Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Privacy

10/19/2018
01:30 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Smarsh Survey Reveals Financial Firms Looking for Communications Risks in the Wrong Places

Eighth annual report finds organizations need to place a greater emphasis on modern workforce communications channels Including mobile and social media

Smarsh today released its eighth annual Electronic Communications Compliance Survey Report. The survey of compliance professionals in the financial services industry shows that organizations are not keeping pace with their retention and supervision efforts— particularly with a growing, younger workforce that relies on expanding, mobile-friendly channels, such as social media and text messaging. As a result, evolving technologies and shifting demographics within the workforce, and within firms’ customer bases, are forcing organizations to rethink their approach to the adoption and oversight of electronic communications.

While email remains the largest piece of the overall electronic communications landscape, social and mobile platforms are playing an increasingly important role in how firms, and investors, conduct business. Half of all respondents (50%) reported concern around non-email communications channels, such as social media, instant message/collaboration platforms, and SMS/text messaging. Likewise, the growing complexity of managing employee use of mobile devices for business communications was a top five concern for 42% of those surveyed, matching recent increases in regulatory scrutiny and enforcement.

“This year’s survey reveals that firms are focusing too much energy on older technologies and not enough time on the mobile and social communication channels that are growing in popularity among their customers and their advisors,” said Marianna Shafir, Corporate Counsel and Regulatory Advisor at Smarsh. “Many don’t have archiving solutions in place for the retention and oversight of modern communications channels, such as text messages, which causes problems and significant risk when facing a regulatory examination, open records request, an investigation, e-discovery event or litigation.”

Here’s Why Firms are Concerned About Social and Mobile Communications

While nearly all firms recognize the need for comprehensive oversight policies for electronic communications – the content of a message is determinative of its status as a business record, not the platform or device that sent it – many have been slow to address the channels of the modern workplace. According to the Bureau of Labor Statistics, the workforce demographics are rapidly shifting toward Millennials. The same report finds that nearly 30 percent of personal financial advisors are Millennials, while another 44 percent are members of Generation X. However, despite clear employee desire to have more flexibility in the communications channels that they consistently use for business, most firms are slow to formally adopt and support the governance of new channels such as social media and mobile.

Outside of email, SMS/text messaging presented the greatest perceived source of risk by a large margin. 59 percent of respondents cited SMS/texts messaging as the biggest perceived risk, ahead of social media and instant messaging/collaboration platforms. At the same time, respondents identified content from instant messaging/collaboration platforms and SMS/text messaging as the top two channels where they devote too little time to supervision.

Additional Key Findings

The report addresses several additional aspects of electronic communications compliance. Other key findings include:

Mobile & Social Present Pressing Challenges for Most Firms.

Mobile device usage will continue to grow in the workplace, which means responsible organizations need to rise to the challenge when it comes to confronting the subsequent retention and oversight challenges. Among respondents that allow SMS/text messaging for business, nearly half (48%) lack an archiving/supervision system. While most compliance gaps have decreased from last year, the SMS/text messaging gap is the same as in 2017 and the corporate IM/collaboration platform gap has increased year-to-year from 24% to 31%.

Confidence in Prohibition is Low.

Prohibition of specific communication channels for business use is not a reliable risk management strategy and is temporarily effective at best. Confidence levels surrounding the effectiveness of prohibition policies are telling. Among firms that prohibit the use of SMS/text messaging, only 44 percent are mostly or completely confident they could prove that their prohibition efforts are working. Respondents also surfaced significant confidence gaps for LinkedIn, Twitter, and Facebook.

To download a copy of the Electronic Communications Compliance Survey Report, visit www.smarsh.com.

About the Survey

In February and March 2018, 191 individuals in financial services with direct compliance supervision responsibilities participated in a 40-question survey designed to identify current trends and to share insight on policies and practices about the usage, retention and supervision of electronic business communications. Respondents were drawn from a wide range of firm sizes and job titles, from C-level management and chief compliance officers to compliance department staff.

Smarsh offered an incentive to respondents in the form of a charitable donation via Smarsh Full Circle (www.smarsh.com/fullcircle), its community service initiative. Questions were answered through an online survey, and the responses were collected by a third party.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
10 iOS Security Tips to Lock Down Your iPhone
Kelly Sheridan, Staff Editor, Dark Reading,  5/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11949
PUBLISHED: 2020-05-28
testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to obtain arbitrary files from a camera's local filesystem. For example, this affects IT9388-HT devices.
CVE-2020-11950
PUBLISHED: 2020-05-28
VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to upload and execute a script (with resultant execution of OS commands). For example, this affects IT9388-HT devices.
CVE-2020-13645
PUBLISHED: 2020-05-28
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verificat...
CVE-2020-13643
PUBLISHED: 2020-05-28
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be e...
CVE-2020-13644
PUBLISHED: 2020-05-28
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accord...