Cyber Security; pension schemes in 2020

In 2018, we wrote about some general areas that all scheme trustees should consider when looking at their scheme’s cyber security. So, two years on, what has changed?

The Pensions Regulator has made it clear that it expects all trustees to actively take steps in ensuring that the cyber security position of schemes is robust. We have talked to a number of trustees about actions and progress in this area, together with reviewing scheme minutes that show us that trustees are taking this seriously.

However, 2020 and the challenges of the COVID-19 pandemic have given fraudsters opportunity to test their abilities to extract data or reward through exploitation of the weaknesses that cyber security is meant to address. At least one well-known third party administrator has been hit by a data hacker and still more organisations have been threatened by ‘ransomware’ attacks. On a personal level, there are sophisticated ‘phishing’ emails in circulation, which purport to come from HMRC, DVLA and TV Licensing among others.

So what does this mean for Trustees?

We would recommend that you review both your IT arrangements and your security controls. Where you rely on others, ensure they are keeping their cyber security protocols under constant review. The move to remote working to accommodate lockdowns has sometimes meant that controls have been amended or their operation has been delayed. Therefore, we suggest you consider the following questions:

• Is your data being stored on any personal computer equipment/servers?
• Are your administrators operating using their usual secured networks?
• How are your administrators managing the confidentiality arrangements when their staff are working in shared housing?
• What training and reminders have your wider team - trustees, actuarial, administrative and secretarial functions, for instance – received about taking the necessary precautions with emails?
• With the move to remote working, how have anti-virus updates been updated?

Pension schemes involve a large amount of personal data that could be valuable to people or organisations looking to profit by selling it, preventing you using it or by exploiting it themselves. Schemes also involve multiple organisations with links so criminals might seek to exploit the vulnerabilities in the whole arrangement. Larger organisations will be targeted due to the greater potential for profit-making opportunities while smaller entities organisations may also be under fire due to potentially weaker controls and less robust security. Most data loss or freezing is the result of a human error; a lost phone or laptop on a train, clicking on a link in a suspicious email or perhaps sending an unsecured email to the wrong place are all common culprits. Hence, fraudsters have increased their determination to sending emails with scam links in them.

While a sophisticated hacking attack may occur at one of the organisations that is involved with your scheme, it is much more likely that a ‘phishing trip’ is successful, bringing pension activities to a grinding halt. Therefore, the key to successful cyber security is good, basic housekeeping. Prevention is always better than resolution so review your protocols for data sharing, storage and information retrieval and ensure that all those that support the scheme are doing the same.

We know that many of you found our checklist helpful in considering the cyber security of your scheme back in 2018. We have now updated it for COVID-19 scenarios and include it again here:

If you are satisfied that your controls are adequate, have you tested them? You could ask your IT department to send out suspicious emails and share the results with your team. Alternatively, you could question each of your providers and ask them about their own testing protocols and analyse the results.

Given the continual changes to day-to-day practices that we are all experiencing, what is clear is that standing still is not an option so, if you do nothing else, schedule a regular review of your current protocols and ensure you are actioning any suggested improvements to prevent potential hazards.

DISCLAIMER
By necessity, this briefing can only provide a short overview and it is essential to seek professional advice before applying the contents of this article. This briefing does not constitute advice nor a recommendation relating to the acquisition or disposal of investments. No responsibility can be taken for any loss arising from action taken or refrained from on the basis of this publication. Details correct at time of writing.

Ref: 127920lw