How financial advisers can prevent cyber breaches


A specialist cybersecurity lawyer has shared six tips for advisers to mitigate the risk of attacks, following evolving updates from the Optus and Medibank data breaches.
Katherine Jones, partner at Colin Biggers and Paisley Lawyers, had managed over 500 cyber breaches during her litigation career in handling cybercrime and fraud.
In partnership with the Association of Financial Advisers (AFA), Jones discussed how firms could be proactive against cyber crime and what to do in the event of a breach.
Financial advisers fell under the category of 'critical infrastructure', according to the Australian Cyber Security Centre. Past cases of cyber crime demonstrated these types of organisations, alongside government bodies, were at a higher risk of online breaches.
With cyber attacks costing Australians close to $29 billion each year and 75% of cyber crimes resulting in a loss of funds or data, the partner reiterated the importance of having adequate risk management.
She examined four common types of cyber breaches:
- Malware, which is designed to cause harm to computer systems. This included trojans, worms, spyware and ransomware;
- Phishing, when a cyber criminal sends out fake emails to steal the login details of an employee. For phishing to be successful, it needed to come from someone that you would expect to receive an email from;
- Stolen details, evident in both the latest Medibank and Optus data breaches. This occured when an individual’s credentials were compromised, which made up 19% of all cyber breaches; and
- Business email compromise, which Jones described as “the most upsetting” form of breach. This targeted an employee’s email and left them vulnerable to surveillance, particularly those making authorised payments who were at a higher risk.
The Colin Biggers and Paisley partner identified six ways financial advisers could manage their risk and questions they should ask:
People and staff:
- How adequately are your employees trained?
- Are there email simulations internally?
- Do your employees know who to contact if they receive something suspicious?
- Is there a culture of calling to verify details internally?
- Jones advised financial advisers to change their passwords monthly to mitigate the risk of a cyber threat.
Secure network:
- How up-to-date are the systems that you are running?
- How does your organisation store back-ups?
- Do you use an external company for penetration testing?
- Use multi-factor authentication on automatic logins.
- Cloud-based software will increase your chance of a breach by 45%.
Payments:
- Who is authorised to make large payments?
- Do you call to verify payments?
- Jones advised the advantages of outsourcing and processing payments through a third-party to increase security.
Insurance:
- Do you need insurance and what does it cover?
Email risk:
- Phishing simulations enable employees to suspect strange emails.
- Frequent password changes additionally prevents the threat of stolen credentials.
Cyber event:
- What is your plan if a cyber event were to occur?
- Is there an escalation process and policy to prevent paying ransoms?
Recommended for you
The regulator has convened multiple sitting panels of the FSCP regarding AFSL breach reports which have identified poor superannuation advice from financial advisers.
One licensee has lost 27 advisers in the past week, now sitting at zero, according to the latest Wealth Data figures.
AFCA remains firm on its stance that industry failures occurring in the financial advice sector are fundamentally an advice issue, rather than a product issue.
A Sydney financial adviser has been permanently banned from providing any financial services, with the regulator deriding his “lack of integrity, trustworthiness and professionalism”.