An email data breach has serious implications for investment management firms. The financial penalties for falling foul of regulations can be significant – but it’s the knock-on effects that hurt most. Trust is the most important aspect of the client/customer relationship for investment management firms. It’s hard earned, and even harder to win back when lost.
For high-net-worth individuals (HNWIs), it’s not solely financial data at stake in the event of a data breach. They share other personal information with their investment management advisors, such as risk appetite and monetary targets to broader life goals and family information. It’s this information that helps advisors build the deep client insight that they need.
A damaged business reputation may lead to the loss of both existing and future clients who choose to entrust their data somewhere else. So, how can investment management firms keep client data secure when communicating? And why is email such an important channel?
Communicating with HNWIs
Investment management firms face a unique challenge within the financial services industry when it comes to sharing and communicating sensitive data. HNWIs require a different communication approach compared to the average retail customer.
They expect their interactions with an investment management firm to be easy and via a channel they’re familiar with. Email tends to be the preferred method of communication, even when highly confidential information is involved. Busy clients don’t always want to use the portals and file-sharing systems many firms have introduced in recent years. They add unwanted steps and complexity.
The pandemic and subsequent explosion in remote working has only amplified the number of emails being sent. And the more emails sent, the greater the chance of a mistake being made and a data breach occurring. Egress data shows that 83% of businesses have experienced an email data breach since March 2020.
It’s more important than ever for investment management firms to keep their client communications secure through intelligent email data loss prevention (DLP) tools.
Preventing email mistakes
First and foremost, intelligent email DLP works to ensure emails are going to the right clients with the right information attached. This might sound simple enough, but human-activated mistakes are easily made. Mistakes such as attaching an incorrect file or selecting the wrong recipient are a far more common cause of email data breaches than malicious attacks.
Intelligent email DLP uses machine learning to adapt to the behavior and sharing patterns of each individual user within an investment management firm. It scans both the email body copy and attachment contents for high-risk data such as PII or financial information, then prompts users to double-check if it’s going to someone they’ve not contacted before, or someone they wouldn’t usually send that kind of data to.
This allows it to catch context-driven incidents that traditional rule-based DLP tools would miss. Intelligent email DLP will also recognise spear phishing attempts, where cybercriminals use very similar names and addresses to try and dupe a rushing or stressed employee. The technology is unobtrusive - it works silently in the background, only popping up and prompting when something unusual has occurred.
Securing data in transit
Due to their profile and the financial value of their transactions, HNWIs are high-value targets for electronic eavesdropping, often known as ‘man-in-the-middle’ attacks. Most investment management firms will use opportunistic Transport Layer Security (TLS) to protect outgoing email, but this isn’t effective if a client’s personal email account server isn’t configured to support TLS.
The message will be sent unencrypted and still be at risk of interception in transit or when it reaches the client’s inbox. Full end-to-end encryption removes this risk – but some solutions can require both recipient and sender to take extra (often complex) steps. It also requires the investment management advisor to decide on what level of encryption is needed every time they send something.
It’s all well and good creating ultra-secure methods of encryption. However, we need to keep in mind why HNWIs want to use email in the first place – it’s easy. Firms need to strike a balance between being secure and creating the minimum amount of user friction.
Intelligent solutions are able to automatically select the right level of encryption. They constantly analyze the authenticity of the recipient’s domain, behavior, location and IT systems. Once they know a trusted relationship can be established, the intrusion of authentication methods can be minimized. This makes it much easier for genuine recipients to access their confidential messages.
Getting the full picture
Finally, intelligent email DLP offers IT leaders much-needed visibility through advanced reporting that monitors the flow of data and user activity. For example, identifying and measuring risk by analyzing how employees across the business are interacting with their email security tools.
Combined with artificial intelligence that identifies unusual behaviour by users, it highlights possible incidents of insider threat, such as users sending data files to personal email addresses, as well as instances of employee carelessness where training has been advised.
Demonstrating oversight and control over data shared by email is an important proof point for investment management organizations. It shows a commitment to protecting data that resonates with both clients and regulators. This can serve as a powerful point of differentiation from firms who take security less seriously.
Ready to try intelligent email DLP?
Egress’ market-leading Intelligent Email Security is able to offer everything an investment management firm needs. Our comprehensive solution ensures:
- The right clients receive the right emails and attachments
- Employees are defended from spear phishing
- Sensitive data is secure in transit with automatic levels of encryption applied
- Clients enjoy secure, frictionless communication
- IT leaders gain analysis and visibility over key trends
You can learn more about email DLP and how it protects your business in our dedicated knowledge hub. Or if you’re ready to give Egress a no-strings attached trial, we’ll be more than happy to set you up with a demo.
