Removing the Targets from the Backs of Small to Medium Size Accounting Firms

BY PAUL MURPHY, CYBERSECURITY SPECIALIST AT BLACK TALON SECURITY LLC

Accounting firms of every size are lucrative targets for hackers. Criminal hackers are after the financial and personal data stored by every accounting firm. Too many financial professionals make the mistake of assuming that “The Bigger the Firm, The Bigger the Risk,” but the reality is that small- to medium-sized accounting firms are even more attractive targets for criminal hackers. Most, if not all, large firms employ dedicated teams of cybersecurity experts who are 100% focused on attack prevention. These teams of experts are typically credentialed, well-trained security professionals who build highly effective security infrastructures designed to find and remediate the areas where those firms are most vulnerable. This strong, but expensive, strategy is also one that most small- to medium-sized firms cannot afford. Cyber criminals are well aware of this and they typically take the path of least resistance when targeting organizations.

What does this mean for the small- to medium-sized firms? What if on a Monday morning you arrive at your office and find 100% of all your computers encrypted with ransomware? Your IT vendor comes onsite and says, “We have a major problem”. Not only is your data encrypted, but the hackers left a note indicating they also STOLE all your data.” Then you find out that all your backups, including your Cloud backup, are gone. Through an investigation, it is determined that hackers installed screen-sharing software 4 weeks prior to the ransomware attack and have been watching everything you do on your computer—including accessing your Cloud software. What will you do?

This is a very common problem that we see in the financial services space. Some common themes that we have seen in all these attacks against accounting firms are:

1. Each firm thought they were protected by their IT company

2. All firms had a firewall and anti-virus software

3. The recovery costs and business interruption resulted in firms spending in excess of $100,000

4. All local backups were encrypted with ransomware, and many of the Cloud backups were destroyed by the hackers

5. Most systems had been compromised for days or even weeks prior to the IT company or firm knowing that they had been breached

If you store the same type of data as the large organizations, yet cannot afford a full-time staff of dedicated cybersecurity professionals, what can you do to protect your clients and your business? Do you cross your fingers and hope for the best? Do you rely on tools like anti-virus software and firewalls to protect you the same way that you did in 2010? Neither of these options is taking a proactive approach to cybersecurity. There are steps that you can take today that are effective and affordable for any size firm. The first, and possibly most significant, step is understanding that your IT provider is not a cybersecurity expert. A typical IT company’s area of responsibility is the installation and maintenance of a network. Most IT companies do not have the tools, training, certifications or real-world experience to offer an effective security solution. I strongly recommend that you have this conversation with your IT provider. If they encourage you to engage with a dedicated cybersecurity company, then at least you know that you’re working with a technology partner who has your best interest at heart.

Taking the next step and engaging with a dedicated cybersecurity company is easier and less expensive than you think. There are companies who offer affordable, effective security solutions that add the necessary layer of protection that accounting firms should have in place to protect themselves and their clients. At a minimum, any company who you would consider working with should offer the following 4 pillars of an effective security solution:

1. Cybersecurity Audit - A complete audit of your operations, technology, policies and procedures. Once the audit has been completed, a gap analysis should be provided which details the areas of risk in your firm.

2. Vulnerability Management - This will help to manage vulnerabilities that exist on your network. These vulnerabilities are present on everyone’s network and are what hackers use to gain access to your data. They exist on your computers, firewall, printers, and any “smart” devices that you may have in your firm. The discovery and remediation of these vulnerabilities are critical parts of creating a more secure environment.

3. Cybersecurity Awareness Training - This helps further educate you and your employees to better understand the risks that exist to your firm. It empowers them with the knowledge to help them minimize these risks. Building a “Human Firewall” is necessary in today’s business environment.

4. Penetration Testing - Penetration tests should be performed against your network on (at least) an annual basis. Most cybersecurity companies employ ethical hackers. These individuals have the same talents and capabilities as the “bad guys”, but their role is to test the security that you have put in place. If an ethical hacker has a difficult time gaining access to your data, then it’s likely that a criminal will have the same difficulty and move along to an easier target.

As we begin 2021, we want you to feel empowered and take the steps necessary to protect your business. Take some of the power away from the ruthless cybercriminals who have wreaked havoc against the financial, medical, and legal industries in 2020.

You are not powerless. You can avoid becoming a victim and remove that target from your back and encourage your clients to do the same!

Paul has over 20 years of experience in the technology field. He regularly leads training and educational workshops on the latest trends in data security. Learn more about your organization’s potential vulnerabilities at www.blacktalonsecurity.com.