Enzoic Navigation
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
SEC

How an SEC Ruling Will Affect Financial Service Firms

The Safeguards Rule

A recent SEC ruling could inform future cybersecurity cases relating to how financial investment firms must secure their users’ personal accounts.

In enforcement actions taken against eight different firms, the SEC announced on August 30, 2021, that each firm had violated the ‘Safeguards Rule’ for failing to protect against account takeover.

Rule 30(a) of Regulation S-P, commonly known as the Safeguards Rule, establishes that companies and firms must ensure the “security and confidentiality of customers’ records and information” by protecting the data from being stolen or compromised.

In the recent sanction, weakness of each firms’ security practices resulted in “email account takeovers exposing the personal information of thousands of customers and clients” at each organization. The accounts were taken over through “phishing [and] credential stuffing” along with other attack methods.

This ruling stands out because most data breach news relates to the compromise of an organization’s network. However, this ruling addresses the firm’s insufficient protection of individual customer accounts and isn’t considering whether or not the client was in any way injured.

As noted in this SEC ruling, the origin of account takeover attacks is commonly related to compromised credentials. Credentials compromised from third-party data breaches are well-known as a tool for cybercriminals to perform credential stuffing. This attack works well because most people reuse passwords across many accounts.   

Organizations have previously tried to blame the use of compromised passwords on the account owners. Many have tried to advise clients not to reuse passwords; however, this education approach has not worked. It is challenging to encourage changes to well-established behaviors. Consumers also don’t have a way to know whether they are selecting a compromised password or not. 

It follows that blocking compromised credentials is a reasonable and necessary defensive measure and is the firm’s responsibility. The use of compromised credentials is now a well-established and available practice. 

Since 2017, the National Institute of Standards and Technology (NIST) has explicitly recommended screening for compromised credentials in their special publication 800-63B. 

The Cybersecurity & Infrastructure Security Agency (CISA) also lists allowing known passwords on their Bad Practices. According to CISA, “This dangerous practice is especially egregious in technologies accessible from the Internet.”

While multiple authentication security measures exist, credential screening solutions provide time- and cost-effective approaches to defending from such attacks. Credential screening involves checking passwords, in real-time, against lists of known exposed credentials. Multi-factor authentication can also provide protection and is strongly recommended, but user adoption of MFA is a known problem.

The SEC’s announcement made it clear that several firms had identified email account takeover earlier and then failed to take action. For example, in one case, despite recognizing the vulnerability in 2018, the organization “failed to adopt and implement firm-wise enhanced security measures for cloud-based email accounts of its representatives until 2021, resulting in the exposure […] of customer and client records.” As industry experts know, this lack of accountability can have many negative consequences.

“Investment advisers and broker dealers must fulfill their obligations concerning the protection of customer information,” said Kristina Littman, Chief of the SEC Enforcement Division’s Cyber Unit. “It is not enough to write a policy requiring enhanced security measures if those requirements are not implemented or are only partially implemented, especially in the face of known attacks.”

The recent SEC ruling sets a precedent of financial liability, in addition to the reputational damage, for failure to apply commercially reasonable cybersecurity measures.  

ATOCompromised CredentialsFinancial Services Firm Security

Search

Assess your cyber vulnerabilities with a free password audit tool
Start Now

Browse blog categories

  • Account Takeover (28)
  • Active Directory (44)
  • all posts (153)
  • Continuous Password Protection (24)
  • COVID-19 (7)
  • Cracking Dictionaries (6)
  • Credential Screening (21)
  • Cybersecurity (66)
  • Data Breaches (31)
  • EdTech (3)
  • Enzoic News (18)
  • Financial Services Cybersecurity (5)
  • GovTech (4)
  • Healthcare Cybersecurity (15)
  • Law Firm Cybersecurity (2)
  • NIST 800-63 (28)
  • Password Security (30)
  • Password Tips (51)
  • Regulation and Compliance (11)

Stay up to date

Research, news, and more right to your inbox

More

  • Learning about strong, but unsafe passwords
  • What is a credential stuffing attack?
  • What is account takeover (ATO) fraud?
  • Eliminating password reuse to prevent ATO fraud
  • Developer Documentation (APIs)

Recent blog posts

  • Should Your Business Prevent Leetspeak in Passwords?
  • CISA: The Risk of MFA Without Improving Password Security
  • It’s W0rld P@ssw0rd D@y!
  • [ Sign Up for a Free Account ]
  • Contact Us
  • 1-720-773-4515

Enzoic ©2022 | Privacy Policy | Acceptable Use

3800 Arapahoe Avenue, Ste 250 l Boulder, CO 80303

Enzoic’s password auditor provides a great baseline for assessing password vulnerability. Get next level of compromised credentials protection and try the full Enzoic for Active Directory at no cost.

Cookies

This website uses cookies to improve your experience. Continue to use the site as normal if you agree to the use of cookies. To find out more about our use of cookies or to opt-out, please see our Privacy Policy.

More Information
This site is for EDUCATIONAL PURPOSES ONLY.
Your password will be sent securely to the Enzoic servers to check if it is compromised. We do not store your password or use it for any other purpose. If you are not comfortable with this, do not enter your real password.
What is this?

Password Check is a free tool that lets you determine not just the strength of a password (how complex it is), but also whether it is known to be compromised. Billions of user passwords have been exposed by hackers on the web and dark web over the years and as a result they are no longer safe to use. So even if your password is very long and complex, and thus very strong, it may still be a bad choice if it appears on this list of compromised passwords. This is what the Password Check tool was designed to tell you and why it is superior to traditional password strength estimators you may find elsewhere on the web.

Why is it needed?

If you are using one of these compromised passwords, it puts you at additional risk, especially if you are using the same password on every site you visit. Cybercriminals rely on the fact that most people reuse the same login credentials on multiple sites.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater. Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.

More…
  • Visit our FAQ to learn more
  • Contact us for press or sales inquiries
  • Add a free password strength meter to your website