IBDs: Keep your head — or some IT supervision — in the cloud.
Independent broker-dealer Lincoln Financial Securities found out the hard way what happens when an OSJ’s cloud server vendor fails to protect customer information from hackers.
As part of a FINRA enforcement action, the Fort Wayne, Indiana-based firm agreed to a censure and a $650,000 fine for failing to reasonably "safeguard confidential customer data" and "supervise and retain consolidated reports."
According to FINRA, foreign hackers penetrated the OSJ's cloud-based servers and had access to customers’ nonpublic personal information. In a letter of acceptance, waiver and consent, FINRA faulted Lincoln for failing to monitor or test the third party vendor’s information security.
FAILED TO ADOPT
FINRA also alleged that the IBD failed to adopt reasonable data security policies that included specific firewall policies and related testing, and cited violations of Rule 30 of Regulation S-P, which requires the protection of customer records and information.
-
As insurers begin to digest the information released this week by the Financial Stability Oversight Council of the U.S. Treasury Dept. qualifying and clarifying systemic risk, the SEC issued guidelines that laid out the kind of information companies should disclose regarding cyber events that could lead to financial losses.
October 17 -
SEC officials warn many advisors and brokers have next to no cybersecurity policies in place, exposing them to data breaches and potential enforcement actions.
February 25 -
In the digital age, advisors are prime victims for attackers seeking pertinent information. Here are some preventative tips to fend off cyber-attacks.
January 21
In a statement, Lincoln "accepted and consented to the AWC, without admitting or denying the findings." The firm said it has implemented "corrective actions or enhancements" to address the security of confidential customer information and account statements.
"Firms must go the extra mile to protect customer information and not just rely on hiring a third party," warned financial consultant Cipperman Compliance Services, in one of its regulatory releases. "FINRA will hold broker-dealers strictly liable for data breaches, even those occurring at the vendor."
Legal cybersecurity expert Kenneth Rashbaum agrees.
"FINRA has sent a loud and clear message that broker dealers are ultimately responsible for data that place with third parties," says Rashbaum, partner and head of privacy and cybersecurity practice at Barton in New York. "This is settled law but the agency by the amount of the fine apparently believes a reminder is necessary due to the growing amount of data placed with third parties such as cloud providers."
