Schulte Roth & Zabel, a market-leading law firm serving the financial services industry, is hosting its 11th Annual Shareholder Activism Conference today. The virtual event spotlights prominent players in the shareholder activism space, including activist investors, advisers and proxy advisory firms. The speakers will discuss their perspectives on the current activist environment, lessons learned from recent campaigns and the impact of the COVID-19 pandemic and regulatory changes, among other topics. The event is by invitation only.

Ele Klein and Marc Weingarten, SRZ partners and co-chairs of the firm’s global Shareholder Activism Group, are spearheading the annual event. Mr. Weingarten will provide introductory remarks and Mr. Klein will speak on the “The Activist Perspective: Effecting Change and the Market Challenges of COVID-19,” panel featuring Josh Frank of Trian Fund Management, Scott Ostfeld of JANA Partners and Jeffrey Smith of Starboard Value, among others.

Aneliya Crawford, SRZ partner in the Shareholder Activism and M&A Groups, will speak on the panel “Anatomy of a Contest: Voce Capital at Argo Group International,” featuring J. Daniel Plants of Voce Capital Management and Dan Zacchei of Sloane & Company. Ms. Crawford will also moderate the panel “The Role of the Proxy Adviser Amidst New Rules and COVID-19,” with appearances from Cristiano Guerra of Institutional Shareholder Services, Jason McCandless of Glass Lewis & Co. and Gregory Taxin of Spotlight Advisors.

Mr. Klein will participate also on the “Anatomy of a Contest: Harbert Discovery at Enzo Biochem” panel with speakers Bruce Goldfarb of Okapi Partners and Kenan Lucas of Harbert Management. Josh Black of Insightia, Jonathan Gasthalter of Gasthalter & Co. and Scott Winter of Innisfree M&A Incorporated will discuss the “State of the Market and Trends for the 2020-2021 Proxy Season.”

In addition, the conference will highlight the expertise of the following SRZ partners: Stephanie Breslow discussing the growing interest in ESG by investors; Michael Swartz providing insight into proxy litigation and Craig Warkol weighing in on insider trading, all as related to shareholder activism and the current state of the market.

“We are proud to present our 11th Annual Shareholder Activism Conference,” said David Efron,

SRZ co-managing partner and co-head of the Investment Management Group. “A year like no other, 2020 and the impact of the pandemic on the activism market will give way to timely discussions during today’s conference,” commented Marc Elovitz, SRZ co-managing partner and chair of the Investment Management Regulatory & Compliance Group.

Mr. Klein commented, “In particular, there was a substantial change in how companies conduct annual meetings, a reignited debate on the purpose of the corporation and new defensive strategies for companies.” Mr. Weingarten added, “There was also a reshaping of the shareholder activist model, as some activists adopted tactics historically associated with private equity. We will discuss the drivers behind this development and others during today’s seminar.”

SRZ is widely regarded as the dominant global law firm for shareholder activism. We bring to each matter a sophisticated knowledge of market practices, vast experience and unparalleled expertise in all areas of law impacting activism. SRZ has more than 30 years of experience advising clients on more than 1,000 shareholder activism matters, making us one of the most experienced advisers to activists in the world.

SRZ assists with all matters relating to activism, including campaign strategies, corporate governance, proxy rules, trading and affiliate rules, Sections 13 and 16 compliance, antitrust regulations, federal and state securities and corporate laws, tax and regulatory issues and litigation. Our lawyers work with clients on a variety of activist strategies, including behind-the-scenes long-term partnerships between activists and management, proxy contests, board and management changes, consent solicitations, special meetings and withhold campaigns, M&A activism, exempt solicitations, regulatory approvals, investigations and legislative hearings, corporate governance improvements, defensive and offensive litigation, spin-offs, split-offs, divestitures and buybacks, and ESG.

Click here to read the November 2020 Shareholder Activism Insight report, published by SRZ in association with Activist Insight and Okapi Partners. Visit SRZ’s Shareholder Activism Resource Center.

On Sept. 15, 2020, OCIE issued a cybersecurity Risk Alert[1] warning about an increase in cyberattacks against registered investment advisers and broker-dealers using “credential stuffing.” Based on recent examinations, OCIE has observed that credential stuffing is an increasingly effective method of attack that can be used to steal assets from customer accounts and access sensitive information.

What is credential stuffing?

Credential stuffing is a type of cyberattack perpetrated by collecting compromised client login credentials from the dark web and, through the use of automated scripts, employing those credentials to gain unauthorized access to customer accounts and firm systems. These attacks are more effective than more traditional means, such as trying to guess passwords by attempting all of the words in a dictionary, because attackers are able to leverage specific information collected online, such as user names, email addresses and associated passwords. If successful, a cybercriminal gains access to a firm’s accounts and systems, enabling the theft of assets from customer accounts and access to confidential information (including additional login credential information) and network resources. Information obtained by the attacker could be sold to other cybercriminals on the dark web. Bad actors may even monitor or take control of a customer’s or employee’s account.

OCIE observed that internet-facing websites — sites that are accessible to the public as opposed to sites that may only be access internally — are most vulnerable. This often includes sites hosted by third-party vendors. The presence of personal information on easily located internet-facing sites, such as the email address of a CTO, can also be combined with information retrieved from the dark web to obtain unauthorized access to accounts.

What steps should managers take to safeguard accounts and systems against credential stuffing?

OCIE encourages fund managers to be proactive in mitigating the risk of credential stuffing, including:

• Password Policies and Procedures. Periodic review of policies and programs with a specific focus on updating password policies to incorporate a recognized password standard requiring strength, length, type and change of passwords practices that are consistent with industry standards. OCIE has observed that successful attacks occur more often when (1) individuals use the same password or minor variations of the same password for different online attacks; or (2) using login usernames that are easily guessed;
• Multi-Factor Authentication (“MFA”). Use of MFA to authenticate the person seeking to log in to an account, which can offer one of the best defenses to password-related attacks and significantly decrease the risk of an account takeover. As MFA frequently relies on sending data to mobile devices, OCIE warns of the need to be alert to when devices are lost or no longer working;
• CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart). Deployment of CAPTCHAs, which requires users to enter information to verify that they are not bots, frustrates the use of automated scripts used in credential stuffing;
• Controls to Detect and Prevent. Implementation of controls to detect and prevent credential-stuffing attacks. For example, monitoring for a higher than usual number of login attempts or implementing a Web Application Firewall (“WAF”) that can identify and thwart credential stuffing attacks);
• Dark Web Monitoring. Surveillance of the dark web for lists of leaked user IDs and passwords; and
• Training. Educate employees and customers on the use of strong, unique passwords and on potentials signs of an attempted or successful cyberattack.

This article appeared in the October 2020 edition of SRZ’s Private Funds Regulatory Update. To read the full Update, click here.

[1] See Cybersecurity: Safeguarding Client Accounts against Credential Compromise (Sept. 15, 2020), available here.

This communication is issued by Schulte Roth & Zabel LLP and Schulte Roth & Zabel International LLP for informational purposes only and does not constitute legal advice or establish an attorney-client relationship. In some jurisdictions, this publication may be considered attorney advertising. ©2020 Schulte Roth & Zabel LLP and Schulte Roth & Zabel International LLP. All rights reserved. SCHULTE ROTH & ZABEL is the registered trademark of Schulte Roth & Zabel LLP.