Remember, it is not if you will be attacked, but when.
The weakest link in most cybersecurity attacks today continues to be the human element, so it is important to remember that your firm employees are a vital line of defense. Take action now to arm your employees with education, awareness, and reminders, so that they can make informed decisions about what they click.
In this respect, cybersecurity awareness training is a basic best practice measure that is extremely important when addressing the human element of data security. As employees are the most common entry point for phishing attacks, a firm's best protection against social engineering is to make continuous efforts to raise awareness of the importance of ongoing vigilance and enhanced skepticism of each email and online interaction. Education can come in various forms, both formal and informal. Consider sharing with your team "real-life" examples of the potential scam emails received by members of your firm. Learning of the attempted attacks on their colleagues heightens awareness of the nature and types of scams that pose potential threats.
As part of the firm-wide cybersecurity awareness training, you should also consider reviewing the firm's existing protocols and infrastructure (refer to the firm's written security plan in place) that supports the firm's commitment to taking appropriate cybersecurity precautions so that all employees are aware and updated when changes are made. If your firm does not yet have a written security plan in place or you are in the process of updating your document, refer to CAMICO's Written Information Security Plan ("WISP" or "ISP") template. The template can be found on the Cyber/Data Security Resource Center on the CAMICO
Raising the cybersecurity IQ of all employees will help tremendously in guarding against a breach and will minimize your firm's potential exposure as employees will be better able to recognize social engineering attempts and understand the importance of guarding their login/authentication credentials both in the office and at home. To be of ultimate value, it is important for firms to commit to embracing a motto of continuous education because the threat landscape doesn't stop evolving when your employees' cybersecurity training is done.
Other steps a firm can take include:
- Use multi-factor authentication. This can add an extra level of security to prevent an account hack, especially when employees work remotely.
- Change and strengthen passwords frequently. Systems are only as secure as the passwords used to access them.
- Ensure all software has the latest security options/patches. This will help protect against malware, viruses, and hacker attacks.
- Require regular data backups. By encouraging employees to regularly back up their data you are preventing data loss when disaster strikes. While this may be a hard policy to enforce for employees working remotely, it remains the best practice. In many instances, devices can be set to back up to the cloud automatically. When relying on cloud storage remember that ransomware can also compromise cloud services. Any data stored in the cloud should also be periodically backed up to an external hard drive. Data backups ensure that a business can continue to operate, even if resources are taken offline by a ransomware attack.
- Maintain strong cyber hygiene. Reinforce with employees the cyber protocols to be followed when working both in the office as well as remotely (e.g., machine use restrictions, Wi-Fi passwords, VPN, firewalls, etc.).
- Remind all employees of the importance of powering down computers when not in use. Computers are not accessible to attacks or intrusions when powered off.
If you doubt the importance of these kinds of steps, consider this case study of a firm where someone did not exercise proper cybersecurity awareness:
An employee of a CPA firm opened an unsolicited email attachment from "IRS e-Services" that immediately downloaded ransomware onto the firm's computer system. The employee noticed that the file names were rapidly being changed to "Needs Decrypting." The employee turned off and rebooted the computer, but the virus had already spread to all the firm's servers, and all the files became encrypted. The employee reported the incident to the firm's managing partner and the firm promptly took actions in accordance with their Incident Response Plan. Once it was determined that a breach had occurred, the firm complied with applicable state and federal laws, and the breach was reported to law enforcement.
Ransomware is one of the most malicious hacker attack vectors and firms of all sizes have become victims. It sneaks into computer systems, encrypts files, and demands a ransom before agreeing to decrypt the files. A major problem is that hackers do not always decrypt files even after the ransom is paid.
Ransom demands have certainly increased in recent years and it is not unusual to see them range from several thousand dollars to several hundred thousand dollars. Some ransomware attacks rely on software that now has known fixes, so a solution might be found online. Other ransom attacks are more advanced and have no known fixes, other than the victim retrieving and relying on the latest backup files. Therefore, being prepared and taking precautions against cyber risk exposures is essential.
To gain a greater perspective on how CPA firms are impacted by cyber exposures, refer to the IMPACT 126 Claims Chronicles for two additional cyber-related claims.
