STP Institute

Checklist: 10 Ways to Mitigate Cybersecurity Risks to Your Hedge Fund

As a result of the COVID-19 pandemic, cybercrime is up nearly 600%. External attackers are able to breach organizational network parameters and gain access to local resources, and nearly every industry is on the hunt for solutions they can implement quickly and efficiently. And yes, that includes hedge fund companies. 

When it comes to your hedge fund, the impact of such an attack could be disastrous, both financially and to your fund’s reputation. 

First, let’s look at the four main types of potential cybersecurity breaches hedge funds are facing:

• Phishing Attacks: Typically conducted via email, attackers pose as someone else and encourage you or your employees to click on malicious links or provide private information. Hackers can also include malware in attachments to steal data.
• Malware: This malicious software can penetrate your network, giving cyberattackers control of your devices and allowing them to steal data.
• Ransomware: A specific type of malware, ransomware allows hackers to hold your data ransom (as the name suggests) by encrypting files on your computer or network. Victims of ransom attacks are forced to make payment to regain access to their information. 
• Physical Attacks: If you’re storing sensitive information in data centers, it could be compromised by someone physically entering the building and accessing it.

As a fund manager, protecting your internal investment strategy trade secrets and sensitive investor information from such threats is critical. Follow these 10 steps to ensure proper information security and data loss prevention at your hedge fund:

1. Ensure Proper Data Classification: Thanks to the financial services’ ongoing digital transformation, you’re required to collect more detailed investor information than ever before. It’s essential to understand how this information is being stored and categorized, as well as how to protect it.
2. Implement Multi-Factor Authentication: Requiring a secondary source of identity management significantly reduces the chance of employee or investor information being stolen.
3. Add Password Access Management (PAM): Eliminate weak plain text passwords along with the risk of employees knowing passwords by putting a PAM solution in place to ensure the management and sharing of passwords is always encrypted.
4. Use Single Sign On (SSO): Keeping all accounts in one place and granting access via a centralized identity provider reduces your risk profile and enhances data loss prevention.
5. Maintain an Audit Trail: Employees may be accessing multiple systems, all of which contain sensitive fund and investor information. Ensure all vendor systems have a traceable audit trail to track user activity. 
6. Enhance Email Security: Over 90% of cyberattacks are exposed via email vulnerabilities. Upgrading to Office 365 Enterprise 5 Tier provides enhanced security and threat detection measures. Phishing attack simulations can also help enforce the importance of email security diligence.
7. Use a Security Information and Event Management (SIEM) Solution: Aggregate and monitor your firewall, file, domain and email login information in a centralized location, which will empower IT teams to quickly identify real-time threats and enact incident response plans.
8. Implement Malware, Antivirus and Ransomware Protection: Use real-time monitoring and prevention software that can detect and prevent vulnerabilities to safeguard employee assets and investor data.
9. Prioritize Training and Education: Annual cybersecurity training and awareness programs are critical for spreading knowledge and encouraging a proactive mindset across your employee base. Consider awarding employees who bring up cybersecurity concerns and risks to foster a culture that understands the need to combat today’s ever-growing  threat landscape.
10. Consider Outsourcing Fund Administration: Maintain your focus on your core competencies – developing investment strategies and ensuring an exceptional end investor experience – by outsourcing fund administration to a third party with a mature cybersecurity program.