who needs cybersecurity training? your whole staff.
by roman h. kepczyk
quantum of paperless
going “paperless” means that all firm files and client data will be digitally stored on the firm’s network, which is almost always accessible to firm personnel via internal workstations and remotely via the internet.
more: survey: digital audit confirmations not the norm | training that works | survey: 61% of auditors commonly use data extraction tools | survey: firms divided on esignatures
exclusively for pro members. log in here or 2022世界杯足球排名 today.
the firm has a fiduciary responsibility to protect this data from anyone not specifically authorized to view it. proper security is very difficult for any internal network administrator to guarantee as few have the experience and have participated in ongoing training to implement security settings optimally the first time.
therefore, all “one-shot” implementations of firewalls, wifi routers, virtual private networks and other security settings should be outsourced to an organization that has experienced personnel dedicated to security. in many cases, these providers can also deliver ongoing monitoring and maintenance of the firm’s firewall, internet connectivity, and provide security guidance and personnel training. we recommend all firms conduct annual security training for all staff on today’s most common cybersecurity threats including phishing, ransomware and social engineering, which can put the firm at risk.
the firm’s security infrastructure can then be verified by an independent security consultant every few years, or whenever a major change in the firm’s network infrastructure takes place. if there is not a security consultant locally, three vendors with accounting firm experience in north america are arxis technology (arxistechnology.com), mcmillen group (mcmillengroup.com) and xcentric (xcentric.com).
recommended actions:
- have an independent security consultant/network integrator review firewall, antivirus, spam and physical security at least every three years or whenever a major change is made to the firm’s infrastructure.
- mandate annual cybersecurity training for all firm personnel.