What's Happening?

Facebook Twitter Youtube Linkedin

NEED HELP? QUESTIONS@FIA.ORG.ZA

become A FIA member TODAY
member login

Cybersecurity: Building awareness and resilience in an ever more complex technology landscape

ARTICLE BY

  • Robyn Clay
  • Linktank

SHARE THIS POST

Earlier in 2023, I was speaking at a conference on Linktank’s specialist topic of finding, selecting, and implementing the right technology for advisory practices. Mid-way through, a member of the audience asked me for advice around solutions to assist in the mitigation of cybersecurity risks.  I did not have an answer for him.  Until that point, we had not put a special focus on this aspect of the technology stack – we simply assumed it was something that fell firmly into the realm of the software providers and IT support, those with the more technical know-how. Subsequent conversations with advisors and vendors, however, have put the item firmly on our agenda.

My explorations into the topic of cybersecurity highlighted just how vulnerable not only financial institutions are, but how every advice practice, every South African business and indeed all our clients, fall victim to these attacks on a regular basis.  I’m aware that there are a multitude of articles, by specialists who have a far better grasp on the subject than I do, but given the urgency of this topic, I’ve decided to add my voice. At the very least to highlight the requirement for all of us to build awareness and resilience in this space and to understand a bit more about what it all means.  Going forward it is critical to ensure that we ensure that any decisions about selecting and implementing technology prioritize a clear cybersecurity strategy as well.

The period over Covid 19 Lockdowns hastened the move to client engagements online and more of the implementation and financial planning activities also shifted into the Cloud. Many of us find this new way of working more efficient and more cost effective but it also comes with a whole new set of risks which every business, especially those in financial services, now must navigate.  The FSCA has drafted Standards which practices need to comply with, but I wasn’t sure how many actually have yet?  Turns out, not many.

In an article on ITWeb, in July 2023, Tracy Burrows for Rubrik wrote that “African financial services organizations have around 15 months to comply with the new Joint Standard: Cybersecurity and Cyber Resilience by the Financial Sector Conduct Authority (FSCA) and the South African Reserve Bank (SARB) Prudential Authority” but at time of writing a poll of participants revealed that only 2% are 100% prepared to implement the Joint Standard and an audit.  22% said they had completed a gap analysis and were swiftly moving to prepare for it.  28% were investigating the policy with a view to preparing and a further 28% had not yet investigated the policy. 18% responded ‘What are the Joint Standards?’ Moreover, when it comes to complying with the terms of any cybersecurity insurance, financial advisors have expressed how complex it is to understand the requirements, let alone comply with them.

There is clearly a critical need for better understanding and more awareness building for advisors, while vendors and support services actively work to ensure that we build technology solutions which keep our businesses, employees and our clients safe.  Saying this, however, making IT support teams entirely responsible for managing cybersecurity risk, or relying purely on software providers to ensure the safety of your data, is foolhardy.  Cybercriminals’ tactics evolve all the time, and our IT teams and software vendors can do all they can to keep up, but it is ultimately down to each user of technology to build their knowledge around the types of threats out there and stay vigilant.

Why the urgency and what are the types of risk?

South Africa is ranked amongst the highest cyber-attack regions in the World. According to INTERPOL’s African Cyberthreat Assessment Report 2022, a total of 230 million cyber threats were detected in South Africa, out of which 219 million, or 95.21%, were e-mail-based attacks. What’s worse is that the nation is already suffering from an alarming 100% increase in mobile banking application fraud and is experiencing on average 577 malware attacks every hour.”

And what are the loopholes in South Africa’s cyber security system that bad actors are taking advantage of? Basically,

  1. Poor investment in cyber security systems
  2. Lack of awareness across users of technology
  3. Poor law enforcement to act on cyberattack cases.

Where do we start to build awareness?

We, the users are our own first line of defense.  Make sure you and your team are aware of the most prevalent threats and how they work.  Most of the threats come via email with a variety of forms and outcomes:

  • Ransomware – business email compromise (BEC) and ransomware.
  • Phishing attacks – these are experience across email, Whatsapp, SMS platform, even QR codes are now used to get access to your information network.
  • Social engineering/Impersonation.

But there are other threats like:

  • Insider threats – posed by discontented employees or even ex-employees/colleagues.
  • Device mismanagement.
  • Weak passwords.
  • 3rd party risk – your technology infrastructure and email domain may be secure but we cannot assume the same for 3rd parties, especially clients using public email addresses.

The good news is that there are a growing number of service solutions who offer comprehensive course material advisors can utilize to build awareness.  Most of them will even ‘test’ staff members on their cybersecurity prowess.  Companies like Mimecast and Synaptic SA are just two which we have recently engaged with, but we intend to find more.

Where do we start – to build resilience?

As we gain a better understanding of how to mitigate risks, financial planning practices will start to hear more and more about:

  • Implementing robust security measures, next generation anti-virus solutions,
  • including firewalls,
  • antivirus software,
  • encryption,
  • secure data storage,
  • regular data backups,
  • multi-factor authentication, strong access controls, and incident response plans.

 

Building resilience means that a business has the processes and backups in place to “bounce back” if they have fallen into a cyberattack trap.  Sounds technical right? So, ensure that the team that is supporting you from an IT perspective is talking to you about these issues, ensuring necessary checks are in place and that your team and clients understand why the processes are required.

In summary, don’t let this be another case of “kicking the can down the road” because the consequences could put you out of business. Ask questions and find the right team to educate, advise and support you.

Sources:

Financial services must move to comply with new standards for cyber resilience, by Tracy Burrows for Rubrik.  18 July 2023 https://www.itweb.co.za/content/LPp6V7rBnoK7DKQz

What makes SA a target for cyber crime, what actions can be taken?
By Eleanor Barlow, Content Manager at SecurityHQ https://www.itweb.co.za/content/Pero37Z34ydMQb6m

Subscriber Terms and Conditions

  1. APPLICATION OF TERMS
    • These terms and conditions (“Subscriber Terms”) apply to the subscription by any qualifying member of the South African Underwriting Managers Association NPC (“SAUMA”) to the services and benefits offered by FIA Services (Pty) Ltd (“FIA Services”) under the SAUMA affiliation arrangement (“Subscription”).

  2. NATURE OF SUBSCRIPTION
    • A Subscription under this arrangement:
      • does not constitute membership of FIA NPC;
      • does not confer any voting rights or governance participation in FIA NPC; and
      • is governed solely by the contractual relationship between the Subscriber and FIA Services.

  1. ELIGIBILITY
    • To qualify for the Subscription, the applicant must, at the time of application, be a current paid-up member of SAUMA.
    • FIA Services will verify the applicant’s SAUMA membership status with SAUMA prior to activation, and may re-verify such status periodically.
    • If a Subscriber ceases to be a paid-up member of SAUMA, the Subscription will correspondingly be terminated.
    • Applicants are required to authorise FIA Services to confirm their SAUMA membership status with SAUMA as part of the application process.

  1. SERVICES
    • The Subscription entitles the Subscriber to the following benefits:
      • Complimentary access to the FIA CPD Platform;
      • Complimentary access to the FIA Insight Magazine (digital edition);
      • Advertising opportunities on FIA platforms at a discounted rate of 15% (fifteen percent) off the prevailing published rates; and
      • Invitations to attend FIA Technical Webinars annually.
    • FIA Services reserves the right to update, vary or substitute the Services from time to time, provided that the overall value and nature of the benefits remain materially the same.

  1. FEES AND PAYMENT
    • The monthly subscription fee is R260.00 (two hundred and sixty rand) for up to seven registered individuals (Key Individuals and Representatives), and R36.00 (thirty-six rand) per additional registered individual thereafter, excluding VAT.
    • The Subscriber shall provide FIA Services with the required details of each individual to be registered under the Subscription for the purposes of activation and billing.
    • All fees are exclusive of VAT, which shall be charged at the prevailing statutory rate.
    • Subscription fees are reviewed annually in March and may be adjusted with effect from 1 April.
    • Any changes to the Subscription, including but not limited to the number of Representatives and Key Individuals registered under the Subscription, may only be effected once annually during the annual review period in March of each year, with such changes taking effect from 1 April.
    • Subscription fees shall be billed monthly in arrears, unless the Subscriber elects an annual billing cycle at the time of application.
    • The Subscriber shall ensure that all billing information (including contact details, authorised signatories and bank account details) is kept accurate and up to date.
    • Non-payment of subscription fees may result in suspension of access to the Services until such fees are brought up to date.
    • The Subscriber acknowledges and agrees that all subscription fees payable under these Subscriber Terms may be collected by way of debit order, which shall be processed by the holding company, FIA NPC (The Financial Intermediary Association of South Africa), on behalf of FIA Services. Payment to FIA NPC shall be deemed to constitute valid and sufficient discharge of the Subscriber’s payment obligations to FIA Services under these Subscriber Terms.

  1. ONBOARDING
    • Onboarding will be conducted as a Subscription with FIA Services under the SAUMA affiliation arrangement.
    • Onboarding will not confer FIA NPC membership status or any associated rights.
    • Onboarding is conditional on confirmation of the Subscriber’s current SAUMA membership at the time of application

  1. DATA PROTECTION
    • FIA Services will process all personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) as set out in our POPIA policies.
    • By subscribing, the Subscriber authorises FIA Services to confirm their SAUMA membership status with SAUMA and to process personal information for the purposes of fulfilling the Subscription.

  1. TERMINATION
    • The Subscriber may terminate the Subscription by giving FIA Services one calendar month’s written notice.
    • FIA Services may terminate the Subscription on one calendar month’s written notice, or immediately if the Subscriber breaches these Subscriber Terms and fails to remedy such breach within 14 (fourteen) days of receiving written notice.
    • Termination of the SAUMA–FIA Services affiliation agreement shall not automatically terminate these Subscriber Terms.
    • Termination by the Subscriber shall not relieve the Subscriber of liability for any subscription fees accrued up to the effective date of termination.
    • FIA Services may suspend or terminate the Subscription with immediate effect in the event of non-payment of fees by the Subscriber.

  1. GENERAL
    • These Subscriber Terms are governed by the laws of the Republic of South Africa.
    • Any disputes arising under these Subscriber Terms shall be dealt with in accordance with the dispute resolution provisions contained in the FIA NPC membership terms and conditions, as modified to reflect that the contractual relationship is with FIA Services.
    • Any notices required under these Subscriber Terms may be validly delivered by email to the addresses provided in the Subscriber’s application form, and such notices shall be deemed received on the day of transmission if sent during business hours.
    • The Subscriber may not assign, cede or transfer any of its rights or obligations under these Subscriber Terms without the prior written consent of FIA Services.
    • No variation of these Subscriber Terms shall be of any force or effect unless reduced to writing and signed by both FIA Services and the Subscriber.