Last month, BlackBerry introduced its final smartphone to the market, signifying the company’s strategic shift to focus on software. While Apple’s iPhones and Google’s Android devices continue to dominate the market, BlackBerry will finally pull back and remove itself from the competitive device landscape.
And while its last entrant to the race, the DTEK60, has much to offer in terms of encryption technology and security software, the outlook remains grim. To many, this has, perhaps, signaled the beginning of the end for BlackBerry. Thus, we take a glance back at what was once a hugely successful enterprise:
September 1996 – Research in Motion/RIM introduces its Inter@ctive Pager 900, a two-way paging device.
January 1999 – The first device with the name “BlackBerry”, the BlackBerry 850, hits the market as an email pager.
June 1999 – BlackBerry Enterprise Server (BES) is released for general availability. BES, at its height, was the de facto operating software solution for enterprise handheld communications.
There’s a lot of confusion across the industry about the difference between cybersecurity vulnerability assessments and penetration tests. A common reaction we hear is:
“You mean they aren’t the same thing?!”
Since we hear the two terms interchanged a lot, we thought it might be helpful to clear up some definitions and use cases for each. Let’s start with vulnerability assessments.
A vulnerability assessment is a discovery action used to identify and categorize potential exposures across your environment. The VA is a broad-spectrum effort designed to gauge your firm’s security posture with regard to external threats. (NOTE: Internal vulnerability assessments are also growing in frequency)
Here’s what the vulnerability scanning process typically looks like:
Identify systems, networks, and infrastructures at hand
Scan networks to determine areas of vulnerability toward external security threats
Create a database of known vulnerabilities and classify based on their unique severity
Make recommendations around remediation of risks and vulnerabilities
So how is penetration testing different?
To wrap up and round out our 6-week Risk Outlook Webinar Series, we spoke with John Cotronis, Executive Director at JP Morgan, about hedge fund risk management and governance. Specifically, he addressed the following questions:
What have you observed in recent years in terms of changes affecting hedge funds – particularly at the startup phase?
Have you noticed a marked shift in the importance managers are placing on risk?
Do the firms you typically engage with have staff on hand to manage risk – compliance officers, etc.?
In terms of corporate governance, where do you see investment firms excelling when it comes to implementing risk management controls and also fostering a culture of risk management across the firm?
Let’s talk a little bit about counterparty risk. What kind of criteria are you looking for that indicates to you a provider has the right risk management framework and best practice structure to support your clients?
A lot has gotten tougher for firms, particularly on the investment side with capital raising, also with regulatory reporting, etc. What areas of operations do you think have gotten easier for hedge funds over the years?
What is your assessment of outsourcing risk – is it higher or lower than managing various functions in-house?
As financial firms become increasingly interconnected and globalized, their dependence on cyberspace has skyrocketed. While this amplified reliance on the infobahn has accelerated productivity and growth, it has also exposed firms to larger risks, such as hacking, malware, spyware and social engineering. The latter, which is the most disregarded element of an organization’s security program, is also the most dangerous.
Social engineering (e.g. phishing, pretexting, baiting, etc.) relies on the exploitation of human behaviors to breach an organization’s information security system. Hackers prey on propensities of human nature, including:
Trust: Some people are trusting to a fault; therefore, they do not question the intentions/identity of another person until proven to be false.
Ignorance: Disregard for the consequences of carelessness with sensitive business information.
Laziness: Willingness to cut corners, such as not filing away confidential paperwork and leaving it exposed for others to see.
Kindness: Employees want to feel that others can leverage them for their assistance and information because we’ve trained them to do so. However, this can lead to divulging too much information to the wrong person.
As our Risk Outlook Series continues, we recently spoke with John Araneo, Partner at Cole-Frieman & Mallon LLP in New York, about many of the regulatory risks facing hedge funds today, including compliance, expense allocations and cybersecurity. Continue reading for a brief synopsis or scroll down to watch our webinar replay below.
How would you describe the current regulatory climate for fund managers and investment advisers?
For hedge fund managers and investment advisers, the regulatory expectations have never been higher. Looking ahead to 2017, managers and advisers should expect the challenge of having to navigate potentially seismic regulatory changes - each of which has the potential to complicate business practices and add to the cost and complexity of compliance.
How should clients prepare to react to these changes?
It’s a top-down approach that all comes down to compliance. A culture of compliance is no longer a lofty goal or a cliché; it is now a regulatory expectation. There needs to be a robust compliance program, actual implementation, and accountability. Clients should be prepared and able to effectively manage the SEC examinations. Managers need to take time to understand regulatory priorities and expectations before an exam.
What is the current regulatory regime's appetite for outsourcing the compliance function?
There is no requirement for firms to employ a full-time person to service compliance. However, the worries about outsourcing certain functions, particularly the compliance officer function, may lead to weakened compliance culture. The opportunity of outsourcing creates a gap between the compliance function and the operations, decision makers and day-to-day activities. Outsourcing can be effective and sufficient, but management needs to resist setting it and forgetting it.
With October being cybersecurity awareness month it is an important time to ensure your firm and employees are aware of and using best practices, and security policies and procedures. Risk mitigation is needed to protect both the firm and its employees from savvy hackers and attacks. Data breaches continue to wreak havoc on businesses, and the cost is continuously rising. According to the Ponemon Institute, the total average cost of a data breach is now $4 million, up from $3.8 million in 2015. Hackers have everything to gain while your firm bears reputational and operational harm.
While companywide policies should reflect long-range expectations and corporate best practices, they should also include tactical recommendations that employees can follow to ensure they are complying with the company’s overall risk strategy. To get started here are just a few pieces of advice we offer our investment firm clients and remember to not only inform employees on what to do, but also what not to do.
In honor of October being National Cyber Security Awareness Month, we’ll be bringing helpful articles on a range of topics starting with this one on understanding malware.
We’re also debuting our first interactive game, FreEze!, where your challenge is to hit malware before it hits you (à la Space Invaders). Play the game below or keep reading for more on malware -- or do both!
Play FreEze and be a Malware Fighter
As of Wednesday, October 5, 2016, computer models continue to show Hurricane Matthew traveling along the southern eastern states starting in Miami early Friday morning and reaching Norfolk, VA early Monday morning. At this point, it’s too early to determine if Hurricane Matthew will head out to sea once it reaches Virginia or continue up to the Northeastern states.
Whether you’re in the south or north, now is the time to prepare your office and home for a potential impact of the storm. The following is a high level review of continuity steps you should consider:
Communicating with Employees
If you haven’t already, create a communication process to ensure you can notify your employees and/or clients. For internal communications, you can use an employee call tree which can be created in word or excel, create a distribution list in your mobile device or subscribe to an automated notification system. Firms must ensure messages are communicated to employees (or clients) properly and in a timely manner. Using a process will ensure all employees receive the same message immediately via email, phone call and/or text message. Whichever method selected, ensure there is a dedicated employee that is aware of their role and prepared to send the communication when appropriate.
Employees’ Work Locations
If your plan is to have employees work remotely should an incident occur, steps should be taken to ensure that employees will have access to all required resources for performing their daily tasks. This includes checking to see that the company has adequate Citrix licenses and having employees do a test run.
To avoid questions and confusion, work location procedures should be clearly communicated to all employees in advance to ensure that any unexpected challenges are dealt with before any disaster.
Employee Remote Access Test
Before Hurricane Matthew reaches your office or home, validate employees have all of the required resources to work remotely. You can validate this process by having key employees do a remote access test to ensure any issues are addressed before an incident impacts your office. Here are some recommended steps to have your employees follow as part of the testing process:
Validate successful communication to internal and external dependencies
Confirm full functionality of required applications
Perform all critical business functions
Confirm access to vital records (key files and documents)
Ensure employees can receive incoming calls, while working remotely, by activating phone recovery procedures or using phone redirect instructions
Disaster Recovery Activations
Depending on the impact of Hurricane Matthew, some firms may need to activate their disaster recovery systems. We recommend you review the activation procedures now to ensure a smooth transition of the systems, if needed.
In Part Three of our Risk Outlook Webinar Series, Michael Corcione, Managing Director of Cordium, spoke about compliance and cybersecurity trends in the investment industry. Although cybersecurity risks and struggles can vary from firm to firm, it is important to address a number of key areas.
Continue reading for quick takeaways or scroll down to watch the 30 minute video replay.
Good security can be achieved as firms move from reactive to proactive strategies. Firms usually start with the goal of checking the box for regulators, but they need to get beyond the 'check-the-box' exercises and test controls. The SEC’s 2015 cybersecurity guidance update provided more specific insights on cybersecurity focus areas for investment firms - governance and risk assessments, training and awareness, incident response, data loss prevention, access rights controls, and vendor risk management. Hedge funds and investment firms should use this as a framework, understand how they have addressed these areas and where they need to improve.
A good cybersecurity program starts with the leadership team, and they need to set the tone from the top down. This way everybody understands the impact of risk and its effects on the firm. Leaders should acknowledge risk, understand risk, and lead ongoing discussions firm-wide.