Financial Advisors and Clients Increasingly Concerned About Threats from Russian Actors Retaliating Against America’s Support of Ukraine
Can events thousands of miles from your office threaten your business?
Almost 4,700 miles from New York, the Russian invasion of Ukraine put the world on edge and according to some, set in motion new and unusual “fifth-generation” modes of warfare. This could include cyber-attacks aimed at private enterprises in the United States as Russia retaliates in non-kinetic ways against American support for Ukraine.
Others say that private American businesses face a low risk of Russia-based cyberattacks due to America’s ability to counterattack, or that threats specific to the wealth management industry remain low because infrastructure and banking constitute the true high value targets for retaliating state or quasi-state actors.
Regardless of whether the Ukraine conflict increased this risk, hackers purportedly operating from Russia have in the past demonstrated their ability and willingness to infiltrate businesses and organizations across the globe, including those on American soil.
WSR Reader Survey Results: Cybersecurity Concerns
In light of these concerns, we polled WSR financial advisor readers to hear their views on the current state of cybersecurity risks.
The key take-away? Concerns among advisors and their clients about cybersecurity increased significantly as of April 2022, compared to this time a year ago.
Major summary highlights are as follows:
- 64% of financial advisors are “significantly more concerned” about cybersecurity risks now than this time a year ago.
- 53% of financial advisors are “reasonably confident” that their cybersecurity protections are sufficient against potential cyberattacks.
- 38% of financial advisors are “fairly concerned” that their current cybersecurity protections may not be sufficient against potential cyberattacks.
- 9% of financial advisors “have no concerns” about current cybersecurity protections being potentially insufficient.
- Of the financial advisors who are more concerned about cybersecurity risks this year versus the year-ago period, 82% believe the current Russia-Ukraine conflict and Western sanctions against Russia raise the likelihood of cyberattacks from Russia directed at U.S. businesses specifically.
- 41% of financial advisors have fielded at least one question from clients in 2022 about cybersecurity risks to their accounts.
Will Russian Hackers Target American Firms?
Cybersecurity solutions provider Entreda’s Co-Founder and CEO Sid Yenamandra believes that U.S. businesses – including wealth management firms – could face an increased risk of cyberattacks stemming from the Russia-Ukraine conflict.
“There’s heightened focus on information safety given the current geopolitical environment,” Yenamandra says. “Russia has traditionally topped the list of leading cyberattacks so U.S.-based businesses may be more susceptible given the country’s support of Ukraine.”
Clayton Chandler, Chief Information Security Officer of Advisor Group, says his firm has seen an uptick in concerns expressed by financial advisors and clients about cybersecurity due to the conflict.
“We have always encouraged both our affiliated financial professionals and their clients to reach out to us with any cybersecurity-related questions or concerns,” Chandler notes. “Lately, we’ve seen an increase in the number of folks taking us up on that offer.”
Ensuring Your Business’ Security
Yenamandra points out that, regardless of any geopolitical conflict, various forms of cybersecurity risk threaten businesses. He advises a number of core actions to prevent threats from all vectors, including ensuring that a firm’s “security teams understand and are trained on various cybersecurity threats.”
Yenamandra suggests additional steps including “making sure you have endpoint protection installed on any device that connects to the firm’s network” to protect against breaches at the point of personal laptops and mobile devices, conducting due diligence on third-party vendors and “reviewing your cybersecurity insurance, ensuring it is current, and that you are following their protocols in case of a breach.”
According to Chandler, Advisor Group prepares for cybersecurity threats – especially those from Russian actors – through a multi-pronged strategy that includes optimizing defenses, promoting user awareness and engaging in readiness preparations.
The firm optimizes defenses “to identify, block and detect any potential cyber threats stemming from a Russian nexus,” says Chandler, “by tuning our technical controls through cyber threat intelligence sharing with industry and government peers, and … by going on the offensive and proactively attempting to hack our own systems.”
Readiness preparations include dry running scenarios to ensure a measured response and anticipate responses, such as whether to pay ransom and how to contact law enforcement. “We do this across our technical, operations and leadership teams across a variety of cyber scenarios, in particular those most commonly associated with Russian tactics.”
In addition to preparations for risks originating from Russia, Chandler states that remote work, which increased significantly due to the pandemic, creates risks that firms must address, including increased reliance on technology partners such as virtual private network and internet service providers, as well as supply chain risks, causing firms to collaborate with partners and providers like never before.
How Cybersecurity Fits Into Broader Tech Stacks
Of course, cybersecurity is not an island to itself, but exists within the space of broader tech stacks, and firms must take the full tech stack into account when implementing cybersecurity protections.
Scott Lamont, Wealth Technology Strategist at F2 Strategy, advises firms to think about integrating cybersecurity with the full tech stack “in every discussion they are having.”
According to Lamont, “Every component of work that touches client data needs to include considerations of cybersecurity. Cybersecurity isn’t just about building the best fortress around your data. It’s about understanding how your data is being secured when it’s moving between any two points.”
As an example, Lamont points to upgrading code within applications, which can introduce new vulnerabilities to attack.
Additionally, Lamont suggests testing best practices on a firm’s infrastructure and employees and developing a cybersecurity-focused mindset in decision-making.
Beyond Russia
Lamont also states that “[i]t matters less why attacks might happen – the geopolitical climate might change who has an interest in committing a cybercrime, but wealth firms need to be focused on protecting their client’s assets against any type of attack, regardless of motivation, geography, etc.”
Tony Brumley, Chief Technology Officer at Liberty Wealth Advisors, notes that the most common attack vector today is phishing emails, and the best line of defense is security awareness training, for which “the overarching goal is to turn employees into ‘human firewalls,’ creating the first line of defense.”
In Brumley’s view, a firm needs multiple layers of security to protect clients’ personal data and prevent bad actors from entering the company’s environment, as well as strong passwords and multi-factor authentication to close other lines of attack.
If there is a lesson to be drawn from the experts, it’s not necessarily a cheerful one, at least in terms of risk duration.
It would appear that cybersecurity risks will continue to be a constantly evolving threat to wealth management firms, their financial advisors and clients long after the Russia-Ukraine conflict ends.
Julius Buchanan, Senior Contributing Editor at Wealth Solutions Report, can be reached at jbuchanan@wealthsolutionsreport.com
