Security Toolkit: Data Protection Best Practices for CPA Firms
The following post was written by the team at Cetrom, a provider of Cloud-based IT infrastructure. We thank them for sharing this content through our blog.
The world of cyber and data security moves at the speed of light. Technologies and security programs are in a constant state of flux and evolution to anticipate and then counter a threat matrix that never sleeps and never stops changing. The cold, hard reality is this: No CPA firm is safe from having their data targeted by hackers and hacker groups with bad intentions. Whether you’re a C-suite executive at a big CPA firm or an IT lead at a smaller accounting organization, you need to be armed with the latest security best practices and resources. You need a security toolkit!
Cetrom is here to help. We’ve compiled the following list of best practices and resources that will bolster your CPA firm’s data security defenses against a pervasive and relentless enemy that’s always scratching at the gates.
Frame Your Data Security Strategy Around These Three Things
Your approach to cybersecurity cannot be piecemeal; it must be comprehensive and consistently executed, monitored, and adjusted, which can be a tough task for IT teams stuck in “break-and-fix” mode.
We recommend a three-pronged overall approach to improving cybersecurity:
- Educate. Your entire staff must be educated on digital security best practices; initial training must then be followed up by more training and a commitment to continually improving the cybersecurity knowledge of your entire team, not just your designated IT experts
- Secure. Assess or hire a third-party IT expert to assess your network’s weaknesses. Then, acquire the necessary technology, software, and tools to plug gaps and strengthen identified vulnerabilities. Securing your network also includes developing a detailed disaster recovery plan should you get hit; the faster you’re able to recover the less damage will be done to your CPA firm and its brand.
- Back Up. You need to focus on building a multi- faceted backup protocol, possibly including onsite backup storage, cloud storage, and even geographically dispersed backups stored in highly secure data centers.
Communicate Consistently and Openly About Security Matters
Data security is not just IT’s problem.
Cyber attacks and data breaches are often the result of human error. Your people remain one of the biggest threats to your data security. Share the pertinent data security details with your entire organization. That doesn’t mean you need to share every detail, but you do need to communicate more broadly about the importance of cyber security, data protection and the role every employee plays in data security efforts.
Every employee needs to embrace data protection.
The best AI or software won’t stop one employee from opening an email that lets the bad guys in the back door of your network.
Invest in Cybersecurity Education
Again, your staff represents one of the gravest cybersecurity risks out there; it is also possibly the most difficult risks to mitigate. Human error, ignorance to possible threats and poorly communicated internal protocols can very easily lead to network breaches.
The most effective solution: Constant education and training of your staff.
Your small IT team, or one IT person, can’t do this alone. Every employee needs to take ownership of the role they play in keeping your CPA firm’s data and information safe. The most sophisticated and expensive software in the world can’t stop a single employee from opening a phishing email that lets the bad guys in.
A cybersecurity educated and trained workforce is your best line of defense against security breaches. Training should be an ongoing professional development requirement that will reinforce company-wide security policies like the following:
- Clear, enforced password rules. Don’t allow your staff the freedom to create simple passwords that they never change. Implement clear password requirements and designate password change deadlines that are appropriate for your industry.
- Restricting access and permissions. Employees should only have the keys to what they need to perform their job.
- Make sure all devices are protected. Cybersecurity should not just focus on an employee laptop — phones, tablets, and any other device doing company business must be protected.
- Require multi-step identity verification. This means that staff cannot always access data using only their username and password. A text or email verification could be required for full access.
- Document your policy and enforce it. Your cybersecurity protocols and processes need to be written down and signed-off on. As threats and technology change, your document needs to evolve and your team needs to get retrained. Have your team sign the document and hold them accountable.
Deploy Artificial Intelligence
AI is a valuable tool for thwarting cyberattacks, be they malware, ransomware, or a solo hacker. It’s an established fact that human monitoring of any given IT network is doomed to failure: The global reach, non- stop change, and supersonic speed of the cybersecurity threat ecosystem is far too much for any one IT person – or even a sizable team – to handle alone. AI, when deployed by an experienced IT-managed services partner like Cetrom, can be a great weapon against security breaches.
- Earlier Breach Detection. Much of detection work is rote, mundane work that’s less than ideal for people and a perfect fit for AI, which never gets bored, or tired, or careless. AI is a logical solution for improving the speed and accuracy of breach detection. AI’s always-on, always-scanning nature not only can reduce vulnerabilities, it also can increase attack response times by allowing your IT team to focus on response rather than everything all at once, including detection. In that way, AI enhances your cybersecurity program both in detection and response.
- Email Scanning. The sheer volume of email activity at a company of any size makes manual, human-led monitoring very difficult, if not impossible. Having automated, AI-led email monitoring is really the only effective approach to mitigating the biggest cybersecurity risk of all: your staff.
- AI Is Better Than Antivirus Software. Antivirus tools are always lagging behind the pace of existing malware threats. AI can detect threats without the lag as it doesn’t depend on signature updates. AI will look at anomalies and unusual program behaviors as they happen, so there is no gap for malware of hackers to exploit between signature detection and distribution.
Develop a Disaster Recovery Plan
This last tip for better cybersecurity is not AI or tech-based. It’s really about being proactive and planning in advance for the worst-case scenario. The first step is simply accepting that a cyberattack is coming sooner or later. Once you and your IT team accept this reality, developing a disaster response and recovery plan is a no brainer. Here are a few tips for building an effective plan.
- Assess your response plan as it currently stands, identifying strengths and weaknesses.
- Create a disaster response and recovery team comprised of staff members from IT and all other departments.
- Develop, document, and communicate the final plan to all employees.
- Create standing re-evaluation periods where the plan can be adjusted, updated, and improved.
- Practice, practice, practice. Run mock attacks and breaches periodically to test your team.
The bottom line: Your CPA firm will get hit. How fast and how well you respond is directly correlated to the damage that will be done to your bottom line and brand reputation.
Bulk Up Your Backup Processes
Finally, you must have a regimented, sophisticated, and repeatable backup process for your data.
- Multiple backups need to be conducted daily
- You need to use various methods to backup your data to create redundancies; these could include cloud backups, hard drive backups, or other methods
- The key is that these backups must live outside of your network and some should live beyond your physical office space to mitigate the risk of natural disasters, fires, or break-ins
You can even store your data and backups in geographically dispersed, disaster-proof, and highly secured locations offsite. For example, Cetrom clients enjoy the peace of mind that comes with their data being securely stored in our two Cloud data centers in Virginia and Colorado that are geographically dispersed for automatic failover protection and remote backups, ensuring their data is protected. Both facilities are SSAE 16 compliant (formerly the SAS70 standard) and SOC 2 compliant for top-tier security measures.
Migrate to the Cloud and Partner with an Expert Cloud Partner
Every best practice listed above is enabled and enhanced by adopting a cloud solution and partnering with the right expert to help you along this data security journey.
Moving to the Cloud or a custom Cloud hosting solution setup has its security advantages, particularly when this move is coupled with a partnership with an experienced IT-managed services partner. What you get by combining a Cloud or customized Cloud system with this partnership can be invaluable to your cybersecurity effectiveness. You should get:
- Access to top-notch security measures to protect your data from hackers (firewalls, anti-spam/anti- virus, endpoint protection platforms, two-step authentication, etc.)
- Proactive monitoring of all hardware and software systems 24/7/365
- Access to the best hardware and software available in the market
- A dedicated team of engineers experienced with combating cyber threats
Moving to the Cloud will improve your CPA firm’s security capabilities, for certain. To maximize the Cloud’s security impact also requires identifying and partnering with the right Cloud Service Provider that understands your business and can customize the Cloud to your needs. 24/7/365 network monitoring by experienced IT experts, disaster response planning and assistance, security training for employees and even data breach drills are the hallmarks of a strong cloud services partner.
Your CPA firm’s best defense against cyberattacks is consistent and effective cybersecurity training and cyber education. Providing your employees with access to the right cyber tools and resources not only will enhance their professional development, but it will also mitigate against the single biggest threat to your firm’s data integrity: human error and negligence.
Interested in Learning More? Consider these K2 Enterprises Learning Options
Fraud continues to plague businesses at epidemic levels and technology control failures are a large reason fraud occurs. Using a case study approach, in this session you will learn about the pervasiveness of fraud, the control failures that contribute to fraud, and what you can do to mitigate fraud risk.
A specific focus of this course is the application of information technology general controls and information technology application controls. In this course, you will examine numerous reported fraud cases and identify the general control and application control failures that contributed to each of these frauds. By learning through these real-world case studies, you will be in a better position to reduce fraud risk.
For more information, click here or visit https://www.k2e.com/seminars/fraud-and-technology-controls/.
Security is not optional and yesterday’s security techniques are not working to minimize today’s security threats. Therefore, now is the time for you to tune up what you know about protecting sensitive data. In this program, you will learn about the latest tools and techniques for securing your data, including encryption, virus protection, secure communications, electronic signatures, secure authentication, and more. You will also learn how to implement a very practical, five-step approach to securing your PC and the types of questions you should be asking of your staff to ensure server-based information remains protected. Extensive demonstrations will be used by your K2 instructor to teach the techniques and concepts presented.
Security failures, such as a breach of client or customer data, are costly – they can even drive your company out of business. What are the security tools you need and how do you use them to secure your sensitive data and systems? Can you afford to take the risk of attempting to manage today’s threats by using yesterday’s techniques? Participate in this program to learn how you can implement viable and practical solutions to mitigating today’s security threats.
For more information, click here or visit https://www.k2e.com/seminars/securing-data/.
In conjunction with over twenty state CPA organizations, K2 Enterprises develops and delivers one-day and two-day technology conferences across the United States. For approximately three decades, these conferences have provided participants with a premier choice for staying on top of the ever-changing world of technology as it relates to accounting, financial, and other business professionals.
To ensure the relevancy of content, each year the topics for these conferences are selected from a survey of over 80,000 CPAs across the nation. The feedback gathered from these CPAs through survey is, in turn, used to identify the sessions presented during these conferences. This process helps to ensure that the topics presented are relevant and timely, and that participants’ educational needs are met.
For more information, click here or visit https://www.k2e.com/conferences/.
