It was never on your list of priorities, and perhaps it shouldn’t be objective number one…
But it would not be wise to ignore the need to protect your investments and the computers from which someone could access, redirect, and wipe out your investments.
Managing the wealth of a family office makes it imperative to protect your wealth beyond the physical realm.
In 2024, assets are increasingly managed online, and cybersecurity already emerged as a necessity and a cornerstone of your wealth preservation strategy. Here’s why cybersecurity is paramount for you:
Digital Asset Protection: your portfolio likely encompasses diverse assets, from traditional investments to modern holdings like cryptocurrencies and digital properties. Each of these exists within a digital ecosystem constantly threatened by cybercriminals. Do you have effective cybersecurity measures to protect these assets from unauthorized access, theft, and fraud?
Preservation of Privacy: The privacy of your family members and the confidentiality of your financial decisions are of utmost importance. Cybersecurity helps protect sensitive information from being exposed or compromised. Information is power, and ensuring the privacy of your deals is critical to maintaining your family’s security and reputation.
Financial Risks Mitigation: Cyberattacks can lead to direct financial loss through theft or fraud. Moreover, the aftermath of a breach can incur substantial costs related to legal fees. Regulatory fines could be a percentage of your yearly turnover, and let’s not forget the restoration of compromised systems. Investing in robust cybersecurity measures is a proactive step towards mitigating these financial risks.
Compliance and Regulatory Obligations: Your family office must adhere to various regulatory requirements to protect investor and consumer data. A robust cybersecurity framework ensures compliance with these regulations. It also helps you avoid penalties and legal complications from data breaches.
Reputation Management: Your family office’s reputation is built on trust and a demonstrated ability to protect your wealth. A cybersecurity incident can significantly damage your reputation, eroding trust among family members and the broader community. Proactive cybersecurity measures are vital in upholding the confidence placed in you.
Operational Continuity: Cyber incidents can disrupt the operations of your family office and affect your ability to manage your wealth effectively. Implementing a cybersecurity strategy ensures that your operations can quickly recover from cyber incidents. This also ensures operational continuity and the ongoing management of your assets.
Family offices face unique cyber threats. For one, you’re not a bank. Hackers know you don’t have a team of 20 cybersecurity experts watching your entire IT infrastructure day and night.
Knowing that your IT is likely a mess, they can stay hidden longer, monitor your operations, and hit you harder than they would a bank, where hackers must act swiftly and often make mistakes.
Your network is simple. Your defenses are simple. And this must change!
Assessing Your Current Cybersecurity Posture
In other words, let’s see what your IT team has been hiding under the rug for years, intentionally or not. Most often, we discover that IT experts are simply good at one thing—building systems. But their expertise is not in defending or attacking systems. So, when it comes to cybersecurity, most IT teams fall short. An audit might help discover anything missed in recent years and potential improvements your IT team hasn’t considered.
Step 1: Conduct a Cybersecurity Audit
The audit process starts with soft introductions between the executives who will participate from your side, IT team members from your side, and the security auditors.
While the audit is ongoing, fully utilize the security experts’ time. Ask them questions, take notes, and you may even start implementing their suggestions immediately without waiting for the final audit report.
Ensure the audits you select don’t just ask checklist questions but go into detail and discuss them with your IT team. This is a great opportunity to learn about cybersecurity.
There are two categories of audits: external and internal. Whatever type of audit you choose, you should probably conduct both internally and externally.
For example, you might want to see how your family office’s network matches an established security framework like NIST 800-53, ISO 27001, or SOC2. But these will mostly check your internal security controls. How do hackers see your network from the outside? How does your 2FA match up against hackers’ skills to bypass 2FA? Security frameworks don’t check for that. And that is what external security audits, or ‘penetration tests,’ exist for.
Services recommended for a thorough audit
Your collaboration suite is the number one target for hackers and should be audited first. Microsoft 365, Azure, Active Directory, and Google Workspaces are all central to how you manage your data, access, and authentication to the data and to your computers. It is the stepping stone into your network and, from there, to controlling your assets. Imagine what would happen if a hacker accessed your accounting department computers for three months, or worse, your CFO’s computer?
Step 2: Identify Sensitive Information and Assets
The audit should produce several things, among them, a list of your most sensitive IT infrastructure elements (what you see as an asset and what your IT sees are two different things, here we focus on IT assets). For example, having access to your Entre ID / Active Directory gives a hacker the opportunity to create or manage administrative accounts. With that, the hacker can gain administrative access to sensitive computers and from there, they can intercept and modify financial transactions…
For an unlimited amount of time, until you catch them or until you get suspicious and invite a cybersecurity firm to investigate.
During the audit, you should map out where sensitive information is stored and how it’s protected.
Building a Cybersecurity Framework
But before building one, you should choose which framework best suits your organization. Because ISO 27001 is bureaucratic and less practical, SOC2 is tailored toward IT companies and is excellent if the businesses your Office manages are mostly in the SaaS space. NIST is great if your acquisitions primarily interact with the US/Australian government.
There are others, but my point is that you should listen to your cybersecurity advisors when they suggest which direction you should take.
Step 3: Develop a Comprehensive Cybersecurity Policy
How to create a cybersecurity policy tailored to the family office’s needs:
- Use a template from the cybersecurity framework we discussed above.
- Heavily modify that template’s contents to fit your entire business model and the ‘spirit’ of your Family Office.
- Come up with ways to distill the most important point from the policy into video content and distribute it along with the policy among your employees and contractors. Including contractors in the policy and its distribution is crucial, as you can get hacked through a third party. Third parties getting breached is how many large companies get hacked – if the third party has access to your computers or network, that is. For example, if you outsource IT to another company and that company gets hacked – you get hacked automatically.
- You must include access control, data encryption, personal and corporate device usage rules, and incident response in the policy.
Step 4: Implement Multi-Factor Authentication (MFA) everywhere you can
- Multi-factor authentication (MFA) can and will be bypassed in many scenarios. But if your accountants log in to your many financial institutions without 2fa, you should be worried. MFA is the most fundamental and often omitted security control. You should have MFA enabled on all systems where you collaborate and share information, on all social media accounts used for business, and on the social media accounts of people who are key to the organization (imagine if a fake CEO FB account starts messaging your CFO about an urgent invoice…).
- Provide instructions on setting up MFA for all critical systems and accounts. If and when appropriate, create or reuse video guidelines. Make sure older or less technically-savvy people get personal assistance in setting up and using MFA methods. Whenever possible, use Face ID – there are special cameras that can be added to almost any Windows computer for that purpose.
Enhancing Network Security
Step 5: Secure the Network Infrastructure
10 years ago, every office had to have a Firewall. Every office had a wired network. Things are different now. People mostly connect via WiFi, and they demand easy passwords to connect. Which makes the job of a hacker located two kilometers from your office that much easier. Yes, WiFi signals can be hacked into from miles away! Now that you know about the risks, let’s talk about some solutions.
- Always have a guest network for visitors. That guest network must be on a completely separate ISP and have NO access to your corporate resources. In fact, your collaboration suite and email system should actively block this guest network.
- Your WiFi office network must only accept device certificates plus a password for authentication. Nothing less.
- For the most critical systems, WiFi access should be impossible. Use wired connectivity and at least 3 factors of authentication when managing access to critical resources, such as your accounting or backup systems.
Step 6: Regularly Update and Patch Systems
80% of companies out there only patch the operating system and sometimes the office suites of their employees, if they even do patching at all. Hackers take advantage of this by sending specially crafted documents which in turn take full control of the victim’s computer. Antivirus programs usually ignore these documents and let them through. Patching everything – the operating system, office suite and third party apps, such as PDF readers, is crucial to your defense.
- One of the best ways to keep all software on a computer (Windows) up-to-date is winget. You can also use choco (chocolatey, that’s the tool name).
- Schedule automatic updates and conducting regular patch management audits.
- Install a monitoring agent to alert you when the update mechanism breaks and you have computers lacking updates in the network.
Safeguarding Against Phishing and Social Engineering Attacks
Email is just one vector of attack when hackers send your users fake login forms and documents containing fake login forms. We have seen SMS (texts) being used, social media services, Whatsapp, Telegram, Viber, iMessage… the point is, your users must be aware of these and expect them. Every time they see something suspicious, they should report it to the cybersecurity department.
Step 7: Train Family and Staff on Cybersecurity Awareness
Run cybersecurity drills, simulated attacks and share posters and interesting tidbits of information on the topic at least monthly. If done at randomized intervals, the training and simulations will have a greater effect.
- Give out awards for things like ‘the most phishing messages reported in a month’
- Simulate email, voice, social media attacks, don’t limit your simulations to email only
Step 8: Establish Secure Communication Protocols
And we’re not just talking about technology here. In some situations people should never use email – remember Hillary’s emails being exposed for the whole world to see? We can assure you she no longer uses email for any confidential or risky communications. Neither should you.
- When it comes to financial decisions, always demand verification before taking action by at least one more channel. For example: if your CEO/COO/CFO sends anyone in the company any instructions for wiring any significant sum of money anywhere – call them, text them back, send them a message using social media, but verify by some other channel than the one you received the order by.
- Never use the phone or texts (SMS) for confidential communications. These are just too easy and cheap to intercept by even regular criminals with $3-5k in their pockets.
Advanced Cybersecurity Measures
There are defense measures even IT experts don’t know about. Or perhaps they’ve heard about them, but never seen them in practice. For example: did you know, that there is such a thing as system hardening? Many IT experts know this, but have never performed it on anything. Yet there is security hardening for browsers, office suites, even PDF reader applications. Because hackers use any opportunity they can get, and an insecure browser is often just the thing they need to get access to your computer and from there, the entire network. Once inside, they can quickly determine how to redirect all financial transactions or assets to a place of their choosing.
Step 9: Leverage Behavioral Analytics and Anomaly Detection
- Behavioral analytics can protect against insider threats and external attacks, if you have the right tools and systems. For example, a combination of actions such as downloading a certain number of files to their desktop, compressing them and sending them over their personal email to some unknown destination, might be a combination only a malicious insider would do. It is better to investigate such cases and determine them not malicious than missing them altogether and hoping they don’t happen.
- Some tools and platforms that offer anomaly detection capabilities are DLP (data leakage protection) systems, web proxies, EDR/XDR systems, threat hunting systems, etc.
Step 10: Consider Cybersecurity Insurance
There is one caveat here: insurance companies *love* to find reasons not to pay you. For example, if they can prove you did nothing to protect yourself but get an insurance, they will blame you and will not pay anything. If you did not run a security audit or patch your systems, a breach will be your fault, and your insurance will be just money down the drain.
Before choosing a cybersecurity insurance provider for your Family Office, read the fine print of the reasons they can use to refuse paying in the event of a security breach, compare them and choose the one with the most realistic expectations toward you.
Twelve years ago I was hired to write the policies for one cybersecurity insurance company. That is how I know they will find every reason to blame you and your team for the breach – because they asked me to bake these conditions right in their policy documents.
Managing and Responding to Cyber Incidents
Step 11: Create an Incident Response Plan
Like getting the flu from time to time, your company will experience cybersecurity incidents of different levels of criticality. Getting a cold might be terminal for people with no immunity and a security incident can become critical if a company doesn’t know how to isolate the threat and respond to it.
Step-by-step guide on developing an effective incident response strategy:
- Build a plan that reflects your company. Don’t just pluck someone’s incident plan template and change the name of the company on top of the document.
- Gather the right experts and tools to respond to an incident. For example, if one of your computers gets infected with a trojan horse virus, your IT team might just “clean it”, without realizing what really happened: someone got access to the IT team admin passwords, your passwords, the finance team passwords, and is now using them against you. Cleaning the virus does nothing to respond to a malware infection, considering the hacker had access to your IT systems. That is why a proper response is important.
- Important: if you are not experiencing cybersecurity incidents, you are not detecting them. Every company and even every individual comes into contact with malicious activities on the Internet, every day. Not everyone is aware of it happening, but it doesn’t mean it’s not happening!
Step 12: Regular Cybersecurity Audits and Reviews
- Hopefully, you have had at least one cybersecurity audit. In the best-case scenario, your team has worked tirelessly to implement all recommendations from the findings report… but after a while, even the best security measures become irrelevant and need to be updated because hackers don’t just use the same techniques over and over.
- Incorporate feedback and lessons learned into your cybersecurity strategy.
- Execute attack simulations at least annually. In the industry, we call them ‘penetration tests.’
Defending a Family Office requires action
Instead of waiting for a breach to happen, conduct a security audit—it can be done in two weeks. After two weeks, you will have a clear action plan with a timeline of what to do and how to do it to defend your company from cyberattacks.
We offer further assistance or consultation to develop a customized cybersecurity plan. Contact us — let’s turn your Family Office into a cyber fortress!
