Certainly a sophisticated threat actor could very easily find ways into the SEC system, a former attorney for the agency told CNBC.<\/b>
\nThe U. S. Securities and Exchange Commission database that was hacked is decades old, former SEC attorney Scott Kimpel told CNBC on Thursday.
The country’s top regulator said on Wednesday it discovered last month that its corporate disclosure database was breached in 2016. It is currently investigating the matter, which may have resulted in hackers profiting by trading using insider information stolen from the system.
Kimpel said there are various security systems that are put in place in the SEC’ s database.
However, \u00ab\u00a0you are dealing with a system that really was built in the 1980s and has been updated through patches over the last three decades,\u00a0\u00bb he said in an interview with \u00a0\u00bb Power Lunch .\u00a0\u00bb
\u00ab\u00a0Certainly a sophisticated threat actor, be it a nation-state or organized crime or some other person with those sort of inclinations, could very easily find ways into the system.\u00a0\u00bb
However, former SEC counsel Bradley Bondi told \u00a0\u00bb Closing Bell \u00a0\u00bb he was very surprised by the intrusion given the tight security in that part of the SEC’s system.
\u00ab\u00a0What happened here was the equivalent of a hacker going into Fort Knox and stealing some gold bars,\u00a0\u00bb he said.
The system, called EDGAR, houses millions of documents that companies are required to file to the SEC so they can be accessed by investors.
The hackers gained access by exploiting a software glitch in the test filing component of the system to gain access to non-public information, the agency said.
Kimpel said companies often make test filings in the hours or days before the actual filings are done. He now suggests companies wait to do it until the last possible second.
\u00ab\u00a0If you would do a test filing at night, for example, before you file the next morning that data sits on the server 12,14 hours, giving a cybercriminal\u2026 plenty of time to play with whatever information they’re able to obtain,\u00a0\u00bb he said.
The SEC \u00ab\u00a0promptly\u00a0\u00bb patched the vulnerability after detecting it in 2016, but the regulator only became aware last month that the glitch \u00ab\u00a0may have provided the basis for illicit gain through trading,\u00a0\u00bb it said.
Bondi said catching those who may have committed the hack and traded illegally on the inside information will be a difficult task.
\u00ab\u00a0It’s going to take a while, I think, for the SEC to piece through and determine really the impact here of these hacks,\u00a0\u00bb he said. \u00ab\u00a0But they do have the tools, and they do have the legal arsenal to \u2026 bring these people to justice.\u00a0\u00bb
According to a report reviewed by Reuters, the U. S. Department of Homeland Security detected five \u00ab\u00a0critical\u00a0\u00bb cybersecurity weaknesses on the SEC’s computers as of Jan. 23,2017.
\u2014 CNBC’s Kerima Greene and Reuters contributed to this report.<\/p>\n

\n

Similarity rank: 10<\/div>\n

Sentiment rank: -0.9<\/div>\n

<\/div>\n<\/div>\n