Controlling Your Data: Use These Controls to Secure Your Firm's Critical Information
Target. Home Depot. Anthem. The IRS. The U.S. government. Numerous hospitals and universities. The commonality? All have been the victims of headline-splashing cyberattacks that led to the breach of confidential data. With so many cyberattacks in the news, many CPA firms may wonder, "Are we next?" CPA firms can be a treasure-trove of information for cybercriminals. Firms routinely collect sensitive information from both clients and employees, including Social Security numbers, bank account information, earnings and business information, and, if the firm accepts credit cards as payment, credit card numbers. All of this information requires protection under professional standards and various state and federal laws and regulations. Most firms have acknowledged that data security represents a critical risk requiring careful management. However, implementing controls over data security can be unfamiliar territory with a daunting vernacular. This can be especially challenging for sole practitioners or firms without dedicated IT resources. To help get started, consider implementing these baseline security measures. RIGHT ACCESS FOR THE RIGHT PEOPLE Implement access controls to help ensure only authorized individuals are permitted to access sensitive or critical areas of information. Physical access controls CPA firms likely restrict access to their premises already, but access to the area in which the firm's server is kept should also be restricted with a lock or access code. If mass storage devices (flash drives, external hard drives, etc.) are used, purchase the encrypted versions. While the cost may exceed that of unencrypted devices, the protection they provide justifies the additional expense. Another option is to use software to encrypt unencrypted flash drives. Encryption of all laptop and desktop computers and mobile devices is one of the most beneficial controls CPA firms employ. A lost or stolen computer or device can result in a devastating and expensive data security breach if it is not encrypted. Full-disk encryption may help to mitigate damages if a breach occurs. Various state breach notification statutes create a safe harbor that waives notification requirements if encrypted data are breached. Refer to applicable state breach notification laws for information on whether a safe-harbor provision applies. Full-disk encryption is built into all major operating systems including Windows and Mac OS X. Instructions on how to "turn on" encryption are available online from Microsoft or Apple. BlackBerry devices are encrypted by default as are iPhones and iPads running iOS 8 or newer. The Android operating system supports encryption, but it must be enabled. Logical access controls Logical access controls are tools and protocols used for identification, authentication, and authorization of computer information system users, including software programs. Assign access privileges to software or network folders where sensitive information is stored based upon the principle of "least privilege," meaning a user should only have the minimum access required to perform his or her job responsibilities. Conduct routine reviews of access and modify access authority when an employee leaves the firm, changes roles, or is perceived to be at risk of becoming disgruntled. Many data security breaches are from the inside and perpetrated by a dissatisfied employee or former employee who has knowledge of the firm's systems and their vulnerabilities. Prepackaged software often comes with default settings. Update the default settings and tailor access rights to your firm. In addition, be sure to implement software updates or patches when they are provided by the vendor. These updates may help troubleshoot and fix a security vulnerability identified and addressed by the vendor. To help further control access, use passwords. …