Publicly Available Information Heightens Need for Cybersecurity Vigilance

For any business, “ports” that allow for communication generally need to be open (for example, ports 80 and 443 for websites, and port 500 for VPN access). While most of these ports allow you to engage in critical functions, there are often ports that remain open despite being unneeded or unused. These available ports present an attack surface that can be exploited.

A scary development in cybersecurity is that specialized skill is no longer required to hack into firms; indeed, “how-to” videos found on YouTube can be easily followed to create a breach. The point of a penetration test is to try to find vulnerabilities on your network before the bad guys do.

If you have been hacked or breached, there are certain sites on the web, such as Pastebin, where hackers post your information.

Criminal hackers search for any information that will make their jobs easier, and often search publicly available web tools for any vulnerable network devices, Cyber 51 LLC’s Martin Voelk and Ascendant’s Adam DiPaolo recently told attendees at Ascendant’s “Compliance Disruptors: Seismic Shifts of the Regulatory Landscape” conference.

Shodan.io is a vulnerability search engine that allows anyone to see internet-connected devices. “Google dorking” is another way to search for specific documents like confidential documents relating to a certain company that may have been posted online, intentionally or inadvertently.

Once you identify what’s on the network, such as type of firewall and version number, then you can search vulnerability databases for vulnerabilities relating to that device and version.

Reporting of threats should be made using the Common Vulnerability Scoring System (CVSS). Scores are calculated based on various metrics and measure from a 0 to 10 range, with 10 being the most severe. It is a great way for senior management to easily understand high, medium, and low risks.

You can have 999 non-critical vulnerabilities but if you find one critical vulnerability, that alone makes your overall risk profile critical.

Firms should engage in scanning as well as internal and external pen testing, with the testing process described in a report. Scanning is a passive enumeration of vulnerabilities and usually involves software tools that are designed to test for exposure to known vulnerabilities. A penetration test is more active in that it attempts to exploit those vulnerabilities. Using a combination of all these tests in an effort to identify vulnerabilities and their severity levels remain a key part of a vigilant cybersecurity program.

Related Content

Latest Content

Insurance Considerations for Investment Advisers

How much coverage is enough? What types of insurance policies do you need? Whether you are starting an investment advisory practice, launching a new line of business, or reevaluating your existing risks, there are critical questions to ask to make sure you understand the various ways to protect your firm. Join us for a practical … Continued

Fifth Circuit Weighs In on DOL Fiduciary Rule

A panel of the U.S. Court of Appeals for the Fifth Circuit has vacated the Department of Labor’s Fiduciary Rule. In a 2-1 split, the Fifth Circuit’s decision overrules a Dallas District Court’s decision, which had previously upheld the rule. Unfortunately, the decision does little to settle the fate of the beleaguered rule. Although it … Continued

SEC Proposes Amending Investment Company Liquidity Disclosures in Forms N-PORT and N-1A

On March 14, 2018, the Securities and Exchange Commission (“SEC”) proposed amendments to the mutual fund liquidity-related disclosure requirements. Specifically, the proposal: Adds a new requirement to “briefly discuss the operation and effectiveness of the Fund’s liquidity risk management program during the most recently completed fiscal year” in the Fund’s Management Discussion of Fund Performance … Continued

Paradigm Shift in SEC Exams, Benefits of a Mock Exam

For investment advisers currently going through an SEC exam, the process likely bears little resemblance to exams of old. Call it the new normal, a paradigm shift, or simply the effects of the SEC having to do more with less, but anecdotal evidence among those now experiencing the exam process suggests some interesting new trends. … Continued

Why Should a Big Hedge Fund Use a Compliance Consultant?

If your firm isn’t already using an outside consultant, you may want to ask yourself “why not?” Oftentimes at hedge funds, compliance officers struggle to successfully fulfill the requirements of the job without an essential tool in their toolbox: the outside compliance consultant. Why? The primary reason is simple: resources. When your head is down … Continued

Mailing List

Subscribe to the Ascendant Compliance email list for the latest compliance resources, conferences, ComplianceCasts™, and more.

Loading form...

Contact Us

Ascendant works together with clients to identify and assess critical needs through customized plans. If you need assistance with compliance functions, regulatory services, cybersecurity or technology tools, we’d love to speak with you.