Author: Stuart Crawford

There was big business security news out of Brunswick, Ohio (a part of the Cleveland metro area) last month, this time involving a church. According to local reporting, the St. Ambrose Catholic Parish recently announced to parishioners that they had been swindled out of a whopping $1.75 million. The attackers’ methods have real implications for churches and businesses alike. We’ll look into their methods, but first a little more detail on this fascinating story.

A Church with Big Plans

St. Ambrose is in the middle of a fundraising and building campaign. As with many older church buildings, repair and restoration are needed. The parish’s Vision 20/20 campaign was supposed to be the answer. This campaign called for raising $4 million needed for repair and restoration, and the fundraising efforts were well underway.

The church only discovered there was a problem when the construction firm they’d hired, Marous Brothers Construction, started inquiring about unpaid bills totaling $1.75 million. The church leadership had been prompt in paying its bills, so they thought, and even had receipts and confirmations for funds transfers. They didn’t understand how the accusation of nonpayment could be true. The funds had left the account, after all.

An Old-School Hack, Well Executed

After involving the Brunswick police and eventually the FBI, an explanation surfaced. The church had indeed been hacked in a business email compromise attack, or BEC. An unknown attacker gained control over two church staff member email accounts. From there it was mostly social engineering.

The bad actors in control of these email accounts managed to convince (via email, of course) the rest of the relevant staff members that the construction company had changed its account information. The “new” account was, of course, controlled by the criminals. The most likely explanation from this point is that an actual, on-site staff member changed over the payment information, having been duped by very real emails that appeared to come from trusted colleagues.

The criminals kept the ruse going very effectively, apparently sending (bogus) confirmation emails so that the church staff thought they were paying the right people. Only when the construction company came calling was the breach finally discovered.

An Isolated Hack with Devastating Results

The church reported to local media that no other components of their IT infrastructure were compromised, including parishioner databases or stored financial information used for the church’s electronic giving service. The hack was isolated. All the hackers got was access to two email accounts. Yet they leveraged this small hack into a $1.75 million payday.

Strategies to Combat BEC Attacks

Stories like these underscore the importance of strong IT security, even in houses of worship. They also underscore the importance of training staff on recognizing the signs of phishing, social engineering, and other bad behavior.

Most BEC attacks don’t start as brute-force attacks. Rather, they start as phishing expeditions. Hackers lure credentialed people to give up their login information by presenting a sometimes extremely realistic fraudulent login page. The first step to preventing such attacks, then, is to educate your staff about how to spot phishing and other similar tactics. Teach staff not to assume that email is from who it appears to be from, especially emails that seem out of context or that ask for unexpected actions. At the enterprise level, implementing a better email authentication protocol like DMARC is an effective way to combat this kind of fraud.

Need Help?

Does your business need help preparing for BEC, phishing, or social engineering hacks? Contact us today for more information.

Today’s businesses are nearly all in a period of transition. If you aren’t old enough to have lived it, all you need to do is stream a few episodes of just about any ’90s sitcom to realize that business has changed at an overwhelming pace since then. This change continues today. Companies are all at varying points on the journey of digital transformation. Some are on the bleeding edge, while most are taking a cautious or catch-up approach. A few remain blissfully unaware, but these aren’t likely to last much longer.

Doing Digital Transformation Right

Digital transformation sounds great, and I’ve already implied that it’s essential. That’s not quite accurate, though. What’s essential is doing it right. A poorly executed digital transformation can be just about as harmful as burying your head in the sand and hoping things will stay just as they are. (They won’t.)

Digital Transformation as a Journey, Not a Destination

One of the first aspects of a good digital transformation plan is to understand its nature. Digital transformation isn’t a one-and-done initiative. How do we know? For starters, we aren’t using Windows XP (or, shudder, the dreaded Windows ME) anymore. Technology will continue to evolve, and your digital transformation will continue as it does.

It’s better to think of digital transformation as a journey. Where are you right now? Where are your competitors? What do you need to do, procure, or implement to catch up with (or better, pass) your competitors? Once you’ve implemented those steps, start to look at what’s next.

Digital Transformation as Mission Critical

Businesses today must understand that digital transformation is mission critical. It’s not something you spend money on when business is booming and squeeze out of the budget when money is tight. As soon as you stop failing to innovate, you give your competitors an open door to squeeze you out of the marketplace. Keep up with your digital transformation journey and stay competitive.

Digital Transformation as a Monitored Initiative

Many companies that do form a digital transformation plan fail to follow through in some way. It’s important to regularly evaluate the progress of your company’s digital transformation plan (be it quarterly or monthly). If digital transformation is a journey rather than a destination, a company working from a 3-year-old digital roadmap is doing it wrong.

Evaluating Your Company’s Digital Transformation Efforts

Evaluating your company’s digital transformation is a complex process. If your company doesn’t have an evaluation plan in place, you might be wondering where to start. Here’s how to get started evaluating your company’s digital transformation.

Ask Questions

It’s easy to assume that a process or plan that’s not making too much noise is working well, but doing this is a mistake. As you should with any process or plan, ask plenty of questions at regular intervals. What is and isn’t working? What new implementations are causing friction among the staff? Is that friction due to lack of training or because the technology solution is failing to deliver? Is the plan sticking to budget? What new technologies or platforms are developing that should be added to the company’s digital transformation journey? What is the right time to add those technologies? Is a particular technology failing to deliver or costing more than you’d budgeted for?

Asking good questions of the right people can greatly improve your digital transformation efforts. Don’t be afraid to include a wide range of departments and seniority levels in your questioning, either.

Review Business Needs

Just as available technology changes over the years, so do your business needs. A piece of software that was mission critical in Accounting 10 years ago may be peripheral or even obsolete today. Similarly, the business needs of your Data and Analytics department today are likely quite different (and far more evolved) than they were 20 years ago. That’s assuming you even had a data and analytics group 20 years ago!

An important part of reviewing your digital transformation efforts, then, is reviewing each department’s business needs and processes. Providing new solutions to long-solved problems isn’t the best bang for your buck. Be sure you understand the problems and processes of each business unit so you can focus your digital transformation efforts in the areas that matter most.

Get the Right People in the Room

A digital transformation plan that no one really knows about isn’t going to accomplish much. A review of that plan that no one knows about won’t, either. Your digital transformation evaluation efforts should include a pretty decent cross-section of organizational leadership. The CFO and CIO (or their delegates) are key stakeholders, as are the leaders of various business units. The CEO must be informed and on board for this to be effective, though of course the size of your organization will likely guide the CEO’s level of real involvement.

Buy-In Is Key

You need the right people in the room, but you also need buy-in from those people. If digital transformation evaluation is a new concept (or a loathed one), you may need to educate first. Get the key stakeholders in a room and use points like these (not this one, of course) to help them understand the mission-critical importance of this process.

Data Is Everything (Else)

You don’t want your review meetings to be based solely on feeling. If your meetings sound a lot like “Well, Jane in Accounting is frustrated using this new software” and “I believe implementing this new platform will really help!”, you need a heaping helping of data. Task your analytics group with researching the effects of a new software suite, for example, so you have real data to go along with feelings.

Conclusion

The digital transformation journey is never-ending, and your efforts to evaluate that journey are as important as they’ve ever been. If you could use a hand, whether with the journey or its evaluation, let’s start a conversation today.

Unlike many other professionals, real estate brokers are constantly moving and constantly juggling multiple deals and contracts at various stages. With whom a broker conducts regular business will vary drastically from day to day. And no single day is ever like another.

As a result, the role of technology for real estate professionals is crucial. For decades, real estate firms have been on the cutting edge of new organizational tech platforms, all of which surely attempt to make the life and business of brokers easier and more effective.

Nevertheless, it’s one tried and true program that’s risen above the rest: Microsoft Office 365.

How Exactly Does Microsoft Office 365 Improve the Work of Real Estate Brokers?

Microsoft Office 365 came on the global scene in 2011. The goal was to provide cloud-based Microsoft Office software via a subscription service, namely to businesses and professionals. Because Office 365 works through a subscription license, all updates are automatic and free.

For real estate agencies and their brokers, Office 365 has been a blessing from the start. Here’s why:

Office 365 juggles multiple databases on one seamless platform.

The nature of a real estate broker’s job necessitates juggling a multitude of deals and interpersonal connections at once. Moreover, each of these transactions is generally at a different stage and features varying degrees of attention and focus.

Microsoft Office 365 was built for situations like this.

Because brokers can access these databases and programs all on the same platform, each of their daily actions becomes faster, easier, and less stressful. Office 365 stores information remotely in the cloud, so even a glitch in an individual device won’t cost the broker a sale or loss of a contact. Prior to this, such a glitch may have lost an agent a full day of troubleshooting or caused a critical error, such as losing a contact’s phone number forever or completely missing an important showing.

The integrated platform of Microsoft Office 365 means brokers can traverse seamlessly from calendar, to contacts, to email, and more. In fact, all three of these features are the cornerstones of why Microsoft Office 365 works for brokers.

Calendaring is one of the platform’s key useful features, allowing easy access to a broker’s own personal calendar as well as access to co-workers’ calendars. Furthermore, a complete catalog of contacts is always at a broker’s fingertips with Office 365, and email integrates seamlessly with all other features.

Access is available and easy to use on all devices.

It’s not uncommon for a real estate broker to be on-the-go virtually all day. Whether they’re in the office, at home, hosting an open house, or showing homes to individual buyers, they need constant access to their email, calendar, and contacts.

With Office 365, all of these features and more are available on desktops, laptops, smart phones, and tablets — yet another reason it works especially well for real estate professionals.

If you own or operate a real estate firm and are interested in acquiring a Microsoft Office 365 subscription, the upgrade can improve your entire business from the start.

Such a massive transition, however, will take time and adaptation on everyone’s part. An IT management professional can help your business make this enormous shift efficiently and effectively. Speak to a managed service provider in your area today to learn more.

The security of user data is of high importance, and that importance only grew with the implementation of the EU’s General Data Protection Regulation (GDPR). These sweeping new regulations went into effect on May 25, 2018. They are European Union regulations, but they have sweeping effects since they apply to any business that stores personal information of any EU citizen.

It’s important to comply with GDPR. The first step, though, is to understand what exactly GDPR requires for your business.

PII Under GDPR

The short answer to the question of what PII is under GDPR is that it’s not a thing. Personally, identifiable information is an American term. The rough European equivalent is personal data. It’s important to note, though, that the two are not identical. The European standards are more restrictive, and the European category (personal data) is, therefore, more inclusive.

Here’s the bottom line: don’t assume that if you’re PII compliant that you’re automatically GDPR compliant. You need to do more for the latter.

Defining Terms

If you’re asking the question “what is PII under GDPR?” there’s a good chance you know some of the lingo already, but it’s worth reviewing.

Personally Identifiable Information (PII)

This term refers to any number of pieces of information that a company might store that can be used to identify individuals. Bad actors who accumulate enough PII on an individual may be able to compromise the individual’s accounts or even steal the individual’s identity. Examples of PII include (but aren’t limited to) driver’s license numbers, social security numbers, full names, physical addresses, and credit card numbers.

Remember, this is an American term, not a global one.

Non-Personally Identifiable Information (non-PII)

Non-PII is what’s left that’s not PII, in the American way of viewing things. This is the kind of information that can be used in aggregate forms. It’s useful data, but it can’t be used to identify individuals on its own. Examples include IP addresses, device IDs, and cookies left behind on devices while browsing the web.

Personal Data

Personal data is the EU equivalent of PII. It’s the information that businesses store on customers that could be used to identify those customers. The important difference here is the breadth of the definition.

GDPR concludes that even non-PII can be personal data. Cookies and IP addresses, for example, can be used in conjunction with PII to help reconstruct a person’s identity. For this reason, even these forms of information are considered personal data and are protected under GDPR.

The ruling that even cookies can be considered personal data is why you’ve started seeing cookie warning messages all over the internet. Those companies are seeking to comply with GDPR by receiving permission from all visitors to use cookies.

Best Practices for Businesses

Given the changing landscape of privacy regulations, businesses must adapt and stay compliant. Here are a few best practices for complying with GDPR.

Survey What Data You Collect

The first step toward compliance is to know what your business is collecting. Conduct a comprehensive survey of the data that you collect and store through your site.

Keep Only What You Need

Second, ask the hard questions about what personal data your business truly needs. If it’s not providing real value, dump it.

Get Permission to Keep It

Whatever you decide is essential, ask permission to keep it. That’s what the cookie notices are doing, and you need to do the same.

Conclusion

Data privacy regulations are complex. You might not want to go it alone. If not, we’re here to help. Contact us today!

The career-centered social media network LinkedIn is the latest victim of phishing efforts on the part of cybercriminals—demonstrating that no organization, no matter how big, is immune to such threats. The phishing attacks are tailored to what LinkedIn users are most likely to be interested in and seek to obtain valuable information from victims. What makes these attacks most concerning from a business perspective is that many LinkedIn users are logging in with their corporate email accounts. When the cybercriminals succeed in getting the information they want, they can gain access to the information of not just the immediate victim, but the organization they work for as well.

Cybercriminals Targeting LinkedIn Users

According to the Security Awareness Training company KnowBe4, a new wave of cybercrime is hitting the LinkedIn community to gain valuable corporate information. Cybercriminals are attempting to get employees to fall for phishing emails—emails that encourage recipients to click a link that leads to a request for confidential information.

The phishing emails are designed to appeal to the personal interests of the recipients, a common tactic with phishing attacks. The goal is to excite the recipient enough that they forget to be cautious. According to KnowBe4, the most popular type of phishing email is one that has LinkedIn in the subject line. Messages from LinkedIn are opened around 50% of the time, so it makes sense for the cybercriminals to use what is most likely to work. They know that around one in two users will open an email that appears to be from LinkedIn, so they tailor their phishing emails accordingly.

Particular Concern for Those with Business Responsibilities

When a phishing attack succeeds against an average person, their personal information and financial information is at risk. But when a phishing attack succeeds against someone who has responsibilities at a business, and therefore security access to protected information of the business, it can lead to damage that harms the business and all of its employees. No one deserves to be the victim of a phishing attack, but there are individuals who, if compromised, can deliver information that will harm more than just one person.

It is predictable that the ones that cybercriminals want most to fall for their LinkedIn phishing attacks are those with higher security clearance in businesses. They know that they could strike a gold mine if they get the right person, with the right information, to fall for one of their phishing emails. That is why they are so devious in the way that they construct their traps. They look closely at the areas of interest of their targets to ensure that they have the highest chance of success.

Areas Where Cybercriminals Focus on LinkedIn

Not just any phishing email will lead to a click from the reader. To get the desired result, cybercriminals must create the kind of emails that recipients are most likely to fall for. KnowBe4 actually conducted tests on LinkedIn to determine which types of emails recipients would click the most often. As mentioned earlier, the most successful phishing emails included LinkedIn in the subject line of the email. According to an article from ChannelFutures, once the recipient looked at the email, they were most likely to click on emails that had the following in the subject line:

• Profile Views
• New InMail Message
• Join my network
• Add me to your network

It makes sense that these subjects would attract the most clicks. They all indicate an interest in the recipient, specifically the kind of interest that could lead to an excellent networking opportunity. A desired employer or contact might have looked at their profile or sent them a message. Even better, they might have requested that the recipient become part of their network, or that the recipient allow them to become part of their network. All four subjects target those who are using LinkedIn to further their careers, which explains why they were so successful.

What Can LinkedIn and Users do to Fight the Problem?

For LinkedIn, the risk of phishing scams and cybercrime is and has always been present. As the company has grown, they have been well aware of the dangers that cybercrime poses to their business and their users. That is why, as with all other major social media platforms, LinkedIn has a dedicated team to identify cybercrime on their platform and to do what they can to fight it. However, there is a limit to what LinkedIn’s dedicated security team can accomplish on their own. Once a platform has millions of users, there will always be criminals who can slip through the cracks. LinkedIn will not be defeated by cybercriminals as a platform. However, the platform’s users do need to be aware of the risks they face.

For businesses, it is best to avoid relying on LinkedIn to keep them and their employees totally secure. Companies have to accept that from time to time, their employees will be targeted by cybercriminals. That is why employee awareness training is so necessary. Businesses must train employees to be aware of the risks of cybercrime, including phishing emails. If you are worried about your employees falling for a phishing scam, consider training them in the red flags of social engineering.

To learn more about cybercrime risks and how to avoid them, please contact our IT services team. We can help you protect your employees and your business.

A major accounting software and cloud services company has been hit by malware, affecting their many clients across the US.

Wolters Kluwer, a major provider of tax accounting software and cloud services, has been hit by malware. The many financial software services they offer to clients across the country have been down since Monday, May 6.

The software provided by Wolters Kluwer is extremely popular in the US accounting industry. Users include every one of the top 100 American accounting firms, as well as 90% of the top banks worldwide, and 90% of Fortune 500 companies.

This malware attack comes at an especially vulnerable time when many accounting firms (and their clients) are intending to file their taxes. With their primary accounting systems offline, they won’t be able to do so, or at least not with Wolters Kluwer software.

However, it’s not as simple as just using different accounting software. Wolters Kluwer also provides cloud services to their clients, which means that necessary client financial data is stored in their servers, and inaccessible by the accounting firms during this outage.

Since the attack began Monday morning, Wolters Kluwer took many of its systems offline to slow the spread of the malware. According to representatives, they have since been working non-stop to try to eliminate the malware and bring their systems back online. They have contacted authorities and third-party forensic teams to investigate the attack.

“We’re working around the clock to restore service, and we want to provide [clients] the assurance that we can restore service safely,” said Elizabeth Queen, vice president of risk management for Wolters Kluwer, to CNBC. “We’ve made very good progress so far.”

However, end-users have still not been able to access their tax documents that are stored in Wolters Kluwers cloud servers. The many systems that Wolters Kluwer took offline on Monday include the customer services lines that end users have relied on to get info from the software provider.

When a backup customer service number was finally provided, users were told that there is no estimated window in which the services will be fully restored. For the time being, thousands of accountants at numerous firms across the US are being expected to wait and see.

For CEOs, digital transformation has changed the game. CEOs today need new approaches to leadership, planning and vision. Otherwise, they risk leaving themselves and their companies falling behind in the wake of rapidly changing technologies.

The last decade has seen a remarkable rise in digitally disruptive technologies that have forever changed business models, business processes and the nature of work.

Consider the impact the Internet of Things, Big Data, analytics, automation, artificial intelligence and cloud computing have had on the way businesses operate. One only needs to look at what impact companies like Airbnb and Uber have had on the lodging and transportation verticals to realize that a new leadership approach is an absolute mandate for CEOs today.

How Is the Modern CEO Role Changing?

“Technology isn’t changing only corporations—it’s also changing the job of the CEO, bringing with it the challenge of keeping up with technological development,” notes a recent McKinsey & Co. article.

There are plenty of resources out there to help CEOs stay in touch with and understand emerging technologies, according to one anonymous business leader in the McKinsey piece. “What’s much harder for a leader is deciding what’s relevant and what’s not,” he said.

That means today’s CEOs need to be clear about priorities and be able to make fast decisions about to pursue.

What Leadership Structure Does a Tech-Savvy CEO Need?

The c-suite looks very different today than it did a decade ago. New titles reflect the importance of technologies in the modern enterprise: Chief automation officer, chief data officer, chief digital officer and chief information security officer are just a few of the roles that companies realize are critical for success.

Board members and senior executives alike need to be adept at and capable of adapting to the technical revolution, providing leadership and guidance to the CEO. These leaders may have experience and demonstrated success, but today they need to be agile. And the CEO needs to be aware of what they need and make changes accordingly.

How Can CEOs Plan for Digital Transformation?

“I very rarely get pulled into the today,” Amazon founder Jeff Bezos told Forbes in a 2018 interview. “I get to work two or three years into the future, and most of my leadership team has the same setup.”

That’s the right approach for CEOs wanting to lead digital transformation.

With so much disruption, Greg Crandall of Query Consulting Group suggests CEOs need planning processes that focus on customers and employees first. Customer expectations are evolving; they expect easy access to brands and that those brands know who they are, how they have interacted and can deliver immediate answers.

“Today’s organizations must compete within themselves to meet the needs of current and targeted customers. … This means internal teams, departments and other groups must compete … and cooperate with each other to transform the customers’ experiences by empowering employees to think and act in ways that, ultimately, transform the organization itself,” Crandall writes. “And to do this, those teams need leadership from the top that promotes thinking critically, communicating transparently, and acting with agility.”

The focus on the customer is paramount to Tim Cook, Apple’s CEO. In a January 2019 interview, he said, “What I focus on is the customer. The customers speak every quarter. They speak every year. They speak every day. And the most important thing for us is that they’re satisfied.”

The cycles are changing too. Gone are the days when 3- to 5-year planning cycles suffice. Today’s CEO needs to lead a process of continuous planning and assessment.

How Do Today’s CEOs Have To Communicate?

Transparency and humility are the order of the day for the modern CEO. Customers, partners, employees and stakeholders expect open and clear messaging. They cannot think of digital strategy as somehow separate from other strategic planning.

Instead, CEOs need a holistic approach that embraces and incorporates technology, listens carefully to customers, and applies that learning and perspective into changes to business models, business processes, markets, structure and culture. The CEO needs to project that the organization is one that is adaptive, learning and nimble.

How Big a Role Should the CEO Play in Digital Transformation?

Traditionally, Research and Development and IT divisions have been responsible for product development and innovation. That’s changing, notes Thomas Siebel, chairman and CEO of C3 IoT.

“With the 21st-century digital transformation, the adoption cycle has inverted. What I’m seeing now is that, almost invariably, global corporate transformations are initiated and propelled by the CEO,” Siebel writes. “Visionary CEOs, individually, are the engines of massive change that is unprecedented in the history of information technology—possibly unprecedented in the history of commerce.”

As technology transforms companies, industries and how we live, work and play, it’s only natural that the CEO’s role also needs to change. CEOs who recognize and embrace the digital revolution are most likely to see their organizations thrive and grow.

Personal email accounts for business purposes

It can be tempting to use your familiar, personal email account to send and receive emails for your professional life – but you shouldn’t take the risk.

Is it safe to use your personal email for business?

Using your personal email to communicate for business purposes isn’t a good idea. It can expose you to a number of legal and other liabilities. And, to be honest, it doesn’t look very professional, does it? Read on to learn more about the legal and security implications of conducting business on your personal email account.

Every so often, a client of ours will check with us about using their personal email to do business.

While there is a range of implications that come with doing so (legal, reputational, etc.), usually the question is asked to double check about how it could affect their cybersecurity.

Regardless of why a user may be asking the question, the answer is that it is never advisable to use a personal email account for business purposes. Period.

But if you’d like more detail as to why and, specifically, if you’d like to understand what risks you may be taking right now if you’re already using a personal email account at work, then keep reading.

4 reasons why you should never use personal email for business.

Legal implications and data integrity

The first risk, and likely one of the most severe, is that when you use your personal email account for work (or, allow your employees to do so), then you’re adding a number of uncontrollable variables into how your business data is accessed and where it is stored.

In an ideal situation, in which everyone at your business is using approved, professional business email accounts on a verified client, then you (or, more likely, your IT department or outsourced Leesburg, FL IT services company) know where your data is.

Especially in the age of cloud computing, when all data is stored “offsite” and accessed remotely in one way or another, you may assume that your data’s “location” isn’t very important – can’t you just access it the same way no matter where it is?

It’s not that simple.

When working with a professional cloud-based IT environment, your IT people should know where your data is stored, and that it’s being stored properly in secure and backed up data centers. Even though your data isn’t hosted onsite (or not entirely onsite, depending on the size of your business) it is still accounted for.

When you factor in personal email, all those assurances go out the window. Your IT team won’t be able to confidently track where your data is being kept, and how well it is being maintained. Depending on the personal email accounts your staff members use, this data may not be backed up.

Furthermore, in the event of legal proceedings, personal emails are often not discoverable, meaning that it wouldn’t be possible to externally scan users emails (e.g. Google specifically prohibits this for Gmail accounts).

And lastly, don’t forget about compliance. Depending on the business sector in which you operate (finance, healthcare, government contracting) you may be subject to compliance regulations that strictly state how data is stored and accessed. Personal email accounts are woefully ill-suited to meet compliance standards.

Security implications and data protection
This one should be obvious – personal email does not have the same cybersecurity measures as their professional counterparts.

In order to properly secure a business’ email accounts, a number of protections must be put in place:

• Sophisticated spam filters to keep time-wasting or even dangerous spam emails out of your employee’s inboxes.
• Top-quality inbound virus blocking capabilities, further protecting you and your employees from incoming threats.
• Automatic quarantine procedures for malicious links and attachments before they arrive. These focus on email-based exploits such as phishing and spyware, to remove the possibility that someone in your organization may open a link without considering the dangerous ramifications.
• Secure email archiving capability so that you have an impeccable record of each and every email in your business.
• Email encryption measures to ensure that your communication is secured against unwelcome readers while in transit.

Can you guarantee that your employees’ email accounts have all the same protections in place?

If one of your staff members is targeted by a cybercriminal or has their personal email address added to a mass phishing campaign, they are much less prepared to defend against it than a robust, professional email client would be.

It’s then only a matter of the personal email account being compromised for a cybercriminal to access any and all private business information that has been sent and received on that account. Given that it’s a personal email and not one managed by an IT department, it’s much less likely that you would be able to wipe its contents, or remotely log it out and reset the login info.

Staff changes and data continuity

Here’s a scenario to consider: what happens when you have to terminate an employee, but they had been using their personal email to conduct business on your behalf?

You can’t remove their access to their own email, and so, when they leave your business, (perhaps not on the best terms), and will continue to have copies of what is potentially private and valuable business information.

They continue to have contact info for your current employees, clients, and other business contacts – and may even be contacted by your clients that may not have been aware of their termination (let’s be honest – you don’t always want to spread the word that you had to fire someone).

By allowing your employees to use their personal email now, you surrender control of a great deal of business data in the future. While it would be nice to assume that your current staff members will always be with you, and if they do leave, that it will be on good terms – but it’s not likely. And you shouldn’t risk your data and your business betting on it.

Professional and reputational implications

While it may not involve legal, compliance, or security implications, this risk could very well affect your bottom line.

Let’s call a spade a spade – using a personal email for work doesn’t look very good, does it?

It’s the same line of thinking that suggests that using a .org domain for your business isn’t a good idea either.

It just makes you look cheap – like you wouldn’t spring for a specific domain that matches the name of your business.

If a potential client gets in touch with you over the phone or in person, and then later follows up on email and gets a reply from something like john.smith.mybusiness@gmail.com, they probably won’t think very highly of your business, will they?

That’s four solid reasons why you shouldn’t be using your personal email at work, but there’s actually one more – it’s completely unnecessary.

Getting a business email account has never been easier. Virtually any service provider will be able to offer secondary accounts that can be personalized with a business-specific domain. Furthermore, any IT services company worth their salt can set it up for you.

Don’t cut corners and try to save a buck when it comes to your business’ email. Beyond the many serious risks to which it can expose you, it also just makes you look bad.