they are too small to be attacked, and that is just not true,” commented Simon Eyre, Director of Service, Eze Castle Integration, at the London event.
Within the alternatives industry, there remains an enormous variation in terms of the level of preparedness, from fund to fund, according to William Jenkins, Global Co-Head, Operational Due Diligence at Amundi.
“You sometimes still get the response, ‘I can’t afford to do much about cybersecurity’. One fund said that their cybersecurity was provided by an outsourced service provider but outsourcing something does not mean you outsource responsibility. If you outsource the compliance function, you are still responsible for maintaining the manager’s compliance function. It’s no different for cybersecurity,” said Jenkins in London.
In his view, the quality of cyber preparedness largely comes down to the quality of the Chief Operating Officer. There is, he says, still a huge variation in the standards of cyber preparedness. Some hedge funds not only have excellent cybersecurity frameworks, they are seeding cyber technologies companies. Others do the bare minimum.
One key consideration for any Chief Operating Officer or Chief Compliance Officer is how long they should spend, annually, on vendor due diligence.
In Sprickerhoff’s view, one needs to figure out who the most important vendors are, in terms of the data they hold on a manager’s fund(s) and who has access to that data and/or the network. It is, he says, a case of drawing up a short list and then working through them, one by one.
“Probably the best first step is to join the Alternative Investment Technical Executive Club (AITEC). They have assembled a vendor due diligence document which contains about 200 questions. Most vendors within this space are already well acquainted with this questionnaire and have completed it already. Also, when you join AITEC you get access to different news feeds and chat groups to pose questions and get advice. I would say that this is the quickest and most immersive way to approach the vendor due diligence process,” said Sprickerhoff, adding that some CCOs spend anywhere from 20 to 25 per cent of their time going on site, meeting vendors, going through the due diligence process.
“It might not be the same for smaller managers, who don’t have the same level of resources or expertise or time to dedicate to vendor due diligence.”
In Jenkins’ view, vendor due diligence should not rest solely with the CCO. Others should be involved, such as the head of operations. “Take advantage of the wider resources in your firm in order to do the work. There’s no point sending someone out to look at service providers when they don’t know what the detail behind that appraisal should be,” suggested Jenkins.
For any service provider, probably the most important question to ask, in any due diligence appraisal, is ‘What are you doing to defend yourself against ransomware?’
This might appear a simple question but consider what it takes for a ransomware attack to be successful. A dozen things have to go wrong for it to lock down one’s system files. There are technical aspects, such as mail servers failing to detect the malware; there are training issues, where an employee received the malware email, clicked on it and initiated the attack inadvertently.
“If the vendor is able to provide a fulsome response on how they guard against such an attack, you can get a pretty good sense of how well placed they are to defend almost all types of cybersecurity attacks. Defence methodologies used against ransomware improve a firm’s defence against insider threat, other malware threats, data extrusion threats and so on. That one question, simple as it is, covers a whole array of technical and policy/procedure considerations,” said Sprickerhoff.
There are numerous red flags to look for when assessing one’s vendors, not all of which need to be technical in nature. Eyre said that before joining a hosted platform, it is important for managers to investigate the platform’s technology infrastructure and check that it has systems in place to screen for any abnormal activity on the network.
“That said, I think a lot of breaches happen when the capabilities of technology are exceeded or circumvented, such as with social engineering exploits. Then it comes down to the education of the end users.
“Everybody tends to think that technology is the final solution for cybersecurity protection but a red flag, in my view, even before a cyber breach has occurred, is discovering that a vendor does not have an education programme for their end users. Employees need to know and understand what to do if they think they’ve done something wrong; perhaps they’ve accidentally clicked on a link they shouldn’t have. If so, it should be clear who to go to within the organisation to rectify the situation,” explained Eyre.
Training is absolutely important but as Jenkins pointed out, the right tone has to be set from the top management. He made reference to one founder/CIO of a hedge fund who regularly sits at the front in training sessions with a notepad in hand, quietly observing and taking notes. There are plenty of CIOs and CEOs, however, who feel that cybersecurity training is optional. That mindset has a trickledown effect on wider staff and impacts not just how fund managers regard their own cyber posture, but that of their vendors. If there is no buy-in from senior management, it is doomed from the start.
“You can have all the best technology in the world, but if someone clicks on a malware link and doesn’t do the right thing afterwards – or even know what to do – that technology is irrelevant,” stated Jenkins.
“The tone from the top is crucial,” added Sprickerhoff. “One CIO’s personal email had been hacked yet he refused point blank to change his password. It took a day of convincing him why he needed to; the mindset is ‘I pay you IT guys a lot of money to stop these things happening’. A lot depends on the head of the firm. Some are very set in their ways.”
There are tools that people can use to analyse their environment, both externally and internally. One common tool our cyber team uses is Nessus, which scans for internal vulnerabilities on an organisation’s servers and workstations and tests firewalls.
“There are various tools like this that IT departments can run to ensure that fundamentally, the core of one’s infrastructure is sound. There are also tools that will test your end users. Services such as Eze Managed Phishing will send simulated phishing to people within the organisation saying things like, ‘You need to re-set your password please click here’. Think of them as white hat ethical hacking tactics. These are becoming very useful tools for service providers to help clients stay protected,” concluded Eyre.
