KSI/KAI Cyber Security Policy / Procedures For Registered Reps Password Protection 1) All electronic devices used in any way for KSI/KAI business must be password protected. 2) Passwords, where applicable, should be at least eight characters long, and contain both alpha and numeric characters. 3) All mobile devices Apple IOS or Android used in any way for KSI/KAI business must contain a minimum of four character password and it is recommended the device be wiped after ten unsuccessful login attempts. This will encrypt them as well. 4) All passwords should be changed at least every 90 days. Data Breach 1) Any known or suspected data breaches must be reported to the KSI/KAI IT Department immediately at informationsecurity@kovacksecurities.com. 2) A detailed and comprehensive accounting of the event must be submitted to the KSI/KAI IT Department. Computer Equipment Data 1) All computer systems used in any way for KSI/KAI business must be located in a secure location. 2) All laptops used in any way for KSI/KAI business must be whole disk encrypted, with an approved encryption package. 3) All computers systems left unattended must be locked with a password. 4) All computer backups must be kept in a secure and locked location. 5) All computer systems must have anti virus software installed. 6) All anti virus software must have a current subscription and virus definitions must be current. 1) Any data stored solely in electronic format must be maintained in accordance with SEC rule 17a 4. 2) SEC Rule 17a 4 states data must be stored in a non rewriteable, non erasable format. Private Information 1) Any private information transmitted electronically must be sent via secure email.
Detecting and Recovering from an Email Virus Incident Registered Representative Procedures A large number of viruses are transmitted via email, commonly enclosed in a file with a.zip or.exe extension. Files with these extensions must not be opened prior to confirming their origin. Additionally, your IT professional should review the email, and advise you as to what steps should be taken. If/when a suspicious email is received, the following steps must be adhered to: Five Response Stages Detection Reporting Containment Eradication Recovery Detection Typical indications of an attempted virus, or virus infection, include: Suspicious email (do NOT open a suspicious email) Confirm with sender Multiple non deliverable emails in your Inbox Sent emails that you didn't send Slow disk access Slow system boots Anti virus software alert Reporting Immediately report any suspect emails or Virus alerts to your IT professional. Registered Representatives must have access to their own qualified IT support professional or company. Your IT professional must contact the KSI IT Department when a virus is detected. Registered Representatives are responsible for ensuring that their IT professional is aware of this KSI requirement. Initial reporting can be made to informationsecurity@kovacksecurities.com.
Containment Your efforts to contain the virus can significantly reduce the virus damage. If you believe or it s determined you have a virus, Registered Representatives must use the following steps to quickly contain the virus: Close Outlook and do not open until instructed by your IT personnel Close all open documents and Internet browsers Shut down your computer and do not turn it on until instructed by your IT professional. Eradication Your IT professional can initiate several steps, depending on the type of virus: Update of virus definitions and full system scan; Offline virus scan; Reinstalling the system, such as a system installation disk, or a clean system image. Recovery Recovery of functionality and data of infected systems may have been carried out as part of the eradication process. Files can be restored, as of the last backup, from your file backup. Removing temporary containment measures, such as suspended network connections, is another aspect of the recovery process. After the recovery process has been completed, a written report must be submitted by your IT professional to the KSI IT Department. This report must contain the following. 1) A detailed list of all viruses found 2) What methods were used to clean the infected computers 3) The time and date all the systems were proven clean Points of Contact Jeff Welch Director of IT Phone 954 670 8140 Email jeffw@kovacksecurities.com John Verderosa IT Services Phone 954 670 8705 Email jverderosa@kovacksecurities.com Regina Schumaker Senior Software Specialist Phone 954 670 0621 Email regina@kovacksecurities.com
Tips for Keeping Your Clients Safe Passwords. It is extremely important to utilize strong passwords for email clients and for any online access to client private information. A minimum password requirement should contain a minimum of eight characters consisting of upper case, lower case, numeric and a symbol. Make sure to never use date of birth, name, initials, or phone number within your passwords. Use multiple sign offs. To ensure no one has cut any corners, require that multiple people approve a disbursement. The more eyes that look over a transaction, the better. Wire fraud is on the increase. Be very cautious about email. Always think twice before sending sensitive information via email. Either don t send private information over email, or make sure the email is sent securely with encryption. Always remember to never open email attachments with an.exe or.zip extension from an unknown source. If you receive an email with one of these extensions from a trusted source, please make sure to confirm with the source the legitimacy of the email before opening. Teach clients electronic hygiene. One of the biggest challenges is getting customers engaged, to make them understand that there are threats out there and that there are things they can do to protect themselves. Send only encrypted emails that contain private information and ask clients to either follow suit or mail documents back to you. The client may find this inconvenient, but remind them this is to protect their identity. Also remind clients that, if they don t recognize an email, they shouldn t open it or click on an enclosed link. Secure your own electronic office. Permanently delete all old emails. Keep documents offline, or behind a firewall. Though scams tend to originate in hacked client email, rather than through online financial dashboards or electronic records, it s still imperative to be careful what websites you visit. Most malware is downloaded via a website rather than email. Some malware can result in the loss private information residing on a computer. Expect criminals to evolve. The fraud preventatives that work now probably won t work forever. Cyber criminals will always be upgrading their tactics, it s vital for anybody in the financial services industry to continuously review their internal measures to prevent cyber fraud. Install quality Antivirus Software. Not all antivirus software is created equal. There are several free antivirus software packages out there with a good reputation. As you might have heard nothing in life is free. Some of the free packages do a decent job at scanning for viruses; however you want to do everything in your power not to get them in the first place. The pay antivirus packages do a better job of spotting the virus before it infects your computer. Some also offer a web reputation enhancement that will warn you of damaging websites. Consult with your IT professional to determine which package is best for you.
What to do after. No antivirus software is 100% effective. If you do download a virus have your IT professional fully scan and clean your computer. After your computer is proven clean, make sure to change all of you passwords.