How To Protect Your Firm From The Current Cyber Threat
We’re receiving a lot of queries about the heightened ‘state actor’ threat in the current news. Here’s a short 3-minute article that will give you the scoop on how the majority of breaches happen to SME Accounting firms and what you can to do protect your firm from them.
Understanding How it Happens
When people think Cyber Security they tend to think “Data Security” with the conversation going to storage locations and encryption technologies that servers and web based apps use to protect data.
However, most threats that target accounting firms, are centred around “access security” and “device security” which exploit weaknesses and target unprepared end-users.
For example, the most common way a businesses’ systems are compromised is through “phishing”. Hackers trick users to click and download a file or enter login details onto a scam site. After this ransomware can be deployed and information stolen, but it all starts with a click.
Knowing what to do to protect your business
In simple terms the three key areas for you to address in your business are:
- User Education
- Access Security
- Device Security
User Education
Most hacks start with a click. If the team member doesn’t open the phishing email and click the link to run the ransomware, then there is no breach.
If you train your team to spot scams and stop them at source, you’ve greatly reduced your Cyber Security risk (and the good thing is you can do this without spending a cent!)
As a minimum we recommend the following:
- Know what scams are out there – Check out Scamwatch to see what the current cybercrime scams are.
- Use online cyber security training resources – There are heaps of resources firms can find online to train their team (we have free CPD qualifying online training here).
- Share examples of hacks – Whenever you see a scam, take a screenshot of it and share it with your team. Let them know how you knew it was a scam. Doing this daily will keep cybersecurity front of mind.
Access Security
The easiest way for hackers to access data is to steal passwords and then walk through the front door.
Hackers don’t hack, they log in.
Therefore putting the correct security around the passwords which are the keys to your data is imperative for having a robust cyber security policy.
As a minimum we recommend the following:
- Set Strong Passwords – all team members need to have strong unique passwords and MFA activated for all their logins and applications (A secure identity provider like Practice Protect can streamline this process)
- Lockdown Email Access – Office 365 is the most breached application. There are specific security settings which firms can setup to greatly reduce the exposure of this application. We have a support article on this here
- Disable Legacy Email Protocols – Hackers exploit legacy login protocols to get into businesses Office 365 accounts, however these login protocols don’t get switched off by Microsoft by default. You can follow our support article here to switch these off in 5 minutes
Device Security
If team members are logging and accessing data from compromised devices, then all of the data and apps that they interact with have the potential to be compromised as well. Securing a device does not need to be difficult, the most important point to consider is that all devices that interact with company data have been reviewed, especially team members personal devices!
As a minimum we recommend the following:
- Antivirus with intrusion detection “IDS” – We use Vipre Business internally for this. Regular antivirus monitors computers and references a database of known threats. It doesn’t protect computers from what the user does and what activity is happening on a network.
- Install/run the latest versions of Software – Malware exploits and hacks systems by breaking through vulnerabilities in different versions of Windows and other Operating systems. If you’re running the latest version of Windows with up to date antivirus, you’ll be protected against the majority of known malwares
The above list is not an exhaustive list of cyber security areas firms need to address, but instead is a practical list of the most common ways we’re seeing breaches occur with simple actionable steps that every accounting firm can follow.
If firms want to learn more about Practice Protect and how we help over 855+ firms to secure their sensitive data, you can book a call with one of our Cyber Security Consultants here.
