Complying with SEC, NFA FINRA Cybersecurity Standards

 Both the SEC, NFA and FINRA have indicated that they will put heavy emphasis on cybersecurity enforcement throughout 2018. While FINRA is explicit – among other things, it publishes a cybersecurity checklist and a detailed report on best practices – the SEC’s guidance is far more general. This causes some confusion among affected companies regarding how to develop controls and internal policies in line with SEC, NFA FINRA cybersecurity standards.

Owing to different data environments, risks, and vulnerabilities, the precise details of SEC, NFA FINRA cybersecurity compliance will vary at every enterprise, but there are a few general best practices that all organizations should adhere to:

Use an Integrated Risk Management Approach to Policymaking

FINRA mentions in its Report on Cybersecurity Practices that “A sound governance framework with strong leadership is essential,” and the SEC, NFA focuses on “governance and risk assessment” during its cybersecurity audits. Organizations should develop their SEC, NFA FINRA cybersecurity policies using an integrated risk management approach. IRM eliminates silos and fosters a top-down, data-centric, and risk management-based culture throughout the organization.

Have Clear, Consistent Security Policies

In its latest risk alert, the SEC, NFA reported that nearly all of the firms it audited had written cybersecurity policies. However, most of them had issues, such as contradictory and/or vague policies and policies that were not being uniformly enforced. Security policies and protocols must be clear, consistent, and make sense in light of the organization’s data environment and individual vulnerabilities and risks.

Conduct Regular Risk Assessments

FINRA considers risk assessments to be “foundational tools” in firms’ cybersecurity arsenals. Because the threat environment is continually changing, organizations must perform risk assessments on a regular basis to ensure that their technical controls and SEC, NFA FINRA cybersecurity policies and procedures are up to date.

Conduct Regular Employee Security Training

An organization’s biggest security vulnerability is its own people; most of the time, hackers break into systems not through brute force attacks but social engineering schemes such as phishing emails. For this reason, both the SEC, NFA and FINRA emphasize the importance of well-trained employees to preventing cyber attacks. Cyber security awareness training should be conducted on a regular and ongoing basis.

Make Sure Your Business Associates Are Secure

Over 60% of enterprise data breaches are traced back to third-party vendors of larger organizations, and SEC, NFA FINRA cybersecurity standards do not allow companies to pass the buck if one of their business associates is breached. FINRA’s report specifically instructs organizations to “manage cybersecurity risk exposures” by “exercising strong due diligence across the lifecycle of their vendor relationships,” and the SEC, NFA looks at “vendor management” during security audits.

The cybersecurity experts at Continuum GRC have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cybersecurity programs.

Continuum GRC is proactive cybersecurity®. Call 1-888-896-6207 to discuss your organization’s cybersecurity needs and find out how we can help your organization protect its systems and ensure compliance.

Gartner Is Shifting Its Focus Toward IRM, and You Should, Too

Over the summer, Gartner announced that it was moving its focus away from GRC and launching a new Magic Quadrant for integrated risk management, or IRM:

IRM enables simplification, automation and integration of strategic, operational and IT risk management processes and data. IRM goes beyond the traditional, compliance-driven GRC technology solutions to provide actionable insights that are aligned with business strategies, not just regulatory mandates.

Is this, as Gartner calls it, the end of the GRC era? Yes and no. Gartner’s announcement is part of a larger market shift towards adopting a risk-based, data-centric approach throughout the enterprise before any GRC or cybersecurity activities begin. This has always been the most prudent, proactive way to approach GRC and cybersecurity; if you do not understand what data you have, where it resides, and how it’s being processed and stored, it’s impossible to secure it. IRM also offers numerous advantages that go beyond better GRC and cybersecurity.

The data concentric  risk focus has been the foundation of our services and solutions since the company was founded,  said Michael Peters, CEO. You can trace this back to the year 2000 when I first embarked on my life’s work to change the industry and disrupt the dominant paradigms for risk management and cybersecurity.

Following are five reasons why organizations should embrace an IRM-first approach to data governance, compliance, and security.

IRM Eliminates Silos & Promotes a Security-Focused Culture

In a digital world where every employee operates a computer, cybersecurity and compliance are now everyone’s responsibility, from the C-suite down to the reception desk, and even extending to third-party vendors. IRM fosters a top-down, security-focused and risk management-based culture throughout the organization, eliminating silos and enabling organizations to identify situations where a risk factor in one area affects other areas.

IRM Improves Effectiveness & Cuts Costs

IRM identifies redundancies and inefficiencies in organizational GRC and cybersecurity, allowing organizations to eliminate processes that add no value, allocate funds and human resources more effectively, improve GRC and cybersecurity functions on all levels, and free up employees to work on projects that further the organization’s goals.

IRM Uncovers Opportunities

Risk isn’t always negative; businesses need to take risks to grow. By integrating risk management into overall organizational strategy, IRM treats risk management as a business driver, not a business cost. It allows organizations to see how risk management, compliance, and data security can further their business goals and uncovers opportunities to take calculated risks.

IRM Allows Organizations to Rapidly Respond to a Changing Regulatory Environment

The EU’s new General Data Protection Regulation (GDPR) is arguably the most sweeping data privacy law to date – and it is highly unlikely to be the last. As more transactions are digitized, more massive breaches on the scale of Equifax and Uber will occur, and consumers in the U.S. will pressure federal and state governments to enact similar protections. Organizations that take an IRM-based approach will be in a better position to comply with new data privacy legislation. Additionally, they will enjoy a competitive advantage in a market where customers are aware of data security risks and demanding that their data be handled securely.

The cybersecurity experts at Continuum GRC have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cybersecurity programs.

Continuum GRC is proactive cybersecurity®. Call 1-888-896-6207 to discuss your organization’s cybersecurity needs and find out how we can help your organization protect its systems and ensure compliance.

Uber Breach a Case Study in Awful Cyber and Business Ethics

The Uber breach, which compromised the data of 57 million drivers and customers worldwide, has just gone from bad to worse. Not only did the company wait for a year to disclose the hack, it scrambled to cover it up by forking over $100,000 in hush money to the hackers – which it funneled through its bug bounty program, no less, possibly in an attempt to keep the entire incident off regulators’ radar. As a result, Uber was facing multiple lawsuits, as well as investigations by governments in several countries.

Now, former Uber security analyst Ric Jacobs is accusing the company of having engaged in KGB-level corporate espionage. In a 37-page letter that has been submitted in the lawsuit competitor Waymo filed against Uber, accusing the latter of having stolen its company secrets, Jacobs claims he witnessed Uber engaging in all manner of unethical and, in some cases, illegal cyber spying, including:

• Hacking into an unnamed competitor’s database to obtain information on their employees for purposes of poaching.
• Hacking into a second company’s database to “steal ideas, exploit any identifiable weaknesses and identify drivers in order to recruit them to Uber.”
• Hacking mobile devices and networks to obtain metadata on opposition figures, politicians, and government regulators.
• Engaging in social engineering tactics to infiltrate private online groups for Uber drivers.
• Recruiting third-party vendors to steal information.
• Recording phone calls and bugging hotel and conference facilities.

A veritable case study in poor cybersecurity practices, awful data governance and risk management, and the consequences of having no cyber or business ethics, both the Uber breach and the newest allegations being leveled against the company contain cybersecurity lessons for us all.

Cybersecurity Lessons from the Newest Allegations Against Uber

When news of the Uber breach first broke, the focus was on the data governance and risk management mistakes Uber made that led to the hack, such as including login credentials in software code and storing the code on a Github repository, and the company’s attempts to hide the breach instead of promptly disclosing it The newest allegations have some things to teach everyone, too:

• The threat of cyber espionage and digital IP theft is quite real, regardless of the industry you operate in. Whether it’s employee data, a secret recipe, or a proprietary app, all companies have digital IP and trade secrets that other companies want to steal.
• The biggest vulnerability in your cybersecurity program is your own people. According to the court filing, Uber heavily engaged in social engineering tactics to steal information.
• Hackers may target your third-party vendors to get at your company.
• Securing employees’ mobile devices is just as important as securing your enterprise network and equipment.

Whether Uber will survive this latest firestorm is questionable, especially since, in a settlement with the FTC following a 2014 hack, Uber agreed to “not misrepresent in any manner, expressly or by implication… the extent to which Respondent protects the privacy, confidentiality, security, or integrity of any Personal Information.” At the time this settlement was being negotiated, Uber was in the process of covering up the 2016 hack, as well as possibly engaging in the cyber spying activities Jacobs has accused it of.

Notably, Uber’s failure to disclose, in and of itself, would be illegal under the EU’s new GDPR data privacy rules, set to take effect next May. As the Uber breach drama continues to unfold, don’t be surprised to see calls for similar data privacy legislation in the U.S.

The cybersecurity experts at Continuum GRC have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cybersecurity programs.

Continuum GRC is proactive cybersecurity®. Call 1-888-896-6207 to discuss your organization’s cybersecurity needs and find out how we can help your organization protect its systems and ensure compliance.