The following article originally appeared in Opalesque's Private Equity Strategies.
The role of the private equity CTO has changed significantly. New technology along with a growing list of cybersecurity threats have placed more demands on the IT department than ever before. According to a new survey of private equity CTOs from Eze Castle Integration, these demands have led to an evolution in the role of the CTO away from simply maintaining hardware and workflows and into making the CTO an integral part of information security and compliance support.
For 2017, respondents to the survey said that their key priorities were cybersecurity, improving customer experience and updating older technologies. Outsourcing some business functions and technology infrastructure to cloud services providers and others also made the list in a big way, with firms looking to outsource a variety of operations.
None of this comes as a surprise to Eze Castle’s Chief Strategy Officer, Mark Coriaty. He says that private equity CTOs have been looking to companies like Eze Castle for those new technologies as well as guidance on how best to implement them.
“Outsourcing has grown significantly over the past three years. Firms are looking for guidance, advice and managed services capabilities,”Coriaty tells Private Equity Strategies. “Private equity firms, specifically, are looking closely at how they manage and maintain data securely. Many firms lack a centralized data source. We can provide a private cloud that allows for centralization and data management.” He adds that Eze Castle also works with CTOs on a consulting basis to help them learn about best practices for information security and maintaining compliance.
Categorized under: Outsourcing
As you’re probably aware, the topic of cybersecurity has been splashed prominently across headlines lately. Earlier this year, the former US director of national intelligence, James Clapper, identified cybersecurity as the top global threat.
In his testimony before the Senate Armed Services Committee, Clapper stated “I think the private sector needs to up its game on cyber security and not just wait for the government to provide perfect warning or a magic solution.” So what should you be doing to better protect your firm’s critical systems and data?
The truth is both large, well-established hedge funds and smaller startups are equally at risk of intrusion. Hackers may target large firms because they see an opportunity to profit from their substantial asset pools. Additionally, they might be after the notoriety associated with successfully hacking a well-known fund’s critical systems, especially in cases that will likely garner media attention. For smaller funds, hackers are likely after intellectual property, namely business plans, market forecasts and investment strategies.
Last week, we shared some important questions to include in hedge fund technology RFPs, focusing on Staffing, Client Service Model and User Support. In today’s article, let’s dive back into the RFP process, and look at some questions on Business Continuity & Disaster Recovery Plans, Backup & Retention of Information, Data Security and Intrusion Detection & Incident Response.
Business Continuity & Disaster Recovery Plans
Does your company have a written policy and program in place for business continuity and disaster recovery?
Have your company’s policies and programs for business continuity and disaster recovery been fully implemented? If not fully implemented, please discuss those areas in detail and explain any plans to address them.
We’ve all heard the saying, “there are no stupid questions,” but when it comes to technology it is easy to feel undereducated. Knowing what to ask a hedge fund technology provider not only makes you look smart (or smarter!) but also ensures you get the right solution.hedge fund tech guidebook
In this article we’ll look at questions around Staffing, Client Service Model and User Support for your hedge fund technology Request for Proposal. Next week we’ll give questions for DR Plans, Information Backup & Retention and Data Security.
Staffing and Skills
Provide the total number of employees (current year and past year). Please show numbers for overall staff as well as a breakdown by function (e.g., developers, client service, etc.).
Provide the number of employees gained and lost (current year and past year).
Describe the organizational structure of your company. Please detail the roles specific to your business (e.g., engineers, client managers, trainers, QA, etc.)
How many full-time employees are assigned to these particular roles, by functional and geographic split?
What is the anticipated project resource profile through the stages of the implementation process?
When it comes to cybersecurity, the list of haves and have nots is constantly evolving due to the changing regulatory and threat landscape. In case you missed it, we hosted a webinar this week on Cybersecurity Basics for Asset Managers, during which we uncovered various elements within three primary cybersecurity layers: from Tier 0 (Basic Protection) to Tier 1 (Industry Standard) to Tier 2 (Advanced Protection).
How does your firm stack up when it comes to your cybersecurity practices? Watch the replay below and find out where you fit in.
Tier 0: We call this level Tier 0 in part because, well, there’s zero chance your firm will have long-term success in thwarting cyber risks if you don’t employ these basic security measures.
I just finished Season 1 of Showtime’s ‘Billions’ and can’t resist calling out the horrible IT security on a key character’s laptop. ‘Billions’ centers on a multi-billion dollar CT hedge fund and federal prosecutors looking to take them down for financial crimes. [Spoiler Alert] As season 1 nears an end, US Attorney Chuck Rhoades easily logs into the laptop of his wife, who is also the hedge fund’s in-house psychiatrist. On the laptop he finds the incriminating evidence necessary to potentially take down Mr. Billions (aka Bobby "Axe" Axelrod).
From an IT security perspective, there were so many things wrong with this scene, but I’ll highlight three that any hedge fund, regardless of AUM, should consider:
First up: password security.
In ‘Billions’ they broke the golden rule of NEVER sharing your password, but beyond that, multi-factor authentication should have been implemented. Multi-factor authentication is established by requiring at least two authentication factors that are knowledge based (password), possession based (something you have – token, mobile phone) and/or inherence based (something you are – fingerprint or eye scan).
Eze Castle Integration’s Eze Managed Suite offering includes two-factor authentication via a tool called Duo. Duo combines knowledge based (password) with possession based (smartphone) authentication factors.
Hedge fund outsourcing is not a new trend, as buy-side firms have long dispersed the responsibility of many functions to third-party service providers more adept and accomplished at said functions. Technology, for example, is an area where many firms choose to leverage outsourced providers to manage complete or partial infrastructures, support projects or supplement on-site IT staffs. The benefits to outsourcing are numerous, but the true measure of a successful service provider relationship comes when an investment firm’s level of risk in using that provider is low.
Risks are everywhere, particularly in today’s cyber-focused environment. But the risk a hedge fund undertakes when outsourcing a function of its business to a third-party is enormous. Not only is the firm relinquishing control to an outside company, it also takes on the added burden of managing that company, in addition to its own.
It’s one thing to put faith in your service providers to do their jobs effectively. It’s another to ignore your own firm’s responsibility to manage that third party as a means of protecting your own firm. Successfully managing risk associated with third-party service provider relationships is a full-time job, especially for financial services firms working with dozens of various parties. Here are a few tips to help your firm properly manage third-party service provider risk:
They say the more things change, the more they stay the same. Turns out it’s a pretty accurate assessment of the hedge fund industry then and now.
You see, back in 2011 we hosted a “State of the Hedge Fund Industry” event that yielded some interesting trends and perspectives, and we thought it might be fun to not only look back at those trends, but compare them to what we’re seeing in today’s industry – more than five years later.
Like I said: the more things change, the more they stay the same.
Hedge Fund Market Trends & Challenges
THEN (2011): It’s been an interesting year thus far for hedge funds and other alternative investment firms, as inflows have been high but performance low. In addition to performance challenges, hedge funds continue to deal with increased competition for investments, and thus asset-raising remains a hurdle for many funds – regardless of their size or strategy.
Our friends at Ledgex Systems are doing some sweet things (obligatory Valentine’s Day reference!) with their portfolio and research management system that warrant a mention.
As a lookback, in 2016 Ledgex introduced new features and enhancements aligned to the needs of family offices, endowments and foundations, wealth advisors, consultants and other alternative asset allocators. These noteworthy features include:
Comprehensive Portfolio Visualization Tools
Ledgex’s visualization tools optimize the presentation of data and notification/alert capabilities, and innovative dashboards bring key information to launch pages via interactive charts and graphs. Ledgex’s data aggregation tools also allow users to drill down deeper into data that helps uncover actionable insights.
An Enhanced Portfolio Management Workshop
Building off the assumption that a well-designed Workshop has all the tools a person needs, Ledgex created its own Workshop within the portfolio management module. Ledgex Workshop is designed specifically to enrich portfolio monitoring and modeling functions including performance, attribution, contribution, analytics, PM modeling and peer group analysis. Workshop provides the features, tools and reporting capabilities users require in an efficient and intuitive interface.
Advanced Research Management Capabilities
These days the value of having a system that combines portfolio management with research management cannot be ignored – and Ledgex is exceling in this area. Ledgex’s advanced RMS features simplify gathering, management and input of manager information while surrounding data with process driven workflows and dashboards.
With the Ledgex platform, users can collect and input manager data via a secure questionnaire or utilize the sophisticated email ‘listener’ tool which vastly simplifies the intake of enormous amounts of manager emails and documents. Ledgex then surrounds the data with advanced work-flows guided by sound research methodology and presents the most important information.
Categorized under: Software
When evaluating a cloud services provider there are a lot of factors to take into consideration: features & functionalities, security protections, provider experience, and industry certifications just to name a few. We've identified some of the most important questions today's investment management firms should be asking cloud services providers during the selection process.
Five or seven years ago, these questions would probably be fairly basic in nature. Does the infrastructure isolate individual client environments? (Yes). Can the cloud environment scale to meet a firm's growing resource needs? (Yes). In 2017, we can safely assume you understand the basics of the cloud, so the questions we've identified move beyond the basic and focus on critical infrastructure, security and support questions your cloud provider should be able to address.
Top Ten Questions to Consider:
I'm most concerned about the security of my data. What types of security layers do you employ across the cloud platform and your broader organization to guarantee the safety of my firm's information?
Does your cloud leverage proactive security technologies such as intrusion detection and prevention, next-generation firewalls and regular vulnerability assessments and/or penetration tests?