Three cybercrime trends to prepare for in 2021

Cyber breaches have become more common threats for businesses. The COVID-19 pandemic accelerated the digitalization of many companies and a shift to remote working. That increased first-quarter cybercrime 273%  in 2020 compared to 2019. The new and innovative ways hackers found to steal company data cost U.S. businesses an average of $8.64 million per breach. Even more startling: small businesses were victims of nearly a third of all cyberattacks.

What new trends, patterns and hacks can we expect this year? How can CPA firms protect their practice and their clients from cyberattacks?

5 tips to protect yourself while holiday shopping online

This holiday season, researchers expect consumer spending to mirror prior seasons but with a huge swing to online shopping. While you’re buying for your loved ones and feeling warm and fuzzy, cybercriminals are feeling the same about the uptick in online shopping because it presents more opportunities to steal data.

With cybercrime expected to reach $6 trillion in 2021, being aware and maintaining safe cyber practices will benefit you significantly. Here are five things you can do to protect yourself during the holiday season:

Free cybersecurity resources to get you up to speed

Ready to learn about cybersecurity to help your clients or business? The pandemic, and corresponding increase of eCommerce and internet use, have created many opportunities for cyber thieves — data breaches increased 273% in the first quarter of 2020.

But opportunities are also being created for you. It’s anticipated that the cybersecurity market will be worth $248 billion by 2023, providing a unique opening for CPAs.

CPAs are trusted advisers. Your qualifications as a CPA, along with a shortage of cybersecurity experts, put you in a prime position to lead businesses in their cybersecurity efforts.

Cybersecurity best practices for the c-suite

Turn on the news and you’ll see that no organization is too big or too small to be the victim of a cyberattack. It’s vitally important for an organization’s leaders to understand and manage cybersecurity efforts because you can never be totally safe from the risks.

Here are four cybersecurity best practices every organization should follow:

1. Keep your system up to date.

Four crucial tips to protect your organization’s data

The cost of cybercrime is increasing at an alarming rate. By 2021, the estimated damages from cybercrimes will be around $6 trillion, according to Cybersecurity Ventures. What can your firm or organization do to ward off evil cyberthieves? Joel White, CPA, CGMA, and Senior Director of Internal Audit, Risk & Compliance at the Association, offers four simple tips to help your firm or organization beef up its cybersecurity defenses. Here’s a quick recap.

ICYMI: Five things you need to know about cybersecurity

It's startling that a cyberattack happens every 39 seconds (source: University of Maryland) and one out of every three businesses will experience a cybersecurity breach within the next two years. The average cost of that breach in the U.S.? $8.19M! As protectors of valuable financial and personal data, CPA firms are prime targets for cyberattacks. Considering the major financial risk that organizations face by failing to set up sound cybersecurity measures, we chatted with two of the Association’s experts on the topic. Joel White, CPA, CGMA, Director of Internal Audit, Risk & Compliance and Jay Overcash, Director of IT Security Strategy, answered your top cybersecurity questions.

Here’s what we learned:

8 cybersecurity resources you literally need right now

Suffice to say, it’s not been a good week for the 5^th largest U.S. credit card issuer. This week, Capital One was hacked in what’s being called one of the largest data breaches in history. A lone hacker gained access to more than 100 million American and Canadian customer accounts and credit card applications. The data theft exposed 140,000 social security numbers, 1 million Canadian Social Insurance numbers and 80,000 bank account numbers, among customers’ other personal data. Capital One estimates the breach will cost them between $100M and $150M in 2019 on customer notifications, credit monitoring, technology costs and legal support.  And this does not include potential reputational damage or political and regulatory actions, including possible penalties. Capital One’s stock also plummeted 6% overnight.

A solid password today keeps the hackers away

With identify theft becoming one of the world’s fastest growing crimes, days like World Password Day are crucial to raising awareness of online threats. I sat down with Jay Overcash, Director of IT Security Strategy, to talk about how people can protect themselves from hackers.

Why is a day like World Password Day so important?

As more and more of our lives move into the digital realm, we rely on authentication to protect our valuable online data and assets.  Usernames and passwords remain the predominant method for securing online data.  World Password Day is important as it draws attention to the need to adequately protect online data with a strong password.

Data breaches are here to stay

Data breaches are constantly in the news. Last year, Marriott, Quora and Dunkin Donuts all made headlines for privacy breaches – and that’s just to name a few. With breaches happening all the time, it’s easy to feel overwhelmed. But it’s more important than ever to focus on data protection. In honor of Data Privacy Day, here are three ways to protect your clients’ data during tax season and all year long.

Develop an incident response plan

Is your firm ready for a cyberattack? In today’s world, it’s not about if you will experience an attack, but when. Having a prepared incident response plan means you and your staff know what to do as soon as you realize an attack happened. You’ll be able to respond faster and more efficiently. Your response plan will delegate responsibilities, detail how you will notify your clients and help mitigate any reputation damage to your firm.

5 tips to help small business clients prevent cyberfraud

Imagine you’re at work on a typical Monday morning. Suddenly, an email from the CEO hits your inbox. It’s marked ‘urgent,’ so you open it right away. She needs you to wire $15,000 to one of your regular vendors ASAP. You make the wire transfer, and head to the break room to refill your coffee. There’s just one problem – that email wasn’t really from your CEO. And that bank account where you sent the funds? That’s not your vendor’s account. You just sent thousands of dollars to a cyber criminal. Uh oh.

It’s a scheme called executive impersonation, a type of business email compromise (BEC) scheme mentioned in an SEC alert issued last month. Unlike a typical scam email, which may have poor grammar or overly suspicious requests, BEC scams are convincing because the criminals spend time figuring out the corporate culture and common phrases and terms used by employees. CPAs should take note, because scammers could try to perpetrate a similar fraud against their small business clients.

Tax identity theft: A horror story

Halloween used to scare me. I was sure that monsters — specifically zombies — were out to get me. But I’m not afraid anymore because I faced down a nameless ghoul who did more actual harm to me than any imaginary monster could ever do.

It all started one fateful day when an identity thief used my name, Social Security number and birth date to file a fraudulent tax return, netting the fraudster a $4,000 refund. While it was an excellent payday for the thief, it was the start of some major headaches for me.

By the time I found out what happened, I was on the hook for more than $14,900 (including supposed unpaid taxes, penalties and interest). Fresh out of grad school with high student loan debt, rent and health insurance payments, I was completely unprepared to weather this storm.

5 cybersecurity frameworks accountants should know about

You’ve seen all the news stories: Cyberattacks are happening almost daily, and they can have devastating consequences. You know you need to protect your organization’s data. But where do you even start?

A cybersecurity framework can guide you in the right direction. These frameworks help you design a cybersecurity risk and controls process that is right for your organization. Whether you’re interested in helping set up your own organization’s cyber program, or you’re interested in providing assurance on other organizations’ cybersecurity systems, you should be familiar with different cybersecurity frameworks and what types of companies they’re best for. I’ve listed a few common ones you should know about below.

Smishing – what you need to know

This blog was updated as of 10/16/2019.

When I first saw the word smishing, I assumed it was some new lingo the kids came up with to further stump us adults. But then again, this is coming from someone who didn’t know what ‘on fleek’ was until it was no longer cool to use. (It’s okay if you still don’t know what that means.) 

Jokes aside, smishing is a very serious matter – and since October is Cybersecurity Awareness Month, now is the perfect time to discuss it. 

What is smishing? 

According to Experian, a credit reporting bureau in the U.S., smishing is yet another tool used by cybercriminals to obtain personal information and steal identities. You’ve probably heard of ‘phishing,’ which is an attempt to get people to provide sensitive information via email, like credit card numbers or passwords. Smishing is a mash-up of SMS (short message service) and phishing. 

Basically, it’s phishing via text. The fraudsters use malware to send an SMS, and once someone downloads the link, the malware is activated, tricking people into sharing sensitive information. 

What are some examples of popular smishing scams? 

We’ve all encountered phishing scams like “I’m a prince and I want to wire $10 million to you, all I need is your bank account information,” or “If you click this link you will get rich quick!” But these SMS scam messages can be more difficult to spot. Here’s one example from Experian: 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Another example might be a text saying that if you fail to click on the link and provide personal information, whatever company they’re pretending to be will start charging daily for the service. Delete these immediately. 

How can you disrupt fraudsters trying to smish you? 

I spoke to Rod Griffin, director of public education at Experian, and he suggests treating your phone like a PC. On a PC, you have antivirus software to prevent fraudsters gaining access to your computer. Since your phone does pretty much everything your PC does, if not more, why not purchase antivirus software for that as well? Don’t let the fraudsters out-tech you. And, of course, never click on suspicious links that come in via text. 

To make sure you haven’t been recently smished, check your credit report regularly to see if any suspect accounts have been opened in your name. 

While fraudsters are always coming up with new scams, there are plenty of steps you can take to keep yourself, your organization and your clients safe. Knowledge is power, so your first move should be to take our quiz on the fundamentals of cybersecurity. You can also register for our Cybersecurity in 2020 webcast on October 30 at 12pm ET, which offers a wealth of information and the opportunity to earn 1 free CPE credit.  

We’ll be providing helpful updates throughout Cybersecurity Awareness Month, so keep checking back atthe AICPA’s Cybersecurity Resource Center to ward off smishers and keep your digital defenses on fleek. 

Samantha Delgado, Communications, PR & Corporate Responsibility, Association of International Certified Professional Accountants

Cybersecurity facts tax practitioners need to get right

This blog was updated as of October 29, 2019 

How many emails does your firm receive in one day? 

Whatever the number, there’s a good chance a chunk of it is malware. According to a 2019 report compiled by Symantec Corporation, one in 412 emails contained malware in 2018. For businesses with less than 250 employees, this rate jumped to one in 323 emails. When you consider just how many emails the average office worker receives in a week, things start to look a little scary.

Three things your firm needs to get started with SOC services

In an era of near-daily cyberattacks, organizations increasingly need to show they are protecting sensitive data—and they are turning to CPAs to help them do so.

SOC reporting isn’t something auditors should learn on the job or figure out as they go, though. If you’ve been thinking about expanding your firm’s offerings to include Service and Organization Control (SOC) engagements, there are a few things you need first.

1. You need to be knowledgeable in the service area

Specialized knowledge of an industry or organization is vital for understanding where risks are, assessing those risks and adjusting procedures to the appropriate risk level. As such, focus your SOC practice on areas with which you are already familiar.

AICPA cybersecurity framework highlighted in Congressional testimony

Earlier today, Bob Sydow, EY Americas Advisory Cybersecurity Leader, testified in front of the US Senate Committee on Banking, Housing and Urban Affairs on cybersecurity risks to financial services.

Sydow outlined three main challenges EY’s clients face regarding cybersecurity:

1. Emerging interconnected technologies that drive fundamental transformations and create complex third-party ecosystems
2. The volume, velocity and precision of attacks
3. A shortage of cybersecurity resources and skilled professionals

Tax pros: How are you protecting your clients’ data?

“I don’t need to worry about identity theft because no one wants to be me.”

-Jay London

American comedian Jay London is funny, but identity theft isn’t. Unfortunately, cybercriminals know that targeting tax professionals is more effective than going after individual taxpayers; after all, tax professionals keep records on hundreds, if not thousands of individuals. This means any firm could be a target this tax season.

The IRS receives three to five data theft reports a week from tax practitioners. And, as IRS Commissioner John Koskinen said last year, “These (cybercriminals) are well-funded, knowledgeable and creative. It’s going to take all of us working together to combat these identity thieves. But doing nothing or making a minimal effort is no longer an option. Anyone who handles taxpayer information has a legal responsibility to protect it.”

While this may not be the time of year to do a full assessment of data security and technology integrity, there are steps CPA firms should take now to keep their clients’ data safe:

Finance pros, meet your new accountability: Cybersecurity

If you’re a finance professional or run a business, you may have a new responsibility these days: cybersecurity oversight. The Association of International Certified Professional Accountants (the Association) recently conducted a survey of financial executives. Seventy-three percent of respondents said their teams are taking on more responsibility for mitigating cybersecurity risks. An additional 15% said they have become the person primarily responsible for cybersecurity.

If you’re hacked, what’s your cybersecurity liability?

Cybersecurity attacks are inevitable. That’s the unfortunate reality. In fact, in a special report, Cybersecurity Ventures projects cybercrime’s global cost will reach $6 trillion by 2021. Now more than ever, organizations and accounting firms of all sizes need to be vigilant about protecting data and responding to threats.

What’s your liability?

That’s a big question we hear from firms regardless of whether or not they’ve been attacked. There are actually no uniform federal laws on business cybersecurity. But there is a patchwork of state rules. Under certain state laws, CPAs can face liability for cybersecurity breaches that expose personal information. Most states have rules for handling breach notifications and for what remediation measures need to be taken. Breach requirements depend on where the client resides – not where your firm is located. We encourage you to learn the dynamic requirements of states that apply to you.

Meanwhile, federal circuit courts are split as to what constitutes sufficient standing to sue in cyber breach cases. Some courts hold that companies may be liable for damages if client or employee data is stolen, even if the theft causes no harm; instead, it’s sufficient to merely allege that the information was compromised. This broad interpretation will only further increase the risk of cyber liability claims.

Five movies that (kind of) predicted cybercrimes

Equifax. The Securities and Exchange Commission. Whole Foods. These are just a few of the hacking incidents that have made the news in recent weeks. Although organizations are becoming increasingly concerned about their cybersecurity in the wake of current reports, Hollywood has been warning us for years about the importance of keeping our data safe. The following five movies are not only entertaining, they also acted as a crystal ball of sorts by giving us a glimpse into the possibility of today’s cyber events.

Movie: “The Net” (1995)

Lesson: Your personal data is your most important possession.

“The Net” warns of what can happen when your data falls into the wrong hands. When systems analyst Angela Bennett receives a disk from a colleague, she inadvertently sets off a chain of events that leads to her social security number being reassigned to another name, her home being sold out from under her and an arrest for a litany of crimes she didn’t commit—not to mention the mysterious deaths of people around her who know about the disk.

CPA life hacks to keep from getting hacked

I love that my bank, credit cards and insurance companies all have intuitive websites and mobile apps where I can easily pay bills and check my balances. But between Whole Foods, Equifax and Yahoo, I – like many other consumers – am becoming increasingly concerned with what organizations are doing to protect sensitive information.

Even as we become more dependent on IT systems for everything from ordering our groceries to tracking our fitness, cyberattacks are becoming more organized, profitable and persistent. For CPAs, this means growing concerns about both protecting client data and helping clients protect sensitive information.

In honor of Cybersecurity Awareness Month, here are three ways CPAs can remain proactive when it comes to cybersecurity.

Surviving the Equifax Data Breach

Odds are, you or someone you know were impacted by the Equifax data breach. The breach, which is estimated to have impacted 143 million Americans – nearly half the US population – is considered one of largest data breaches in history. Adding insult to financial injury, Equifax has put the onus on consumers to do their own research about whether or not they need to worry.

But don’t panic just yet—we’ve got steps you can take to help protect yourself. Let’s start with the basics:

What is Equifax? And why do they have my information?

Equifax is one of three major U.S. consumer credit agencies, and if you have ever purchased anything of note, like a car or a house, or rented an apartment, or have had any reason to request a credit report, these agencies have your information.

Getting Ready for Assurance Has Its Benefits

 

In recent months, sweeping global cyberattacks have taken thousands of businesses offline, compromising valuable data and blocking access to critical services and information assets. If it wasn’t clear before, it is now: cybersecurity is a business imperative with direct implications for overall company value. Prior to this spring, and without a common language or benchmark for cybersecurity, how do you quantify and communicate your cybersecurity risk in a meaningful way?

Enter the AICPA’s cybersecurity risk management reporting framework. Unveiled in April, the framework is intended to standardize the way organizations define their cybersecurity objectives and report against those standards in a format that works for all stakeholders.

Most Passwords Are Easy to Guess. Do This Instead.

You’re doing your passwords all wrong.

So says the developer of the guidelines most internet users have been following for 15 years, anyway. Passwords that L00K l!ke tHi$ are actually much more susceptible to hacking than most people realize, says Bill Burr, former manager of the National Institute of Standards and Technology (NIST) and author of the NIST’s 2003 recommendations for password management.

In an interview with The Wall Street Journal, Burr said that his previous advice to use numbers, symbols and randomized capitalization resulted in people creating passwords that are easy for computers to predict.

A more secure option is to use four random words, such as “that purple monkey dishwasher.” Such a phrase is actually much more complicated for computers to guess, The Wall Street Journal reports. (Cartoonist Randall Munroe explained the math in a comic six years ago.)

Some password advice remains relevant, however: avoid using birthdays or anniversaries, your kids’ names or your address, as all of this information is easy for hackers to locate. Additionally, use different passwords for each of your accounts and avoid storing them where they can be easily seen or stolen.

ICYMI: Protect Clients from Petya Cyberattack

Just as people are starting to recover from last month’s devastating WannaCry ransomware attack, Petya, another malware worm, is shutting down networks across the globe. No one is immune, international businesses and governments alike have been hit by this new attack. Unlike WannaCry, which spread via the internet, Petya spreads through computer networks and shuts down entire hard drives.

It is imperative that you not only take proper precautions yourself, but also help your clients fortify their defenses against cyberattacks. You can learn more about how to do so with these recent AICPA resources:

4 Steps to Fortifying Your Cybersecurity

Small businesses are “unprepared or poorly prepared for a cyberattack” according to 75% of the 307 insurance and risk management advisors surveyed through the Advisen and Experian 2017 Cyber Risk Preparedness and Response Survey. Unfortunately, no organization is immune to cyberthreats. These days, most companies should have some basic form of cybersecurity program in place. If yours doesn’t, or if you need a refresher, here are four steps you can take to establish a stronger foundation.

Step 1: Create a Comprehensive Set of Cybersecurity Policies

What resources does your organization have that are at risk? Think beyond the obvious. On-site computer systems, laptops, tablets and mobile phones are immediate suspects, but bring your own devices (BYOD) and wearable technology such as smartwatches can also be compromised. Determine what controls you need in place to ensure information is kept secure. Set your rules for communicating, working with, copying and distributing sensitive data; and document those rules and make sure everyone in the organization receives a copy. Necessary policies typically include an IT policy, information security program (including a risk assessment), employee acceptable usage policy, business continuity and disaster recovery plan, and an incident response plan. 

The One Vulnerability Cyber Thieves Are Desperate to Exploit

Cybersecurity attacks are becoming more pervasive and seemingly effortless to pull off.  Cybercriminals who can execute a successful attack are seizing credit card numbers, bank account information and even Social Security numbers. A 2016 study conducted by the Ponemon Institute found that the average cost of a data breach is $4 million. You can strengthen your organization’s cybersecurity risk management plan by addressing this one vulnerability: weak passwords.

The capture or reuse of passwords, or “static credentials” as they are often referred to in the IT industry, is standard practice for organized crime groups and state-affiliated attackers alike, according to the Verizon 2016 Data Breach Investigations Report, whose list of contributors represents a “who’s who” of cybersecurity expertise worldwide, from both the private and public sectors. Likewise, passwords are used against all kinds of targets, from the largest organizations to individuals.

A common misperception is that cyber attackers have become so sophisticated that something as simple as a password is no longer effective. The tendency is to think that if federal agencies and multi-national corporations can be breached, there’s nothing individuals can do to protect themselves. This could not be further from the truth. Individuals have the most power in preventing attacks that exploit passwords, which is why a policy on passwords should be a key component of your firm or organization’s cybersecurity risk management program.

It’s Time to Speak the Same Language on Cybersecurity

Recent massive ransomware attacks on organizations around the world demonstrate how disruptive—and in some cases destructive—cyberattacks can be. The “WannaCry” malware incident is just the latest alarm on the ever-urgent call for companies to immediately address and manage their cybersecurity risks. Every organization is susceptible to cyber assaults, making a clearly defined, flexible and robust risk management program essential to a business’s ongoing success.

Addressing an Increasing Market Need

With cyberattacks on the rise, organizations are not only reinforcing their ability to prevent attacks, but also taking steps to demonstrate that they are doing all they can to detect, respond to, mitigate and recover from attacks on a timely basis. Customers, investors, boards of directors and even government officials want to know more about what companies are doing to address cybersecurity.

5 Emerging Services Set to Transform the Accounting Profession

What’s on the horizon? How are changes in the business marketplace creating new opportunities for the accounting profession? What are the implications of up-and-coming technologies like blockchain?  These, among a host of other emerging trends were discussed recently at the AICPA’s Assurance Services Executive Committee (ASEC) meeting. The committee, composed of the profession’s leaders in assurance and advisory services, engaged in an insightful discussion about issues that are gaining traction internationally and in the United States.

In addition to discussing ideas for potential future projects, the committee also spoke about the projects they have currently underway that facilitate new opportunities for practitioners to provide value-added services to clients. These include five emerging service opportunities:

5 Data Backup Gaps and How to Fix Them

March 31 is World Backup Day. Why March 31? Because you don’t want to be an April fool according to World Backup Day’s organizers.

Human error, equipment failure and theft are just a few ways your organization could be at risk of data loss. Today, no firm or company can afford to be without a cybersecurity risk management program. If you’re like most CPAs, this is not news to you. In fact, if you’re somewhat of a data backup fanatic, you might already be paying for secure offsite storage of paper files as well as digital backups. Still, experts say even the most diligent often have gaps in their backup practices. Let’s look at some of the most common considerations and how to address them.

1. Do you know exactly how to retrieve your backups? For starters, knowing the person in your office who you think knows how to retrieve your backups doesn’t count. Knowing the name of one of your cloud backup vendors is not enough. Retrieval is an often underdeveloped but equally important aspect of backup planning (see #5 below). Unfortunately, there’s no single, all-encompassing solution for backing up your systems. Even in a small firm, you’ll likely need three or four different backup systems. Tax preparation, bookkeeping and auditing software packages often have integrated, cloud-based backup options. There’s the information on your office network and server(s)—here you can choose a cloud-based solution or an onsite backup system that updates each night. Then you have your desktop and laptop PCs. And, finally, you have smart phones, tablets, watches, etc. Organize your retrieval information for ALL systems and test it—like a fire drill. If your test goes off without a hitch, you can skip the rest of this post.

7 Benefits of Cybersecurity Penetration Testing

Security breaches are prevalent in today’s business environment and reports indicate that these threats are not going away any time soon. As a result, organizations need to take steps to safeguard their confidential data and other sensitive information. Smaller-sized organizations like small businesses and not-for-profit entities are increasingly vulnerable. A recent study by Symantec found that email malware affected small businesses and large enterprises in equal proportions during 2017.

Even organizations with limited resources have affordable and effective options for protecting valuable data. I recommend penetration testing, a type of cybersecurity vulnerability assessment, to my clients working in the not-for-profit sector. Many of my not-for-profit clients feel compelled to conduct cybersecurity penetration testing when they consider how accepting online donations may create vulnerabilities for not only for themselves but also for their donors. Potential donors may feel more comfortable donating online once they hear that the organization has safeguards in place to protect their information. Penetration testing is performed by an outside, third party and can be tailored to the needs, or concerns of the organizations.

3 Steps to Mitigate and Respond to a Security Breach in the Cloud

The AICPA is participating in National Cybersecurity Awareness Month with a series of blog posts to help CPAs understand the role they can play in addressing cybersecurity issues. This is our second post in this series. Our first post discussed low- and no-cost ways to protect data.

Much like their counterparts who run growing companies in virtually every industry, many accounting firm executives have their heads in the cloud. They have implemented, or are considering, cloud computing options for everything from data storage and networking to task automation and product delivery. Some firm executives see an additional opportunity: offering consulting services to help clients understand and use the cloud.

It’s clear that cloud computing provides proven advantages over on-premises options, such as savings, convenience and flexibility. However, the cloud also presents some unique challenges, including often complex deployment options, operational issues and substantial security concerns. Below you’ll find three steps to take to address cloud computing security.

Step One: Know the Risks

The first way to mitigate a security breach is to understand and prioritize the risks related to using cloud services. For accounting firms and their clients that use a cloud service provider (CSP), cloud-based solutions present the same risks as traditional information security, plus the risks associated with managing and governing a third-party service provider.

5 Low- or No-Cost Ways for CPAs to Help Slam the Door on Cybercriminals

The AICPA is participating in National Cybersecurity Awareness Month with a series of blog posts to help CPAs understand the role they can play in addressing cybersecurity issues. This is our first post in this series.

October is National Cybersecurity Awareness Month, but fighting cybercrime is a year-round battle. As experienced keepers of confidential information, CPAs are uniquely positioned to support cybersecurity initiatives for their firms, clients, or employers. But cybersecurity is costly, and budgets are always limited, especially in the public and not-for-profit sectors. Consider these five simple steps CPAs can take to help protect data without breaking the bank.

1. Know email scams and warn others. People are increasingly the weak link in organizations’ cyber armor. You know not to give your checking account info to an unknown foreign government dignitary. But what if you get an email from your CEO instructing you to wire funds for a deal that you know is about to close? This scenario was all too real last year for a finance employee who was tricked into wiring $730,000 to a bank in China, according to an FBI report. Since the FBI started tracking business e-mail scams in late 2013, it has compiled statistics on more than 7,000 U.S. companies that were targeted. Total losses exceeded $740 million.

Introducing a New Framework for Reporting on Cybersecurity Risk Management

The list of companies is growing. Businesses, organizations and governmental entities have suffered damaging publicity—and faced lawsuits—due to data breaches, forcing them to make cybersecurity a priority. It’s not surprising to hear, then, that 95% of CGMA designation holders said their companies were concerned about cyberattacks, according to an AICPA survey. Organizations and their stakeholders are not only seeking ways to address current and potential threats but also to gain assurance and communicate about the efficacy of their own efforts to identify and manage the potential effects of cybersecurity risks.

Stepping up to help our fellow CPAs meet businesses’ and clients’ needs, the AICPA is proposing a way for businesses to demonstrate due care and build stakeholder confidence in their cybersecurity risk management efforts. The Cybersecurity Working Group of the AICPA’s Assurance Services Executive Committee (ASEC), in collaboration with the AICPA’s Auditing Standards Board, is developing criteria and guidance that companies can use to communicate, and we can use to report on entity cybersecurity risk management efforts.

Seizing Opportunity Like a Rapping Founding Father

When hip hop music first became popular, very few people would have thought that the music could be a great way to tell the story of America’s Founding Fathers. Yet, the wildly popular Broadway musical “Hamilton,” which won 11 Tony Awards, merges the historical narrative of the nation's first Secretary of the Treasury with hip hop music and lyrics, and proves that it’s possible to successfully create something fresh by offering a new take on a familiar subject.

Alexander Hamilton, the man whose life inspired the musical, started his career as an accounting clerk in the West Indies, then went to colonial America, where he would eventually lay the groundwork for the United States financial system. The musical came to life because Lin-Manuel Miranda, its creator and the man who originated the role of Hamilton, saw an opportunity and seized it by utilizing his musical talents to tell a 240-year-old story and delight unsuspecting audiences.

What does that have to do with CPAs? A lot, actually. Every day, CPAs use their knowledge and talents to meet a wide spectrum of client needs, often in ways that weren’t initially envisioned 50 or 20 or even five years ago. If you’d like to set the stage for new options in your career or practice, here are several opportunities that mesh well with CPAs’ core competencies and experience.   

Are You Cybersecurity Ready?

 

The interconnected digital world has been referred to as the wild, wild West. Hackers are eagerly looking to exploit the weakest line of code in mobile devices, applications and operating systems. And those are just a few of the types of technology at risk in today’s environment.

You’ve probably heard the old adage, “you don’t bring a knife to a gun fight.” Cybersecurity is no exception. In a cyber “gunfight,” only the most prepared organizations can survive a security breach. To assist organizations in preparing for cyber incidents, the Department of Justice’s (DOJ) Cybersecurity Unit released Best Practices for Victim Response and Reporting of Cyber Incidents, out lining steps to take before, during and after a cyber attack or network breach. 

The DOJ document provides best practices and indicates that organizations connected to the Web should evaluate cybersecurity readiness by preparing prior to, in response to and for recovery from an intrusion.  

4 Cybersecurity Pitfalls to Avoid

This blog was updated as of 10/16/2019.

You might break out in a cold sweat at just the thought of criminals on the other side of the world stealing your clients’ or customers’ account information. After all, if some of the largest corporations and agencies of the federal government can’t prevent their systems from being breached, what can a Main Street CPA firm or medium-sized business possibly do against such a threat? 

The reality is that as a CPA you can do more than you might think. At a minimum, as a trusted business adviser, you should help your clients or employer avoid these common pitfalls:

Answers to 5 Common Cloud Questions for Not-for-Profits

With cybersecurity in recent news headlines, more clients are coming to us for advice on accounting software solutions. Cloud systems, especially, have increased in popularity among businesses in the private sector and not-for-profits alike. Organizations with decentralized operations, or with many remote workers that need access to information, can benefit the most from using a cloud system.

Here are the most common questions we encounter in our practices.

Q: What (and where) is the cloud?

A: When we talk about the cloud, it just refers to a system or application that is hosted somewhere outside of your office—usually accessed over the Internet. The term “cloud” comes from the shape used to represent the Internet on network diagrams. 

Some people may also be familiar with the term Software as a Service (SaaS).  The “as a Service” (aaS) suffix also refers to the cloud. There are several flavors of this: Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and more keep coming up as additional services are delivered via the cloud.

Another term also often associated with the cloud is “hosted solutions.” This can be software, servers, or even desktop services. Unlike the “as a Service” model, which would be considered “pure” cloud and accessible directly from the Internet in a web browser, hosted solutions usually require a VPN network connection or specially configured client software to access.  However, for most intents and purposes, we can consider hosted solutions as part of the “cloud.”

Update on Taxes and Terrorism: Why Clients’ Data Could Become Vulnerable

Since this article was initially published in December 2015, the FBI has attempted to compel Apple, Inc. to defeat its own encryption for the purposes of accessing the information on the iPhone of Syed Rizwan Farook, perpetrator of the mass shootings in San Bernardino in December of last year. Apple has thus far refused to obey a federal court order to provide access to the phone, based in part on a first-amendment argument that code-writing constitutes free speech. A federal court in California will hear arguments on March 22, but promises from both the Justice Department and Apple, Inc. to appeal any decision against their respective cases mean the dispute is unlikely to conclude at that time. The case is certain to have far-reaching implications for the nature of digital security both here in the United States and abroad.

5 Cybersecurity Precautions for Small CPA Firms

With busy season off to another running start, it’s important to remember that cyber attackers are busy too. With readily monetizable information on hand that can be sold easily on the black market, your practice is an especially attractive target for attackers.

Frequent news reports of breaches at large organizations and government entities might lead you to believe you don’t stand a chance if targeted. Fortunately, this is not the case. The following basic precautions can significantly reduce your risk and mitigate damage if you experience a cybersecurity incident.

1. Locate, classify and separate information by risk level. The highest risk information for most firms is going to be financial account information such as bank routing and account numbers, credit and debit card numbers, and usernames and passwords for online account access. This information should be protected with a high level of security and stored separately from other client records. Because industry safeguards typically require names of authorized users, billing addresses, employer identification numbers and Social Security numbers to gain access to accounts, a system that stores information used to authenticate account numbers separately from the numbers themselves can mitigate losses should a security breach occur.

CPAs Well-Positioned to Help Manage Cybersecurity Risk

Cybersecurity is becoming a critical issue as consumers increasingly entrust their most confidential information – including Social Security numbers, tax identification numbers and financial information – to companies that store this data electronically. As companies look for third-party assessment and verification of their cybersecurity risk management program, CPAs are well-positioned to provide these services – and the more comprehensive definition of attest that many states have adopted ensures that only CPAs can provide cybersecurity attest services in accordance with the AICPA’s high standards.

Attest services are those services that are limited to licensed CPAs and can only be performed by licensees through CPA firms. They include audits, reviews of financial statements and examinations of prospective financial information.

Are You Prepared for a Cybersecurity Attack?

Is your firm or organization prepared to respond to a cybersecurity attack? What about your clients? A cybersecurity breach could occur at any time. No organization is too small to come under attack, so it is best to be prepared. When a breach occurs, companies without a plan may waste valuable time trying to organize a core team and put a strategy in place. Below are steps that you should consider as you develop a cybersecurity response plan.