Any advisor who pictures teenagers in their parents’ basement when they think of computer hackers would be in for a rude awakening, according to a Morgan Stanley cybersecurity expert speaking on Sunday at the National Association of Plan Advisors annual 401(k) summit.
Cybersecurity threats to wealth managers and their clients aren’t are just coming from hobbyists. There are continuous, sophisticated and well-organized attacks on financial services firms by professionals from countries and independent groups alike, said Rachel Wilson, the head of Cybersecurity for Wealth Management Technology, Morgan Stanley. For those reasons and others, cybersecurity is “top of mind” for clients, and wealth managers need to be leery of the threat that has spurred a $90 billion cybersecurity industry, she said.
Wilson shared her perspectives on cybersecurity and the wealth management industry during a keynote presentation to a few hundreds attendees at the NAPA 401(k) Summit in Nashville on Sunday.
She’s been at Morgan Stanley just over a year now. Prior to working for the bank, Wilson spent nearly 15 years with the National Security Agency that included a stint running counter-terrorism operations.
A desire to continue to serve her country in the private sector is what Wilson said drove her to financial services. “This is people life’s work, this is their retirement plan … my job is to protect that legacy,” Wilson said.
Wilson told attendees that three major threats to financial services firms big and small right now are North Korea, hackers working on behalf of criminal organizations with malware and tricks that are difficult to spot.
To help fund itself, North Korea has approximately 6,000 professional hackers who, among other things, are in search of ways to steal money. They don’t just steal cryptocurrencies, either. Wilson said it’s widely believed that North Korea and groups it supports are behind digital bank heists that have successfully stolen millions of dollars from financial institutions, including a $60 million theft from Taiwan’s Far Eastern International Bank in October 2016.
“Sometime these are just like bank robberies except they don’t need the guns or the masks,” Wilson said.
State-sponsored attacks are the only ones that are severe. Wilson said the hackers working for governments like North Korea’s aren’t paid a lot of money, so on nights and weekends they offer themselves as for-hire mercenaries on the dark web, stealing information or creating software for other hackers to use.
Some hackers have intentions beyond monetary gain, too. So-called “hacktivists” use their software skills to support causes they believe in and financial services firms just land in their sights. Wilson said Canadian banks are constantly threatened because they work with and capitalize Canada’s prominent oil and gas industry, which hacktivists might oppose.
It’s safe to say few financial advisors have the cybersecurity expertise Wilson has, which is why banks hire people like her. But Wilson said she and her team can only do so much—that advisors and employees are the “weakest link in the chain.”
“Eighty percent of this is making sure your IT departments are doing the right things, and they know how to do that,” Wilson said.
What might seem like mundane tasks—downloading software patches, good password habits and even separating personal and business hardware—are critical to making sure any advisory business and its clients are safe.
Wilson keeps her personal and her work devices separate and said advisors should consider doing the same, so that they aren’t on websites or entering information on one that could be used to compromise the other.
She also recommended that everyone use virtual private networks (VPNs) and avoid public power cord stations and reject offers from rideshare service drivers to charge your phone in their vehicle, which could give someone access to your phone.
