On a Praemium webinar, head of IT security Indika Wimalasiri said the cyber security landscape has been “rapidly evolving and changing” in recent years as technology becomes more sophisticated, meaning advice firms need to ensure they have processes in place to shore up their cyber protection strategy.
According to the latest data from the Australian Cyber Security Centre, one in four (26 per cent) cyber crimes reported by businesses in FY2023–24 were either online banking fraud or business email compromise (BEC) fraud resulting in financial losses.
Furthermore, the report said that BEC continues to “significantly impact businesses”, with an average financial loss of greater than $55,000 for each confirmed incident.
As such, Wimalasiri said that all businesses, but particularly those in the financial services sector, have a responsibility to their clients to put adequate measures in place to protect themselves and their clients and the highly sensitive information they hold.
“The industry we are in … this makes us a prime target for cyber criminals. Financial professionals, financial advisers, everyone around that associates with the finance industry, we’re not just managing money, we’re protecting people’s financial futures,” Wimalasiri said.
“Cyber safety is no longer an option for us. It’s actually a fundamental professional requirement.
“As we work with sensitive information, it is critical to remember our responsibilities as well because this information represents individuals and humans behind it … We have a big responsibility as a community, and as an industry.”
With cyber crimes becoming increasingly pervasive, Wimalasiri suggested that even small businesses, which may be lulled into a false sense of security by thinking that their size makes them a less desirable target for criminals, must remain vigilant of cyber threats.
“It’s important to remember that cyber criminals, they don’t discriminate. They’re just after easy targets. They’re after finance. They’re after money. They’re after personal information,” he said.
“They often go after one target to go into other targets. So, if you are compromised, they actually use you as a springboard to go into different angles that you may not think of. That can be a bit of a chain reaction.
“It is important to remember the big picture. Cyber criminals, they’re after us, not just to get into my information, but all my customers and other persons involved.”
Using a case study to demonstrate the realities of cyber crimes, Wimalasiri explained an event in which a scammer sent a sophisticated phishing email pretending to be the client’s adviser that ultimately resulted in the client losing $1.2 million on a fake investment and fundamental damage to the trust between client and adviser.
To this point, he said there are a number of lessons advisers can learn from this, including the importance of having strict verification protocols and establishing verbal communication procedures with clients, in addition to using encrypted communication channels and regularly informing clients about emerging scam techniques.
“Better security is not doing one thing but doing many things together to create a protective barrier. If one mechanism fails, there is another one to stop when something bad is taking place,” Wimalasiri said.
“No single solution prevents financial crime. It is a number of small things that we do together to protect ourselves, our customers and the information that is associated with it.”
Meanwhile, as artificial intelligence (AI) becomes increasingly sophisticated, much to the benefit of the financial services industry, Wimalasiri warned that cyber criminals are also using these technological advances to their own advantage.
“We use AI to help us to do business and it makes things easier for us. So do the cyber criminals. They use artificial intelligence to help them commit crimes,” he said.
“AI is a new digital frontier. We are not entirely sure where AI is taking us as an industry, as a community. It is rapidly evolving every month, every single day.”
We’re a single-adviser practice and spend around $8–12k per year on managed IT. We also have a proper modem, business-grade NBN, and a password manager with two-factor authentication.
I don’t need to be impenetrable to be safe—just a harder target than another firm that doesn’t take security as seriously.
It’s like when cars in our swanky neighbourhood get ‘broken into’, but ours don’t. More often than not, the crooks find enough unlocked cars that they don’t bother trying to break into the locked ones.