2019 was a landmark year for cybercrime, and this year will be just as dangerous for accounting firms like yours. Are you sure you’ll have a safe and secure 2020?
The more cybercrime events there are, the less it seems we pay attention to them. It’s all kind of become white noise, right?
Becoming complacent about your cybersecurity is dangerous, though. The fact is that cybercrime has never been bigger:
The point is that cybercrime is a growing and ever-present threat. What are you doing to protect your accounting firm?
How Should You Protect Your Accounting Firm In 2020?
Proper cybersecurity is a matter of proactive efforts and careful prevention of identified issues. Take a comprehensive approach to manage your accounting firm’s cybersecurity by answering the following questions…
Do You Have The Right Cyber Security and Disaster Recovery Solutions In Place?
To start, you need the right solutions protecting your systems and your data:
- Managed antivirus, managed antispam and patch management to make sure you have up-to-date software to protect against malware, hacking and other digital threats
- Active monitoring of your IT endpoints around-the-clock to detect and resolve issues immediately before they result in costly disruption or downtime
- Integrated firewalls, antivirus and antimalware solutions, data loss prevention (DLP), and simplified data encryption, you can rest easier knowing your systems are secured end-to-end.
- Full management of the security of your Wi-Fi to keep your business safe without sacrificing the convenience of wireless Internet
- Data Protection to keep your employees’ and clients’ information safe
- Cloud security to ensure your data is as secure as it is accessible via user-friendly cloud solutions
- Disaster recovery capabilities via an off-site backup solution, hosted in a robust and reliable data center, providing real-time imaging of servers and an array of backup solutions, such as full virtualisation capability through 24/7 offsite backups
Do You Have A 2020 Cyber Security Risk Mitigation Plan?
Effective cybersecurity doesn’t just happen by accident – it requires careful planning, both to protect your firm against know risks, as well as to manage the fallout after an event has occurred.
- Data Integrity You should have a clear, detailed picture of what client data you have, how and where it is stored and accessed, and what you’re doing to protect it. Your plan should consider and standardise the strength of your current passwords, the validity of any firewalls in place, and any implementations of control lists that determine what users have access to sensitive information. By making sure these security standards are properly configured and up-to-date, your system will be that much more difficult to compromise.
- Reliable Failsafes Despite best efforts, even the strongest security measures can be overcome, whether it’s a data breach or an unexpected emergency on your premises. A plan should verify that you have regular backups kept at on- and off-site locations that can be relied upon in the case of any disaster.
- Strategise Cybersecurity It’s essential that you determine exactly what data or security breach regulations could affect you. You need to know how to respond to data loss. All employees should be educated on how to report any loss or theft of data, and who to report to. Data loss can expose you to costly state and federal regulations and litigation. You must be able to launch a rapid and coordinated response to a data breach to protect your reputation. Determine how your data is handled and protected. Also, define who has access to your data and under what circumstances. Create a list of the employees, and third parties who have access to specific data, under what circumstances, and how those access privileges will be managed and tracked. You must know precisely what data you have, where it’s kept, and who has the right to access it.
- Roll Out A Security Policy Every firm should set a security policy, review it regularly for gaps, publish it, and make sure employees follow it. It should include such things as:
- Not opening attachments or clicking on links from an unknown source.
- Not using USB drives on office computers.
- A Password Management Policy (no reusing passwords, no Post-it Notes on screens as password reminders, etc.).
- Required security training for all employees.
- A review of policies on Wi-Fi access. Include contractors and partners as part of this if they need wireless access when onsite.
Are Your Systems Monitored And Maintained Around 24/7?
Ongoing cybersecurity needs to be supported by round-the-clock monitoring and maintenance. An endpoint monitoring service, with adaptive threat protection that identifies active cyberattacks and takes action in real-time to protect your business, will help to protect your systems against external threats.
Comprehensive monitoring should include:
- Termination of communications with blacklisted or untrusted remote sites.
- Continuous monitoring of and protection against new or abnormal user activity on your networks and systems.
- Automatic shutdown of your critical systems to stop active cyberattacks when necessary.
- Real-time notifications of any significant network activity with automatic remedial actions.
Furthermore, maintenance means keeping your systems updated and optimised. Did you know that the most common way cybercriminals get into a network is through loopholes in popular software, applications, and programs? Despite how advanced modern software is, it is still designed by humans, and the fact is that humans make mistakes. Due to this, much of the software you rely on to get work done every day could have flaws — or “exploits” — that leave you vulnerable to security breaches.
Many of the most common malware and viruses used by cybercriminals today are based on exploiting those programming flaws; to address this, developers regularly release software patches and updates to fix those flaws and protect the users. This is why it’s imperative that you keep your applications and systems up to date.
Comprehensive and regular patch management is a crucial part of proper IT security. Some of the worst data breaches are based on “zero-day exploits”, which are based on exploits found by hackers but not by the developers, leading to severe security risks and an immediate need for patching. In order to maintain a secure IT environment, you either have to make sure your staff is staying on top of all incoming updates
Are You Sure You’re Compliant?
Did you know that, in the approximately 2 years since Notifiable Data Breaches scheme and the General Data Protection Regulation (GDPR) went into effect in Australia, 55% of organisations believe they have been fined for being in breach of such legislation?
The fact is that you handle some of your clients’ most sensitive and valuable data and information, and so, there is a duty of care and compliance levels you need to meet. In addition to having all the above cybersecurity measures in place to protect that data you also need a viable Incident Response Plan. Even before the introduction of the new data breach notification laws, the OAIC expected to see a pre-prepared and considered plan being used in the management of a data breach.
Data breach notification laws in Australia require swift action to be taken to determine if an incident is an eligible data breach and, if so, what notification to regulators and other parties is required. Now, with a 30-day timeframe within which to assess whether an incident is an ‘eligible data breach’, the need for an efficient plan is all the more apparent.
An effective plan should form part of an organisation’s broader data management and governance plan and should set out how an organisation will respond to a breach including, at a minimum:
- How incidents are identified – who has oversight over the coalface, and how are incidents reported internally?
- How is the response team determined and called – who plays a part in the response team and do they know their role?
- How are incidents to be assessed as ‘eligible data breaches’ – who takes charge and how do the various internal stakeholders (legal, risk, IT, communications, etc.) work together to assess and consider the risk of harm?
- How will cyber insurance support the organisation’s incident response (including the way notifications are to be made under the policy) and the process for providing breach response services included in the cover?
- How are third party experts engaged – what external experts are required and are they on call?
- How is the investigation documented – who is recording the steps taken and compiling a report, and does it need to be privileged?
- How is the plan tested – who is responsible for ongoing monitoring, testing and auditing of the plan?
Need Expert Assistance?
This may seem like a lot to handle on your own, and you’re right – it is. But you don’t have to take care of it by yourself.
Steadfast Solutions will help you implement robust security measures, deploying security devices like firewalls, patching, antivirus software updates, intrusion and gateway protection, to name a few.
We will help you develop a detailed cybersecurity plan that takes modern threats into account and protects your firm against them. Furthermore, Plenty of Steadfast Solutions Managed Support Programs involve proactive maintenance work and monitoring company security.
We have been working with Australian accounting firms since long before the rollout of the current breach notification laws and GDPR – we have the experience to help you make sure you’re compliant.
With our help, you don’t have to be worried about cybercrime in 2020.
Published on 28th January 2020 by Ian Brady.