CyberMaterial

Nation States undermine the integrity of another nation’s financial services sector through cyber terrorism. Cyber terrorism propagates harm in the same way as any other crime: physical or digital, economic, psychological, reputational, and social or societal.  Cyberwarfare is characteristically a “persistent form of engagement”. Effective risk mitigation depends on strategic investment into effective controls and continuous alignment with international standards and continually adapting to regulatory obligations.

Hacktivists, aggrieved about the perceived lack of engagement into environmental, social, or ethical activities, or perceived unethical or immoral activities undertaken by a PE Firm or by stakeholders.

Organized criminals intend to use personal data or materially non-public data for nefarious purposes.

Nation States undermine the integrity of another nation’s financial services sector through cyber terrorism. Cyber terrorism propagates harm in the same way as any other crime: physical or digital, economic, psychological, reputational, and social or societal.  Cyberwarfare is characteristically a “persistent form of engagement”. Effective risk mitigation depends on strategic investment into effective controls and continuous alignment with international standards and continually adapting to regulatory obligations.

Hacktivists, aggrieved about the perceived lack of engagement into environmental, social, or ethical activities, or perceived unethical or immoral activities undertaken by a PE Firm or by stakeholders.

Organized criminals intend to use personal data or materially non-public data for nefarious purposes.

Contact your investment firm and other financial institutions immediately.  If you think your personal financial information has been stolen, contact your broker-dealer, investment adviser, or other financial professionals immediately to report the problem.  You should also contact any other financial institutions where you have accounts that may be impacted by the loss of your personal financial information. These may include banks, credit card companies, or insurance companies. Please remember to document any conversations with your investment or financial firms in writing.

Change your online account passwords.  Immediately change the password for any investment or financial accounts associated with the compromised personal financial information.  Always remember to use strong passwords that are not easy to guess, consisting of at least eight or more characters that include symbols, numbers, and both capital and lowercase letters.

Consider closing compromised accounts.  If you notice any unauthorized access to your investment account, you may want to ask your investment firm to close the account and move the assets to a new account.  You should consult your investment firm about the best way to handle closing an account if you choose to do so.

Activate two-step verification, if available.  Your brokerage firm or investment adviser may offer a two-step verification process for gaining access to your online accounts.  With a two-step verification process, each time anyone attempts to log into your account through an unrecognized device (i.e., a device you have not previously authorized on the account), your investment firm sends a unique code to either your e-mail or cell phone.  Before anyone can gain access to your account, they must enter this code and your password.  Activating this added layer of security may help reduce the risk of unauthorized access to your accounts by identity thieves.

Monitor your investment accounts for suspicious activity.  Closely monitor your investment accounts for any suspicious activity.  Look out for any changes to your account information that you do not recognize (e.g., a change to your address, phone number, e-mail address, account number, or external banking information). You should also confirm that you authorized all of the transactions that appear in your account statements and trade confirmations.  If you find any suspicious activity, immediately report it to your investment firm.  Please remember to document any conversations with your investment firm in writing and provide a copy to your investment firm.

Place a fraud alert on your credit file.  Placing an initial fraud alert in your credit file provides notice to potential creditors (e.g., banks and credit card companies) that you may have been a victim of fraud or identity theft and will help reduce the risk that an identity thief can use your personal financial information to open new accounts.

Monitor your credit reports.  After you place an initial fraud alert in your credit file, you are entitled to obtain a free copy of your credit report from each of the credit bureaus.  Check each of your reports for signs of fraud, such as an unknown account, a credit check or inquiry to your credit file that you do not know about, an employer you have never worked for, or unfamiliar personal information.

Consider creating an identity theft report.  If a breach in your personal financial information results in identity theft, you may want to consider creating an identity theft report.  An Identity Theft Report helps you deal with credit reporting companies, debt collectors, and businesses that opened accounts in your name. Creating an Identity Theft Report involves three steps: 1. Report the identity theft to the Federal Trade Commission (FTC) by completing the FTC’s online complaint form at www.identitytheft.gov 2. Contact your local police department about the identity theft 3. Attach your FTC Identity Theft Affidavit to your police report to make an Identity Theft Report.

Document all communications in writing.  Remember to document, in writing, and keep copies of any communications you have related to your identity theft.

Advanced persistent threats: This method employs a combination of the other methods (discussed below) to evade discovery, whilst gathering information surreptitiously over time. Through this coordinated and subvert approach threat actors are able to precisely target the weakest target personnel in a PE anyone connected to a PE Firm.

Social Engineering: This method requires gaining the trust of individuals who are the least cybersecurity proficient persons in a PE Firm. Thereby, exploiting a PE Firm’s vulnerabilities by riding on weaknesses in the “human perimeter’s” awareness to cyber risk.

Phishing: This method, like social engineering, exploits vulnerabilities through weaknesses in the human perimeter. PE Firms forget that their human perimeter also encompasses their service providers, such as third-party custodians or fund administrators. Many PE Firms still depend far too much on email as a form of communication with these providers. The sophistication and quality of these fake notices have greatly improved, making them almost indistinguishable from legitimate sources. Phishing also succeeds by targeting overworked personnel at these service providers, who typically deal with a high volume of emails. This high-stress scenario increases the likelihood of phishing emails being mistaken as legitimate. It is important to invest in penetration testing, multi-factor authentication, and effective workflow design together with service providers

Advanced persistent threats: This method employs a combination of the other methods (discussed below) to evade discovery, whilst gathering information surreptitiously over time. Through this coordinated and subvert approach threat actors are able to precisely target the weakest target personnel in a PE anyone connected to a PE Firm.

Social Engineering: This method requires gaining the trust of individuals who are the least cybersecurity proficient persons in a PE Firm. Thereby, exploiting a PE Firm’s vulnerabilities by riding on weaknesses in the “human perimeter’s” awareness to cyber risk.

Phishing: This method, like social engineering, exploits vulnerabilities through weaknesses in the human perimeter. PE Firms forget that their human perimeter also encompasses their service providers, such as third-party custodians or fund administrators. Many PE Firms still depend far too much on email as a form of communication with these providers. The sophistication and quality of these fake notices have greatly improved, making them almost indistinguishable from legitimate sources. Phishing also succeeds by targeting overworked personnel at these service providers, who typically deal with a high volume of emails. This high-stress scenario increases the likelihood of phishing emails being mistaken as legitimate. It is important to invest in penetration testing, multi-factor authentication, and effective workflow design together with service providers

Failure to identify due diligence responsibilities. During the diligence stage of the investment, there may be confusion around which party is responsible for surfacing and mitigating potential security issues. Let’s be clear – the responsibility lies with the investor, who must conduct robust diligence to validate and verify the potential investment’s claims. What’s also clear is that the investment target should be an active participant in this phase of the process, providing supporting information about the organization’s security performance over time. By doing so, the target can showcase the organization’s commitment to managing enterprise risk, which should increase enterprise value.

Not asking the right questions. For years, cyber diligence consisted of one question: “Have you ever experienced a breach?” For most targets, the answer to that question is a resounding “no,” regardless of the veracity of that statement. Investors need to go beyond this simple question, exploring, for example, the target’s data protection strategy, the types of technologies it has in place to mitigate risk, executive leadership, and employee training, in order to gain a broader understanding.

Untapped data. While asking more questions is important, investors must also seek out quantitative, objective security performance information. Historically, the due diligence process has largely relied on qualitative data based on written or in-person interviews with executives and board members, which frequently produces subjective, emotionally-driven results. When evaluating the potential risk an organization may inherit through an investment, it’s best to avoid gut feelings and focus on the facts. While there is value to hearing directly from executives, qualitative analysis should be supplemented with objective, straightforward measurements of security successes and challenges throughout the period. Security ratings provide significant, relevant insight here.

Security monitoring. Cybersecurity is dynamic and things can change quickly. Investors often assess the status of an investment’s cybersecurity environment at the beginning of the relationship and fail to monitor the environment throughout the investment period. Failing to continuously monitor the security environment leads to a lack of visibility into risk and potential threats. Just as sales teams report on leads and revenue quarterly, cybersecurity teams should monitor and report on the state of the organization’s security strategy to interested parties on an ongoing basis.

Lack of business context. More often than not, those driving the due diligence processes are not cybersecurity professionals, which means that they need cybersecurity metrics to be contextualized against potential business impact. For example, it is not enough to share that one million records were exposed in a data breach; investors also need to know the losses the business incurred as a result. Investors should be sure to ask questions that frame these metrics within the context of business impact, such as, “How will this impact stock price, revenue, and our brand’s reputation?”

Failure to identify due diligence responsibilities. During the diligence stage of the investment, there may be confusion around which party is responsible for surfacing and mitigating potential security issues. Let’s be clear – the responsibility lies with the investor, who must conduct robust diligence to validate and verify the potential investment’s claims. What’s also clear is that the investment target should be an active participant in this phase of the process, providing supporting information about the organization’s security performance over time. By doing so, the target can showcase the organization’s commitment to managing enterprise risk, which should increase enterprise value.

Not asking the right questions. For years, cyber diligence consisted of one question: “Have you ever experienced a breach?” For most targets, the answer to that question is a resounding “no,” regardless of the veracity of that statement. Investors need to go beyond this simple question, exploring, for example, the target’s data protection strategy, the types of technologies it has in place to mitigate risk, executive leadership, and employee training, in order to gain a broader understanding.

Untapped data. While asking more questions is important, investors must also seek out quantitative, objective security performance information. Historically, the due diligence process has largely relied on qualitative data based on written or in-person interviews with executives and board members, which frequently produces subjective, emotionally-driven results. When evaluating the potential risk an organization may inherit through an investment, it’s best to avoid gut feelings and focus on the facts. While there is value to hearing directly from executives, qualitative analysis should be supplemented with objective, straightforward measurements of security successes and challenges throughout the period. Security ratings provide significant, relevant insight here.

Security monitoring. Cybersecurity is dynamic and things can change quickly. Investors often assess the status of an investment’s cybersecurity environment at the beginning of the relationship and fail to monitor the environment throughout the investment period. Failing to continuously monitor the security environment leads to a lack of visibility into risk and potential threats. Just as sales teams report on leads and revenue quarterly, cybersecurity teams should monitor and report on the state of the organization’s security strategy to interested parties on an ongoing basis.

Lack of business context. More often than not, those driving the due diligence processes are not cybersecurity professionals, which means that they need cybersecurity metrics to be contextualized against potential business impact. For example, it is not enough to share that one million records were exposed in a data breach; investors also need to know the losses the business incurred as a result. Investors should be sure to ask questions that frame these metrics within the context of business impact, such as, “How will this impact stock price, revenue, and our brand’s reputation?”

A PE Firms’ most critical asset is information. Vulnerabilities exist in the nature and movement of data, and threat actors seek out weaknesses whilst data is static, in transition, or in motion through interconnected entities.