checklist: protect your firm in 10 steps.
by hitendra r. patil and jeffrey lush
jeffrey lush is ceo and co-founder, bap solution, a cybersecurity firm lush is known widely as a passionate technologist with more than 34 years of it experience. before serving as ceo for bap, he worked as the cto for both hpe and dell federal. lush’s us federal experience includes serving as the executive chief technology officer for the us department of veterans affairs. he has served on us presidential workgroups focused on cyber and has extensive knowledge of cybersecurity standards and policies throughout the globe, with a focus on us federal policies to include nist, fisma, fedramp, dfars, pci, and hipaa.
it is no secret that cybersecurity continues to top the list of business concerns for businesses of all sizes. small independent business, mid-size business and large organizations can all be impacted by a cyber attack.
why accountants need to recognize cybersecurity as a daily “to-do”
the ponemon institute, the well-respected creators of the “cost of a data-breach” annual report, says that the biggest threat is that cyber threats keep evolving. if it teams don’t know what to expect, how are accounting professionals supposed to help cyber threats? in addition to a possible business impact, many organizations that touch personal identifiable information or other sensitive data are often subject to government regulations. failure to comply is costly and embarrassing.
it is even more critical for accountants and accounting firms, simply because it is not just your own data and information that you want to protect from cyber threats but because you manage your data and information of your clients – and possibly of their employees, their vendors, their customers, etc. therefore, for hackers, your firm can be that “master-key” that can open many doors.
the first and fundamental preventive measure you can take to protecting critical data, reducing the risk of a cyber attack, and complying with federal mandates is to start thinking about security and to begin today with tested steps. many of the steps may feel simple, but the improvement in security is substantial.
what is cybersecurity
first, let’s recap what we mean by cybersecurity. cybersecurity is a blanket term that encompasses a number of different ways to protect from the attack vectors that a hacker can utilize to access proprietary information. their typical goal is to acquire sensitive data to sell on the dark web for profit. your data has big value. let’s review some of the most common types of attacks.
- ransomware – as the name implies, ransomware occurs when malware is unleashed on your system to block access to your data until a ransom is paid to get back. this method is often distributed through email that might include an attachment carrying the malware payload. or the email contains links to websites that contain links to malicious sites. the fbi discourages payment of ransom, because paying your ransom does not mean you get your files back. it also means that the hacker was successful, and will strike again.
- phishing – phishing is also done through email. these emails are often doctored to look like they are sent from a trusted contact or company to trick recipients into revealing personal information. a form of phishing focused on executives is called whaling. the types of data they are “fishing” for is often passwords, banking details, credit card numbers. spear phishing takes place with the attackers spend the time to research their intended target and personalize their messages. for obvious reasons, these attacks can be very difficult to detect.
- distributed denial of service (ddos) – ddos consist of attacks against a system’s resources to overwhelm service and shut it down. there may not be a financial benefit to a hacker, aside from the satisfaction of interrupting service. however, competitive companies have been known to launch ddos attacks to interrupt competitors business for financial gain.
- spoofing – sometimes called man-in-the-middle. just as both names imply, this happens when your communications between a client and trusted servers are hijacked. often times the attackers send a packet which mimics the intended host and disperses malware on your system.
- insider threats – this is when digital information is stolen from someone or something inside of your environment. often a trusted insider will make copies of key company details ranging from product specifications, financial details, or other valuable information that may cause financial damage. insiders could be employees, former employees, contractors, or anyone else that may have access inside of your firewall, antivirus, and endpoint protection.
how you can ensure cybersecurity
there are numerous other kinds of cyber threats. these may feel daunting and make you wonder how you as the accounting professional can make any difference. the answer is that you can make a difference. making basic adjustments to the way you go about business may thwart countless attacks.
1. one of the first things that you should do, especially if you are an independent or small business accounting firm, is to ensure that you have an updated antivirus on your computer and that it is activated. if you don’t have one, then get one right away. in terms of cyber protection, antivirus apps are very inexpensive. antivirus apps are often compared to the fence around a yard. its job is to create the first barrier to keep the majority of threat out. there a number of organizations that routinely test most of the antivirus options out there, such as pcmag and av comparatives are both widely respected as independent reviewers. they compare side by side so you can find the product that best meets your need.
2. basic cybersecurity-hygiene – there are some simple steps you should be incorporating into your everyday workload. the key is to be vigilant. if something feels off or wrong, it likely is. implement the steps below to improve your cybersecurity.
3. lock your computer screen when you are not at your desk. when i first started working for a technology company our it team would routinely change passwords for anyone not locking their screen. it was an unpleasant reminder that if they can change your password, anyone has access to your files. you would never want to give a burglar the keys to your house. leaving your computer unlocked and unattended is doing just that.
4. physical security: secure physical files. while in the office, do you have a process for locking up any files that have personally identifiable information or sensitive information? whether this is a clients tax returns, quarterly financial details, or bank information, you are likely touching very sensitive information. the best thing to do is lock it up. in compliance with your company policy, excise proprietary information when you can. in addition, what are your policies for public access to your workspace? if you are in an environment that does not have access control (badge system) to admit people to your office, you may need to implement even stricter procedures.
are there times you may work remotely? will you be carrying sensitive data between work and home? the best practice here is to keep that data with you or secure in a safe place at home, this could include a locking safe. a few years ago there was the story of a state government worker who had a laptop stolen out of their car. or another who had contracts stolen from a briefcase stolen from their car.
in addition, never insert into your computer an unknown device, such as an usb. social engineers for years have strategically dropped usb drives hoping an unsuspecting person will pick it up and insert into their computer, thus unleashing rogue malware.
5. email – do not open any links from people you do not know, especially unsolicited. as we saw when describing the types of cyber attacks, email is a popular vehicle for distributing malicious malware. in general, you will not receive an email from the irs, law enforcement or you cousin who has money for you but needs you to first send money to get them to where they can send you money. if an email feels strange, don’t open or click. hover over the sender’s address to ensure it is the right email. or give them a call to ensure they sent you something to open.
6. social media – similar to email, don’t open something from someone you don’t know. also, accepting connections requests from someone you do not know, without doing any sort of preliminary due-diligence, can risk you as well as your existing connections – because when you connect with them, inadvertently you are giving the new connection a shield of legitimacy. it is common to hear “i connected with that person because some of my friends/connections were our mutual connections.”
7. internet searches – plain and simple, don’t search where you shouldn’t on a work computer. avoid celebrity sites, pornographic or other kinds of like searches. these sites often are riddled with malvertising or other types of malware that can infiltrate your system and have an impact well beyond your internet. the right antivirus will have internet security included.
8. continuously monitor – in conjunction with your it team, they should have technology in place to always be watching your system.
9. back up, back up, back up – if you are ever victim to a cyber attack you may not be able to retrieve your files. it is good policy to regularly back up your hard drive to ensure that if something does ever happen you have access to your files. backing up always gives you an option out if you are hit by an advanced cyber attack, such as with ransomware.
10. get trained – if you have an in-house it team, ask them to train you and your department on best practices. or if you are independent, choose from resources found from the following non-profits. check out additional free resources from these groups:
resources – stop, look, think campaign by isc2 – https://www.isc2.org/
center for internet security – https://www.cisecurity.org/
center for cyber safety and education – https://iamcybersafe.org/
11. cybersecurity is not a one-time thing – it is also important to frequently review your processes and determine what can be improved to secure your environment.
you, truly, can be the difference between a major breach and security. by being aware and vigilant, you may thwart a cyber attack on your environment. following these steps will give you peace of mind and help to combat.