Three Hedge Fund Cybersecurity Tips

Gartner believes that the worldwide spend on cybersecurity will hit $101bn in 2018, up from $75bn in 2015 and RSA, in its 2016 State of Cybersecurity survey, found that 82% boards are concerned about cybersecurity. The increased spend doesn’t seem to be making boards feel safer, or better protected, so what can they do to improve confidence levels and protect their firms against cyberattacks?

Tip One: Simplify your use of encryption keys and certificates.

In a report by Venafi and Vanson Bourne, 90% of surveyed CIOs felt vulnerable to cyberattack because they trusted blindly in security keys and certificates and worried that encrypted traffic could be used to hide an attack. 80% also believe that stolen encryption keys and digital certificates will become the next big market for hackers. Since encryption keys and certificates are the foundation of most cybersecurity solutions, firms have no choice but to live with them and manage them in line with best practice guidance and recommendations. An encryption key lifecycle management plan will bring order to the process of generating, distributing and destroying keys at the end of their life. It will also outline a disaster recovery plan, what happens if a key is lost or compromised and recommended backups for business continuity.

Tip Two: Teach employees how to spot a potential cybersecurity threat.

Human hacking has surpassed automated attacks as the top cybersecurity threat, according to Computer Weekly. Common human hacking techniques include pretexting, where a hacker poses as an employee or similar and attempts to trick an employee into revealing details that enable the hacker to gain access to the corporate network or admin credentials; baiting, where an interesting looking, but infected USB device is left lying around where employees can find it and insert it into their machine; and spear phishing, where an individual or organisation is targeted by a bogus email and contains a link to a site where credentials are required. Scareware tricks a user into thinking they have got a virus or malware infection, then swiftly offers a fix, which is in fact, malware. Employees need to be taught how to identify potential threats so they can adapt their behavior. However, with a distinct lack of hands on, qualified and experienced trainers available it could be tricky for firms to do this effectively themselves.

Tip Three: Employ behavioral analytic techniques to identify cyberattack patterns.

FireEye, in their 2015 Annual Mandiant M-Trends Report, found that there had been a drop in the average number of days that attackers were present on a victim’s network without being discovered. Although this is positive in many ways, it is clear that much damage can be done before an attacker is discovered. Since many cyberattacks follow the same basic formula, behavioral analytics uses a combination of artificial intelligence, predictive analytics and data to identify threats before they cause damage. At the very least, firms should be monitoring access activity and administrative activity on the security controls they have in place, such as password vaults, two-factor authentication and data encryption to identify if and when attacks are taking place.

As technology becomes more sophisticated, so do cyberattacks. Moving offline with baiting and pretexting is unexpected in this technologically advanced world, and systems and users must be adequately prepared.