Chapter 11 - Cyber Security and Use of Artificial Intelligence
Financial advice practices hold significant amounts of sensitive information, including personal identification details, financial records, account information and confidential advice documents.
This makes financial services businesses attractive targets for cybercriminals. While cyberattacks can be highly sophisticated, many security incidents begin with something relatively simple: a compromised password.
iComply2 Password Manager App
The iComply2 Password Manager App helps advisers and their teams improve how business passwords are created, stored and managed, providing an important layer of protection for practice systems and client information.
Why password security matters
Advisers and support staff may access numerous systems during an ordinary working day, including:
Client relationship management systems.
Investment and platform provider portals.
Financial planning software.
Email and document storage platforms.
Licensee and compliance applications.
Accounting, payroll and payment systems.
Marketing and communication tools.
🔑 BUILD A PROCESS, NOT A HABIT
Remembering a different complex password for every system is difficult. Without an appropriate password management process, people may use weak passwords, reuse the same password across multiple systems or store passwords in insecure documents, emails, notebooks or spreadsheets.
If one reused password is exposed, cybercriminals may attempt to use it to access the person’s other accounts. This is commonly known as credential stuffing.
A compromised account could expose confidential client information, enable fraudulent transactions, interrupt business operations or allow an attacker to impersonate an adviser or staff member.
What is the iComply2 Password Manager?
The iComply2 Password Manager provides practices with a central location for managing access credentials used across their business.
Rather than relying on staff to remember passwords or store them using insecure methods, the app supports a more structured approach to password management within the iComply2 environment.
It helps practices maintain stronger and more consistent password security while making it easier for authorised team members to access the systems they require.
How the Password Manager helps advisers
Stronger and more unique passwords
A password manager makes it practical to use longer and more complex passwords without expecting staff to remember every password.
Each system should have its own unique password. This limits the potential impact if the credentials for one service are exposed.
Reduced password reuse
Reusing passwords across multiple systems creates a significant security risk. If one provider experiences a data breach, the same credentials may be tested against email accounts, CRMs, platforms and other business applications.
Using the iComply2 Password Manager makes it easier to maintain separate passwords for separate systems.
Less insecure password storage
Passwords should not be stored in emails, unprotected spreadsheets, shared documents, web browser notes or handwritten lists that can be easily accessed.
A dedicated password manager provides a more appropriate method of managing business credentials and reduces the need for informal password lists.
Better access management
Practices need to ensure that access to systems is limited to people who genuinely require it for their role.
A central password management process helps practices manage access more consistently, particularly when team members change roles, take extended leave or leave the business.
Improved business continuity
Business-critical credentials should not be known by only one person.
Appropriately managed access helps ensure that authorised team members can continue essential operations when a key person is unavailable, without resorting to insecure password-sharing practices.
More efficient administration
Password managers do more than improve security. They can also reduce time lost to forgotten passwords, repeated password resets and searching for access details.
This creates a more efficient experience for advisers and support staff while maintaining stronger security controls.
Password management is only one layer of protection
🛡️ PART OF A BROADER FRAMEWORK
The iComply2 Password Manager should form part of a broader cybersecurity framework. Practices should also:
✓Enable multi-factor authentication wherever it is available.
✓Use a different password for every account.
✓Never approve an unexpected multi-factor authentication request.
✓Keep computers, mobile devices, browsers and applications updated.
✓Be cautious with links, attachments and unexpected login requests.
✓Verify unusual payment or information requests using a trusted contact method.
✓Remove access promptly when a staff member or contractor leaves.
✓Regularly review who has access to business-critical systems.
✓Maintain reliable backups and test recovery processes.
✓Report suspected cyber incidents immediately.
Multi-factor authentication is particularly important. A password manager protects and organises passwords, while multi-factor authentication provides an additional barrier if a password is compromised.
Protecting the master password
Access to a password manager must itself be carefully protected.
Users should create a strong and unique master password that is not used for any other account. The master password should never be shared through email, text message or another unsecured channel.
Multi-factor authentication should also be enabled for access to the password manager wherever available.
Cybersecurity is a shared responsibility
Technology is an important part of cybersecurity, but secure behaviour remains essential.
Every adviser and staff member has a role in protecting client information. One weak or reused password can undermine otherwise strong security controls across a practice.
Practices should establish clear expectations for password management, train team members on those expectations and regularly review compliance with their cybersecurity procedures.
Getting started
Advisers and staff are encouraged to use the iComply2 Password Manager for business-related credentials and progressively replace weak or reused passwords with strong, unique alternatives.
Priority should be given to systems containing sensitive client or business information, including:
✓Email accounts.
✓Client management systems.
✓Advice and document storage platforms.
✓Investment and product provider portals.
✓Accounting and payment systems.
✓Cloud storage services.
✓Licensee and compliance applications.
By combining the iComply2 Password Manager with multi-factor authentication, appropriate access controls and strong cybersecurity awareness, practices can materially reduce the likelihood and potential impact of a compromised password.
Cybersecurity does not depend on one system or one control. It is built through consistent habits — and secure password management is one of the most important places to start.