Asset Allocation by its nature is a risky business attempting to make money through investments such as shares, equities and funds. With this in mind it makes sense to ensure every other aspect of the company is as safe as possible to prevent further risks and dangers.With this in mind let me set the following scene:
'Imagine you arrive at work in morning and are just about to enter the building when you see a delivery person struggling with the door'
It’s human nature to try and be helpful (at least for most of us); in this situation it would mean holding the door open so they can get through easier. Of course in a perfect world this is fine but what if that delivery guy you let into the building was in fact a ‘Hacker’, you would have just given them access to the building and potentially the network of your business.
This type of attack is known as ‘Social Engineering’ and it preys on people’s good will. These sorts of attack go beyond the ‘Tail Gating’ example mentioned above and can actually become quite smart in the way they work. Someone confident in the art of Social Engineering might even attempt to directly contact a member of staff pretending to be in a position of authority to gain information on their target (an act known as ‘Reverse Social Engineering’). Obviously this works better in larger organisations where there is less personal contact between the lower and higher levels of the workforce.
As soon your network is compromised internally it no longer matters how much your company has spent on fancy Firewalls and advanced Intrusion Detection Systems because the damage is probably already done. Trojans might have been put in place to allow the hacker a Backdoor for easy access to the network again, Key loggers could have been installed on a target system or personal details might have already been taken from the database. These are things that you really don’t want to have to worry about when you are trying to focus on complex Asset Allocation procedures.
There’s nothing that can really stop these types of attacks from happening but you can do your best to prevent them. This amounts to one thing really; Training and knowledge sharing. You need to set out clearly in the operational procedure of the business the sort of things to be aware for; i.e. Do not let unauthorised personnel into the building, always lock your computer (with password protect) whenever you leave it for a prolonged period of time and never ever give your password out to anyone.