Des Moines-based Voya Financial Advisors (VFA) has agreed to pay the U.S. Securities and Exchange Commission a $1 million penalty in the wake of an April 2016 breach that affected several thousand VFA customers. The SEC cyber enforcement action charged VFA with not having sufficient written policies and procedures in place to protect customer information, as well as not having a written Identity Theft Prevention Program as required under the Identity Theft Red Flags Rule.
In addition to paying the $1 million fine, VFA agreed to be censured and to seek help from an independent consultant to get its internal cyber security controls in order. The action against VFA is the first SEC cyber enforcement action under the Identity Theft Red Flags Rule.
In the SEC’s press release, Robert A. Cohen, Chief of the SEC Enforcement Division’s Cyber Unit, had some stern words for financial firms and implied that the SEC cyber enforcement action against VFA is a harbinger of things to come as the SEC clamps down on firms that lack appropriate internal security controls: “This case is a reminder to brokers and investment advisers that cybersecurity procedures must be reasonably designed to fit their specific business models. They also must review and update the procedures regularly to respond to changes in the risks they face.”
The financial industry isn’t the only target of the SEC’s focus on cyber enforcement.
SEC Says Insufficient Internal Controls Could Violate Federal Law
Shortly after its cyber enforcement action against VFA, the SEC issued a report detailing its findings on an investigation into nine public companies that had been victimized by business email compromise (BEC) scams. The SEC did not identify the companies it investigated but described them as public firms spanning “a range of sectors including technology, machinery, real estate, energy, financial, and consumer goods,” illustrating that no industry is immune to cyber crime.
Each organization lost at least $1 million dollars (two lost more than $30 million) to BEC scams where hackers impersonated either a company executive or an outside vendor and convinced unwitting employees to wire them money directly or pay invoices to accounts that the hackers controlled. The SEC noted that the schemes where hackers impersonated vendors were more technologically sophisticated than those where company executives were impersonated because the hackers had managed to infiltrate the email systems of the victims’ foreign vendors and gain access not only to vendor email addresses but bona fide invoices. In some cases, the victims had no idea they’d been tricked until the real vendor contacted them about the invoices being past due.
The SEC became involved to determine if the organizations had sufficient internal accounting controls, as required by the Securities Exchange Act, regarding transactions and access to company assets. In the end, the SEC determined not to pursue cyber enforcement actions against the organizations. However, in its report, the agency directed public companies to consider cyber threats when implementing internal accounting controls and warned them that a failure to do so could violate federal securities laws.
The report noted the importance of considering both technological and human vulnerabilities when devising internal accounting controls. In each case the SEC investigated, it wasn’t a technological vulnerability but a human one that caused the BEC scam to succeed. While each organization had payment authorization procedures in place, the scams were successful because the personnel determined that the [phony] electronic communications were, in and of themselves, sufficient to send wire transfers or process invoice payments. Each organization has since made changes to its internal controls to add further redundancy.
The SEC’s cyber enforcement action against VFA, and its report on the BEC scam investigation, indicate that the agency is quite serious about investigating cyber crimes and exercising its cyber enforcement powers when necessary. Organizations cannot assume that their internal controls are sufficient just because they haven’t been hacked — yet. Regular assessments and active monitoring are necessary to ensure that existing controls and procedures still provide protection in a continually changing threat environment.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.