The CPA and Responsible Cyber Security: 5 Actions Your Firm Must Take

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://www.cpapracticeadvisor.com/news/12087207/the-cpa-and-responsible-cyber-security-5-actions-your-firm-must-take

Less than half-way through 2015, business and government entities in the
U.S. have been hit with 15 major cyber attacks.

A hacker group identifying themselves as HL4T ushered in the New Year by
publishing Microsoft’s software development kit, known internally as Xbox
One SDK. This proprietary information allows anyone with sufficient
expertise to create games for the Xbox console.

Later that same month, in a more serious breach, officials of the U.S.
military command overseeing Middle East operations were hacked. Several
maps and diagrams were subsequently leaked and posted on the Internet.

In early February, Anthem, Inc. suffered a data breach that compromised the
health records of 37.5 million customers of various corporate subsidiaries.
This leaked information included not only confidential medical records but
also names, birthdays, medical IDs, social security numbers, street
addresses, e-mail addresses and employment information, which included
income information.

All pale in comparison to the most recent breach occurring in the Office of
Personnel Management (OPM). Beyond routine personnel files, which contain
the most private of detailed information, including social security
numbers, salary information and address information, hackers were able to
retrieve information regarding individuals processed for security
clearances. Latest government disclosures suggest more than 18 million
individuals may ultimately be victims of this cyber attack.

Plainly, when a tech giant the likes of Microsoft, the U. S. Military and
agencies of the Federal Government can be hacked, seemingly at will, what
can CPAs and their firms do to mitigate this very real risk?

Top 5 Risks You Can Tackle

Complacency

Yours is a small firm, hardly worthy of the effort it would entail to hack
into the system, right? You could not be more wrong! A hacker uses IP
addresses and they all look pretty much alike. Hackers get no more
information about a computer from an IP address than you would get from
reading a social security number. Hackers look for weaknesses and your
organization, whether large or small, may be a target solely because of
that weakness. Don’t place your data at risk by making the assumption that
you are too small to be targeted.

Weak or Shared Passwords

This is no revelation but that makes it no less a fact. Simple passwords,
sharing passwords with coworkers and failing to change passwords frequently
is a risk that you can easily correct. Additionally, IT security experts
report frequent instances of passwords being written down and left in plain
sight. There were even reports of folders titled “password” being found on
the system. Always remember that passwords are intended to be secret!

Phishing and Spear Phishing

Although we are probably familiar with the terms, time and again, data has
been compromised when an unwary target opens an email and clicks on a link
or attachment opening the door for a hacker to infiltrate the system or
infect it with malware. Spear phishing, which targets a person in an
organization using information relevant to that individual, is often
successful against even the most cautious of recipients. This hazard should
be discussed frequently in meetings to ensure it is kept top-of-mind by the
entire staff. You cannot rely on email filters to eliminate this risk.

Malware

Backoff, Dyreza, BlackEnergy and Crowti are the names of just a few of the
numberless malware programs waiting to infect your computers and systems.
This malware can be introduced via phishing or an innocent visit to a
website. Many of these malware programs can be purchased by anyone with the
money and intent to inflict harm. Vigilance and policies that prohibit
non-business use of the Internet can aid in reducing the risks malware
represents.

Vulnerabilities

These are flaws or weaknesses in system and software architectures that
hackers can exploit. The proliferation of software and the haste with which
it is sometimes brought to market has only served to increase the number of
security holes that can be exploited. Periodic updates in operating systems
are commonplace and have reduced the incidence of security holes, but
software applications are often overlooked except by hackers. It is crucial
to update software application regularly and reboot systems to ensure that
updates take effect. This includes workstations, servers, laptops and
routers. In short, all the hardware and software that is used in your day
to day operations.

A Word on the “Cloud”

Software as a service (Saas), cloud storage and similar innovations have
also heightened the opportunities for hackers to breach your data. Make
certain your providers are thoroughly vetted with respect to security.

Concluding Thoughts

While the explosion of software solutions and cloud services has enhanced
productivity and profitability, it has also created opportunities for those
with malicious and criminal intent. Our profession has a fiduciary
responsible that necessarily encompasses the safety and security of client
information in our control. An attentive approach to security must be an
elemental part of our client relationships.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
YourCISO is an affordable SaaS solution that provides a comprehensive information security program that ensures focus 
on the right security.  If you need security help or want to provide real risk reduction for your clients contact us!