By Drew Carmichael, Director, Cyber Security – Iron Spear
CPAs are often entrusted with some of their clients’ or organizations’ most sensitive and valuable assets—their personal and business data. As custodians of this information, you have a responsibility to ensure that it does not fall into the hands of cyber criminals. According to Accounting Today, accounting firms, for example, have seen a 300% increase in cyber attacks since the start of the COVID-19 pandemic and IBM’s Cost of a Data Breach 2023 report found that the average cost to recover from a cyber breach has now reached US $4.45 million.
Given that the recent MOVEit file transfer vulnerability impacted three of the ‘Big 4’ accounting firms and contributed to the leakage of confidential client data, its clear that there is a need for further improvement even in the largest organizations.
As digital technologies evolve, so do the tools and techniques employed by cyber attackers. In today’s online and remote working world, attackers have no shortage of entry points. Since most security breaches are a result of human error, there are many preventative measures that can be put in place to limit the potential for exposure of your clients’ personal information. The following are five threats to the security of confidential data and some of the preventative measures that can help protect that data.
- Ransomware: A ransomware event involves an attacker stealing and encrypting your data and demanding payment to restore access. Accounting firms are especially attractive targets as the threat actors can quickly commoditize this data, either through extortion or other fraudulent means. To limit your exposure, be sure to use a secondary layer of protection such as multi-factor authentication (MFA) for all remote access, and regularly apply security updates on all devices. You can further reduce your risk footprint by removing any outdated or unused programs from your devices. Old or poorly maintained applications represent an opportunity for attackers to gain a foot hold. If you do not use it, remove it.
- Phishing: Phishing attacks are launched by skilled fraudsters who attempt to convince their victim to click on untrusted links, download attachments or share sensitive information by impersonating someone the target knows. Artificial intelligence tools have significantly increased the effectiveness of some phishing attacks by enabling cyber criminals to generate convincing-sounding emails as bait in social engineering campaigns. Be wary of suspicious or unsolicited emails and avoid clicking on embedded links or unknown attachments. Beware of emails marked ‘urgent’ and use anti-virus or anti-malware software. When in doubt, confirm the legitimacy of emails by contacting the sender directly.
- Business email compromise (BEC): This is a growing problem for organizations of all sizes with most attacks focused on financial gain. An attacker typically spoofs an email address, so it appears to originate from a trusted vendor. The attacker then convinces the target to change the banking information of the vendor to an account controlled by the attacker. All subsequent invoices are then paid to the attacker. To avoid falling victim to these types of attacks, review any unsolicited emails closely, especially those that involve financial transactions or changes to banking information. Independently verify any requests before proceeding with the change.
- Lost or stolen devices: Over 60 percent of network breaches can be linked to a lost or stolen device. Losing a personal or business device can place sensitive data in the hands of criminals. Be sure to enable data encryption on all mobile devices and report the loss or theft of a device to your company at once. Ensure that processes are in place to remotely wipe lost or stolen devices to reduce the potential for data exposure.
- Unsecured public wi-fi: While it is tempting to use free public Wi-Fi at a coffee shop or airport to finish some work, your network connection could be intercepted by malicious actors listening in. It is best to avoid unprotected wireless networks. Instead, use your mobile device’s hotspot to work safely on a private connection. Disable your device’s automatic Wi-Fi and Bluetooth networking function when away from home and sign out of all online apps, networks and devices when you are finished using them.
Unlock cyber security insights at our October Peer-to-Peer Forum, brought to you by Iron Spear
Join us at our upcoming peer-to-peer forum on October 6, to learn more from Drew Carmichael, Director of Cybersecurity at Iron Spear, on the protection of data. This session, Defending the Crown Jewels: A Guide for the Protection of Client Data, will equip you with crucial knowledge and essential steps to protect your data, including minimum security controls and everyday practices to safeguard against cyber crime.
Peer-to-Peer Forums offer Alberta CPAs a transformative platform, where practical insights converge, and professional networks flourish. In this dynamic space, you’ll find the ideal complement to formal learning. Engage with your peers, receive real-time feedback, and unlock results that propel your professional journey.
