AGAT

Categories
blog DLP Ethical Wall

FINRA Compliance Requirements

Due to the COVID-19 pandemic, many companies had to restructure the way they worked almost overnight. Suddenly data that was protected by the organization’s regulations and contracts had to leave the company in order to work with it. That is the reason why FINRA extended all its compliance regulations to the internet space, establishing strict cloud governance standards and making cybersecurity a must.

Insider threats to enterprise data are a permanent cause of concern since they can impart a huge amount of destruction on a business, especially in the financial services sector. A simple mistype by an employee with privileged access can be just as damaging as a compromised employee looking to make a quick buck. Financial institutions face the second highest breach costs among targeted industries.

Table of contents

  1. What is FINRA?
  2. What does FINRA do?
  3. Rules regarding information barriers
    1. How to comply with FINRA information barriers requirements 
  4. Rules regarding data loss prevention (DLP)
    1. How to comply with FINRA DLP requirements
  5. Rules regarding archiving and data recovery
    1. How to comply with FINRA eDiscovery requirements

1- What is FINRA?

The Financial Industry Regulatory Authority (FINRA) is a private, nonprofit American corporation that acts as a self-regulatory organization (SRO). Its mission is to set forth rules and regulate stockbrokers, exchange markets and broker-dealer firms, keeping the U.S. markets safe and fair. FINRA is the successor to the National Association of Securities Dealers, Inc. (NASD) as well as the member regulation, enforcement, and arbitration operations of the New York Stock Exchange. 

The US government agency that acts as the ultimate regulator of the US securities industry, including FINRA, is the US Securities and Exchange Commission (SEC). Although FINRA is not a government organization, it does refer insider trading and fraud cases to the SEC, and if you fail to comply with FINRA rules, you may face disciplinary actions, including fines and penalties that are set to deter financial misconduct. 

2- What does FINRA do?

  • Oversees all securities licensing procedures and requirements for the United States.
  • It’s responsible for governing business between brokers, dealers, and the investing public.
  • Examines firms for compliance with FINRA and SEC rules. 
  • Performs all relevant disciplinary and record-keeping functions.
  • It encourages member firms to secure their financial data and execute transparent transactions. 
  • Delivers steps defining accurate cybersecurity goals.
  • It fosters transparency in the marketplace

Best practices Compliance FINRA

Is your company compliant? You must, among other things, make sure that digital data is immutable and discoverable and that the access and usage of data can be restricted, regulated and audited*. This is where AGAT’s SphereShield software can help.

3- Rules regarding Information Barriers

In a few words, financial institutions are subject to regulations that prevent employees in certain roles from communicating or collaborating with employees with other specific roles. Why is this? because there are conflicts of interest involved, and if they exchange sensitive information there can be severe consequences. 

A research analyst provides information to investors, they gather data around possible investment opportunities. Their increasing popularity expanded their influence on the price of securities: they give ratings that, if good, can make the price of an asset go way up. In parallel, a slight disfavorable change in their ratings can make prices drop. That’s why, to maintain a fair marketplace, research analysts cannot disclose ANY information they collected before an official public release.

The practice of information barriers has been expanded over recent decades to prevent those communications and risky information flows and to avoid insider trading, protecting investors, clients, and other key stakeholders from this wrongful conduct. FINRA Rules 2241 and 2242 require organizations to establish policies and implement information barriers between roles involved in banking services, sales, or trading from exchanging information and communicating with research analysts.

 – How to comply with FINRA information barriers requirements 

Agat’s SphereShield offers granular control over users/groups engaging in communications both within other areas of the company or with external organizations. It also includes independent control for different kinds of actions: instant messaging, audio, video, conferences, desktop sharing and file transfer. 

So, let’s say a user identified as a Research Analyst wants to communicate with someone from a restricted area: a well implemented information barrier will fully block that possibility.

4- Rules regarding data loss prevention (DLP)

Firms must put robust policies in place for employees to know which sensitive information they cannot disclose, and also monitor them for suspicious activities that  hint at possible misconducts. FINRA rules 3110/3013 explicitly mandate analyzing all electronic employee communications. 

Clearly, reading all emails and listening to all voice calls is just not possible, but there are technologies that can actively transcribe, analyze, and monitor communications flagging any suspicious behaviors or activities. As an extra step, there’s software that can assist a firm to turn surveillance from reactive monitoring (that means, addressing employees missteps after the fact) to a proactive rule creation approach. This allows for risks to be identified, managed, and mitigated before information breaches or other incidents occur.

– How to comply with FINRA DLP requirements 

AGAT’s DLP engine does real-time inspection of content, being capable of blocking or masking all data that is defined as sensitive before it reaches the cloud or is sent to external users. Firms can use it to prevent information leakages and insider trading offenses from happening, but it will also help them identify communication red flags  to make risk assessments and train personnel.

5- Rules regarding archiving and data recovery

Examining a company’s books and records to make sure they are up to date and accurate is a significant component of FINRA industry inspections. FINRA establishes in its rules that access to all the records they might need  to audit has to be accessible easily and promptly. 

FINRA rules 4511, 2210 and 2212 are the rules on storage and recordkeeping, stating that all organizations must preserve their records and books in compliance with SEC Rule 17a-4. This includes ensuring the easy location, access, and retrieval of any particular record for examination by the staff of the Commission at any time. This rule applies, and has specific notes to electronic storage, like accurately organizing and indexing all information. 

– How to comply with FINRA eDiscovery requirements

An eDiscovery search feature isn’t an ordinary content search tool. It provides legal and administrative capabilities, generally used to identify content (including content on hold) to be exported and presented as evidence as needed by regulatory authorities or legal counsels.

The eDiscovery solution from SphereShield allows for data to be immediately available to any regulatory organizations or commissions by giving advanced search capabilities to quickly retrieve and export data. This solution can also be integrated to other existing eDiscovery systems.

Categories
blog Ethical Wall Microsoft Teams

Are Microsoft E5 and E3 Licenses worth the money?

In this article, we will talk about the best ways to address important security and compliance issues with SaaS products, and review some solutions available within plans like Microsoft E5 or E3.

Table of contents

  1. The paradox of reducing cost while maintaining high compliance and security standards
  2. The range of solutions within Microsoft licenses E3 and E5
  3. Is the Microsoft E5 license really worth the money?
  4. Alternatives to a Microsoft E5 License
  5. AGAT’s SphereShield for compliance
This image has an empty alt attribute; its file name is image3.png

1- The paradox of reducing costs while maintaining high compliance and security standards

It’s 2022 and the global scenario is one of economic uncertainty. Companies are starting to pull back on developments while others look for ways into reducing operational costs before starting to lay off employees.

While the global stagflation keeps on developing, many chiefs of compliance, security, and technology officers are facing the same question: How is it possible to reduce the overall SAAS spending while not sacrificing any security or compliance requirements?

On one hand, it’s impossible to get rid of essential paid services such as corporate emails, servers, cybersecurity, collaboration software, and the like. But on the other hand, there is a tremendous risk associated with the idea of replacing functioning solutions developed by well-known vendors with home-made not-so-effective patches.

2- The range of solutions within Microsoft licenses E3 and E5  

Microsoft 365 is the market leader in SaaS, offering a complete suite of business productivity tools for easier communication and collaboration. We know that Microsoft 365 includes Windows OS and the whole Office product line in its subscription, also allowing the use of diverse cloud-based services for business environments, such as hosted Exchange Server, Skype for Business, MS Teams and SharePoint, among others.

With a good price/value ratio, the E3 license is one of the most popular options between small to mid-sized organizations. But Microsoft E3 offers only limited solutions around identity and access management, threat protection and information protection, and it lacks compliance solutions.

Then there’s Microsoft E5, a more than significant step-up from Microsoft 365 E3 that includes important security features such as, Identity Management, Cloud App security, Auto Labeling for sensitive content, etc., as well as it can address some compliance requirements. But this plan also includes other functionalities like Power BI and Teams Phone that add up to the price unnecessarily for companies if they won’t use them.

This image has an empty alt attribute; its file name is image2-1024x390.png

3- Is the Microsoft E5 license really worth the money?

The difference between the features provided by E3 and E5 is clearly reflected in the monthly subscriptions price jump of $21. Taking a look at their published prices, if a company with 500 employees decides to contract E3 it would incur an annual cost of 216,000.00 USD, and that price ascends to 342,000.00 for the Microsoft E5 plan.

But the bottom line is, getting access to the newest compliance and data governance technology developments by Microsoft demands high-end licensesThe Microsoft 365 Enterprise packages E3 and E5 are aimed at organizations that need more information protection and compliance capabilities.

Microsoft E3 and E5 licenses prices list

Microsoft also offers separate plans for security and compliance that can be added to an E3 license. There’s the Microsoft 365 E5 Security add-on (formerly Identity & Threat Protection) priced at $12/user/month, and the Microsoft 365 E5 Compliance add-on, also priced at $12/user/month, both requiring annual commitments.

It’s not necessary to dive into the details of the solutions provided by each of those add-ons knowing that, by adding the two of them to an E3 plan, the total price ends up paired to E5. So if your organization is interested in both the security and the compliance solutions by Microsoft it’s still preferable to purchase the complete E5 bundle.

I know what you’re thinking, is it possible to purchase the E5 security and compliance add-ons for a cheaper license than E3? No, Microsoft makes these packages available only for E3-level subscriptions. Smaller companies with plans like Business Premium (limited to 300 hundred users) don’t get the option of incorporating Microsoft’s wider compliance and security features.

For the case of Office 365 (the subscriptions without Windows and EMS) the conclusion remains the same, an Office 365 E5 license will give you a better bundle than adding security and compliance separately to Office 365 E3.

4- Alternatives to a Microsoft E5 License

Ultimately, decision makers should know that it’s not impossible to drop down and optimize SaaS software licensing if certain features aren’t essential for their organization’s particular needs. More so, many users choose to turn to third party providers for alternatives to some of Microsoft’s native capabilities.

It’s also important to address that organizations with specific needs, like the ones in tightly regulated sectors or those subject to data protection legislation need to secure their environments with the right technology to manage and protect sensitive data, and even though the E5 license offers a good complete set of security and risk mitigation features it’s not necessarily the only way, or the most effective, to address your compliance needs.

In past articles, we have taken a look into the limitations that the native capabilities of products such as Microsoft Teams have when it comes to compliance. You may find that important functionalities, for example the ones regarding Information Barriers, are very limited with a Microsoft E5 license and not available in E3.

5- AGAT’s SphereShield for compliance

With costs that represent only 10% of a Microsoft E5 license, AGAT’s SphereShield offers a complete compliance set of solutions that can be integrated to Microsoft Teams, expanding some crucial functionalities.

This image has an empty alt attribute; its file name is image4-1024x446.png

Among its most important characteristics there’s the inclusion of an advanced information barriers solution: SphereShield’s Ethical Wall, that allows extra control over guest user capabilities, granular control over specific operations, incident auditing for compliance awareness, and more.

We have addressed before how Microsoft’s DLP solution is only near-real time, and the risks involved in that kind of reactive approach. AGAT’s SphereShield DLP engine offers real-time inspection of content and context-aware policies for data loss prevention, identifying and blocking sensitive data before it reaches the end user.

AGAT has also developed features that extend Microsoft Teams’ governance capabilities for better control over user permissions and preventing information leakage. SphereShield also offers eDiscoveryadvanced search capabilities that can be implemented online or on-site.

Finally, the whole range of compliance solutions developed by AGAT can be licensed separately, allowing companies to further tailor their subscription plans to meet their exact needs.

We encourage you to contact us to get a free trial of AGAT’s SphereShield

Categories
blog DLP Ethical Wall Screen Sharing

The Hidden Risks of Screen Sharing

image1 1

Sharing screens during presentations can lead to a full range of dangers, from embarrassing mistakes to catastrophic slips.

We’ve all been there: working on a thousand documents at the same time, and, unpromptedly, a virtual meeting requires you to screen share, and while you try to close every window, you realize every little embarrassing detail which is on full display for everyone else to see.

Dangers of Screen Sharing

1) Messy Desktops

image3

We’ve all seen this sometime in our lives. A desktop so messy that you can’t comprehend how a person can find anything on it, maybe someone working with multiple tabs simultaneously opened on their web browser, or simply a very unprofessional wallpaper.

These issues can lead to anyone quickly assessing the documents’ names, important folders, also, company information that shouldn’t be lying around in the first place.

2) Favorite music and private audios

Do you enjoy your favorite tunes while working? That’s good, who doesn’t? But, the problem here is that sometimes audio from the conference can get mixed up with the meeting one, and accidentally blast your music to every participant.

It could be even worse by displaying a private audio you received in confidentiality to the whole group of people.

3) Private Correspondence

Having your emails opened or another sort of message platform is a common practice among workers: you can check the influx of mail, any real-time conversation, and maybe some gossip, why not?

The real problem is when you accidentally show a glimpse of your inbox, or, even worse, you forget you are screen sharing and you start writing that private mail.

4) Private Pictures

image5 1

We don’t want to expose our beloved ones, but maybe you are working and forgot your wallpaper is a picture of your family and kids.

Or maybe you had Facebook opened, displaying your kids’ names and pictures for the whole company to see.

5) Pop-ups

Alert notifications, incoming emails, people calling. Not only can they be annoying and distracting, but they might reveal important information you are not willing to share.

Imagine you’re looking for a new job and, while sharing a screen with your boss, a pop-up email from a rival company tells you you didn’t get the job.

Or you get an incoming mail from your children’s school, telling you they were sent to the principal’s office for misbehaving.

Even worse, you are an important CEO at your company and you get an urgent email from your doctor about your iffy test results.

These are awful and embarrassing situations, but at least no law is being broken, unlike…

6) Important Documents

image7

Mistaking is human, and sometimes people forget to close the documents they were working on before a presentation. Maybe they were looking for a specific spreadsheet but ended up accidentally opening the wrong one, and displaying confidential information in front of everyone.

Imagine you are dealing with very sensitive information, like credit cards or social security numbers. You have all the personal data of an individual in full display, as you accidentally screen share.

The penalties for that could be just astronomical:

In 2021, the global average cost of data breaches exceeded $4 million, so this could easily put businesses into big distress.

Data is too valuable and must be secured: an unfortunate example of this is Uber. In 2016, a hacker compromised the personally identifiable information of nearly 60 million employees and customers.

Instead of disclosing the breach immediately, Uber paid the cyber criminal $100,000 to delete the data and keep quiet. Although, information about the breach leaked anyway, and turned Uber obligated to pay a settlement of $148 million on top of other damages.

In 2021, T-Mobile, a wireless network operator from the United States, suffered a huge data breach that exposed the full names, birthdates, social security numbers, driver’s license numbers, and other personal information of more than 40 million former customers and 8 million current customers. In just one year, over 50 lawsuits have been filed against the organization.

image4 1

Recorded Screen Sharing

What could be worse than a big slip-up? Being recorded as you do so.

Nowadays, most meetings are recorded, making the job easier for everyone, and there is a backlog in which you can find useful material for doing your job.

Sadly, that also means that any mishap can be recorded. Even when the human eye is too slow to read all the documents displayed on the screen, a quick pause on the video allows anyone to gather any personal data they might want or need. Or worse, the recording of the meeting could be shared by anyone or even edited!

So, is there anything we can do to avoid all this?

How to avoid ScreenSharing mishaps

Virtual Desktops

image2 1

Our computers tend to be very personalized, even when we don’t mean it. Trying to get rid of everything that could cause us trouble in a span of seconds is easily compared to trying to clean the whole house because guests are coming.  

A good solution to this is virtual desktops.

Virtual desktops are a set of applications and operating systems, in which the desktop environment is separated from the physical device used to access it. Users can access their virtual desktop over a network using any endpoint device.

They look and feel like a physical workstation, and the user experience could easily be better since powerful resources such as storage and back-end databases are readily available.

This could be used as a safe desktop. A clean screen with just the elemental pieces to your daily necessities.

DLP

DLP stands for “Data Loss Prevention”, a real-time agent which is crucial to effectively managing and protecting confidential information. This means all your internal and external communication is monitored and protected, while also any sensitive data will be intercepted and filtered before it reaches the recipient.

AGAT’s DLP immediately blocks any suspicious operation. Therefore, if a mishap is happening on a shared screen, the software is able to prevent any sort of data loss from happening.

The AI is able to instantly recognize crucial data being shared.

Let’s pretend someone from marketing is screen sharing for a presentation, although accidentally left open a spreadsheet, with a list of the customers’ credit card numbers for everyone to see: here, the program would act so fast that no one would be able to take advantage of the situation.

The best solution for Screen Sharing troubles

Ethical Walls

image6

Ethical walls are barriers that prevent information or communication exchanges between unwanted parties. They exist to prevent conflicts of interests and improper trading within organizations, i.e., preventing investors from talking with people who gather confidential information, that could lead to investment decisions.

AGAT’s Ethical Walls offers granular control over federation to address security and data protection when federating between different groups and users when interacting either with external companies or inside the same organization. You can apply specific sets of rules to each communicational case, and establish a safe control over your data share.

The user interface of the Ethical Wall is clean and simple, allowing control of each activity and dictating the communication direction, choosing either or just one side only to start a chat with the other side.

You can also block a specific group from communicating with another inside the company and even individual users. For example, IT could be forbidden from communicating with management, or certain level entry users from reaching the CEO.

Ethical Walls, therefore, help in implementing compliance regulations in companies.

In short, Ethical Wall offers the following features:

  • Granular control is offered based on groups, domains, and users, and is applied dynamically based on the context of the communication.
  • Policies can also be applied to flexibly control the types of communication, such as direct messages, file sharing, screen sharing, audio and video.
  • Policies can be applied to chat, channels, and/or meetings, depending on the participant type (employee, external, or guest).

Of course, AGAT’s Ethical Wall protects users from screen sharing mishaps too, by enforcing control over who can screen share with who, and which computers are allowed to be reached via remote screen share.

To learn more about it, contact us today!