Stuart Crawford – Page 88 – Ulistic Projects Blog

October 26, 2018

REMOTE DESKTOP ACCESS: YOU MAY HAVE JUST OPENED YOUR NETWORK TO HACKERS

What’s The Remote Access Protocol And Why Should I Worry About It?

The Remote Desktop Protocol (RDP) is a means that Microsoft provides for Windows (and Mac) users to access another computer remotely. Remote computer access is often used by IT people to diagnose and repair a problem with a computer. If you’ve ever worked with a company’s Help Desk, then the technician may have asked for remote access to check out your computer. The help desk tech has all the powers and abilities that the user has.

If that user is an administrator (if only one user is authorized on the computer, that user is set up as an administrator by default), they have total control over the remote computer. They may well have total control over the network as well, depending on how the network administrator’s permissions are set up.

So How Does RDP Work?

RDP works by connecting the computer remotely, then controlling it over a local network or the internet. The internet port used for this is 3389. If that port is open in the remote computer’s settings, anyone can potentially connect to it and control it.

The FBI recently warned that hackers are constantly scanning the internet for open RDP ports and selling the access information that they find on the Dark Web. Several types of ransomware and other exploit tools rely on finding open 3389 ports. One security company, Rapid7, found 11 million open 3389 ports on the internet in 2017. There are over 1,000 attempts to find open RDP ports per day.

Obviously, if you don’t know your ports are open, you are not going to be able to protect them. The first step is to make sure that only machines that need remote access are set up for it. Your system administrators can use several methods to make sure that only computers that need remote access have it.

But We’re Covered…Or Are We?

Ah, you say, but we are protected against this kind of attack because we have all our RDP-enabled computers protected by a password. Guess again. If you look, you may well find RDP servers (and servers in general) that are not password protected. Sloppy system administrators (sysadmins) all too often leave the machines they manage unprotected, so they don’t have to remember the passwords to them.

Even if both the servers and the remote machines are protected by usernames with strong passwords, there are two ways that hackers can still access them. One, called a brute-force attack, keeps trying usernames and passwords until it scores a hit. This is known as a dictionary attack.

The other way is to use lists of username/password combinations that are automatically created, bought on the Dark Web, stolen, or some combination of this. The only defenses against this are two-factor authentication or the use of security keys (dongles).

In two-factor authentication, users have to enter a second password, sent by SMS to a smartphone or by email, to log on. When dongles are used, a physical device, such as Google’s Titan security key is used.

Use of biometric identifiers (fingerprints, face scans, retinal scans) is another way of either single-or two-factor authentication (i.e., the user is required to use a password and scan a fingerprint.)

How Bad Is This Problem Really?

Remember, once a hacker gets into your system via RDP, you are probably vulnerable if you do not have two-factor authentication and/or biometric identifiers enabled on all your machines, both Mac and Windows. In any other condition, you are vulnerable. The lists of RDP endpoints being sold on the Dark Web include those stolen from airports, hospitals, nursing homes, and government agencies.

How Bad Could This Get?

So far, the use of RDP as a means of network penetration has been limited to attempts to install ransomware or steal banking, credit card information, and online shopping information.

There is little evidence (remember, we don’t find it unless we look for it or the hackers make a mistake) of any state actors or terrorists using it. But RDP access is really low-hanging fruit for them.

Practically everything runs on computers today, and the vast majority of them communicate over the internet with unencrypted data. Imagine terrorist hackers shutting down first-responder communications systems. They also have the potential to shut down hospital EHR systems or disrupt air traffic control at the airport.

Once we begin to think of the vulnerabilities in our systems, this problem of open RDP ports gets worrisome very quickly. Small wonder that the FBI is warning everyone about it.

In 2017, just one Dark Web site had 85,000 RDP endpoints for sale. It has dozens or hundreds of imitators. We just do not know until the FBI or some other agency finds the Dark Web site and tries to take it down. If you work with a managed IT services company, then it can be worth your while to ask them to check your computers and networks to see whether you have RDP ports open and susceptible.

October 25, 2018October 24, 2018

How To Protect Your Child From Identity Theft

Depending on the age(s) of your child (ren), your response to this topic may be, “She’s too young – she doesn’t even have an identity yet.”

Alas, not so. In our electronic society, kids exist in databases even before they’re born. And they are an attractive target for several kinds of bad actors on the dark web – those who want to exploit their names and other data for identity theft, such as opening credit card accounts, child pornographers looking for images that can be photoshopped, school bullies, and so on. Although this post focuses on identity theft, taking the steps described herein will also protect your children from other bad actors.

Children Identity Theft

What’s So Bad About Social Security Numbers?

As they were originally intended, nothing. The original intent was to use them to associate a specific individual with a specific record of earnings. But over the years, they morphed into the closest thing we have to a national identifier. Many organizations ask for it as a kind of reflex, with no intention of either using it or controlling its use. They have the notion that having an SSN makes your child a “real boy” (as opposed to a wooden one like Pinocchio?).

This leads to the first set of steps.

Get your child a Social Security Number. You will need it for some legitimate things about your child’s identity, including passports. (Try taking the child abroad without one.)

Once you have it, put it in a safe place, like a bank safety deposit box. The same goes for birth certificates and other papers that identify your child. And of course, their passports

Never give anyone an SSN, or a copy of identifying documents, without knowing why they want it, and what the intended use is. If it is just a bureaucratic reflex, ask what you can do instead of handing it over.

Make sure the organization has a policy of destroying documents that are no longer needed. (This will guarantee a lot of comical blank stares.) The only acceptable responses are “we return them” or “we destroy them with a cross-cut shredder.”

Monitoring Your Child’s Financial Existence On The Web

Your child, from the moment of birth, is a thing that businesses highly value – a customer, even if it’s you-by-proxy until your kid starts watching TV or using a computer or tablet. This means that your child will have an online existence from the moment of birth, and perhaps before. Those who exist can be exploited. So, you need to monitor your child’s financial identity. This means:

Check your child’s Social Security Earnings Record every year. You can get this by calling 800-772-1213 or submitting SSA-7050 Form. If you know the child has never worked and you see any earnings, that is a sign of possible identity theft. Contact Social Security immediately. A list of Social Security local offices can be found here.

The same goes for earnings in excess of what you know a child who is working earned. A non-certified copy of the earnings record is free; a certified report is $34.00. There is no reason to get a certified copy just to monitor your child.

Check all three of your child’s credit reports every year. Reports are free once per year. The three large credit bureaus that control most of the records are Equifax, Experian, and Transunion. Their online sites are Equifax, Experian, and Transunion.

Check any packages sent to your child. If you permit them to place orders online, make sure that what they got is what you or they ordered.

All these steps are relatively easy. The hardest part is teaching your child to be cautious (and safe) online. Social media are havens for identity thieves, and worse, predators. Teach your child to reveal private information only to trusted parties you have indicated that you approve of. For anything else, teach the child to respond with something like, “My parents don’t want me telling that.”

And, of course, it is obvious that you should keep your operating system, anti-virus, and anti-malware software updated. If you check every day, you will find that there is almost always an operating system patch, virus and malware definitions updates, or driver updates waiting to be installed.

Check to see if you can configure your OS and virus/malware software to update automatically. This exposes you to potential bugs, of course, but it will give you some peace of mind in the long run. Unless you are a true geek, consider it.

There are lots of other ways to keep your children safe online and this is an important topic you should discuss with them at the earliest time. You just can’t wait until your kids are teenagers anymore to talk about cybersecurity and online predators.

October 25, 2018October 24, 2018

Canada Now Has It’s Own Version Of Required Breach Disclosure

As data breaches echo around the world, Canada now has its own law, paralleling Europe’s General Data Protection Regulation (GDPR) and the USA’s Health Insurance Privacy and Portability Act (HIPAA). These regulations govern disclosure of data breaches to people whose data has been lost, stolen or somehow leaked to the public.

Canada Data Breach Law

Responsible leaders in U.S. companies should note that there is no exemption here for foreign-owned or operated companies. If your data breach involved Canadians, even those residing outside Canada, you have to comply.

Types of Organizations Included

Note that the law applies to organizations, which of course includes businesses. But the range of the law covers other entities as well. If you can be considered an organization of any kind, you may need to comply with these regulations.

What happens if the breach occurs in Canada, but for some strange reason, no residents of Canada were involved? You’re still required to comply with the law. (As always, legal questions are best answered by lawyers.)

The law was passed in 2015 and becomes effective November 1, 2018. Penalties for any violation can be up to $100,000. (This is a pittance when compared to penalties under the GDPR and HIPAA.)

What Do I Have To Do If There’s A Breach?

You must disclose it to affected Canadians, including the following information:

The data and nature of the breach and what specific data are at risk
What your organization has done to reduce risk and harm
How the affected Canadians can reduce their risk after the breach
Information about the organization’s contact information
The procedure for filing complaints

Is There More To This Than Meets The Eye?

Yes. It’s important to be aware that the law governing data breaches is not a stand-alone act. It is an amendment to PIPEDA, the Canadian Personal Information and Electronic Documents Act. A summary of Canada’s privacy laws, and links to more specifics can be found here. A discussion of the specific laws related to digital information is here. You need to understand and comply with both.

The wording in PIPEDA leaves room for the judgment of executives. It covers situations where “…it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.”

Whether intentional or not, the wording is somewhat vague and ambiguous. Certain words should be interpreted in the light of precedents set in the Canadian courts. There is no way to determine the true meaning of many of these terms when applied to a specific data breach, including:

Reasonable
In the circumstances
Real risk
Significant harm

What Really Happens After November 1, 2018?

Although the law takes effect on November 1, 2018, it will not actually take effect until the Office of the Privacy Commissioner of Canada has written and published its implementing regulations after consultation with stakeholders.

If you are concerned about the impact on your Canadian operations, it is important to track what is going on in the process of writing and implementing these regulations.

There is, for example, no guarantee at this point that the regulations, when written, will not be retroactive. You should comply now.

Should All Data Breaches Be Reported?

The answer to this question can be found by looking at the experiences of other companies – Facebook, Uber, Google, and Experian – that suffered data breaches and did not report them.

Every single one received a great deal of bad publicity. Many of their executives were fired for the way they mishandled the breach.

The applicable rule here that all should remember is: “It’s not the crime; it’s the cover-up.”

A data breach is bad enough. It exposes the personal information of millions of people to hackers and thieves. Any organization that has a data breach also has a duty to report it promptly. The guidelines for reporting it and notifying affected parties are clearly spelled out in the law. Your best assumption is that either you will have to report the breach, or someone will report if for you.

Fines and penalties can be much more severe for those organizations that wait too long before reporting a breach or do not follow the guidelines.

Wrap Up

Despite all the efforts devoted to cybersecurity, the public is still extremely vulnerable. In years to come, security experts may find ways to stop the onslaught of data breaches around the world, but today, the best course of action is to follow the data breach laws.

October 24, 2018October 23, 2018

Should You Ban Laptops From Meetings?

Efficiency in the workplace is paramount to success. This concept is widely held across office environments everywhere. But while technology plays an increasingly valuable role in the way the world does business, that’s not to say it doesn’t come with its own unique set of drawbacks. Laptops and mobile devices are presenting problems within the workplace, particularly in regard to productivity.

In the workplace, screens often serve as barriers, and today’s businesses are tasked with coming up with new ways to minimize these technological distractions. One effective method? Banning laptops from meetings.

The research is clear: laptops and mobile devices are no good for productivity, especially when it comes to meetings. Banning laptops and mobile devices from meetings can boost both productivity and efficiency. From reducing the amount of time it takes to conduct a meeting, to encouraging employees to be more present and engaged, banning laptops may be the next big trend in business.

The Dangers Of Multi-Tasking

Technology that’s been designed to improve our productivity can actually serve as culprits. They can interfere with our point of focus, whether that be our boss or colleague during an important meeting or a lecturer in the midst of a seminar. Laptops distract from learning, both for users and for those around them.

Research shows that multi-tasking is a killer of productivity. This doesn’t apply to just individual productivity, either. It can also have negative effects on the organizational level, which is causing problems for businesses everywhere, regardless of industry. One report concluded that multitasking within organizations is even impacting the global economy, resulting in a loss of $450 billion.

The human brain simply does not retain information as well when there is a distraction like a laptop or mobile device competing for attention. There are numerous studies that back up these claims. In fact, when employees use their laptops or mobile phones during a meeting, they’re known to do a number of things that hinder productivity, including asking questions that have already been answered. It may seem like nothing but a minor inconvenience to some, but gather enough instances like this, and you’ll see how much time (and money) is at stake.

Not only is multi-tasking thought to hinder productivity, but it also makes employees more prone to distractions. Other negative effects include poor critical-decision-making and underperformance.

Benefits Of The Ban

There are several benefits to banning laptops from meetings. From boosting creativity to cutting down on meeting time and even encouraging engagement, banishing laptops from the meeting room may be doing your company more good than you initially realize. This is why a growing number of managers are making the call.

Here are some of the benefits associated with banishing laptops from meetings.

Time Management

Commanding complete attention during company meetings can lead to more valuable, engaging discussion. A meeting in which all participants can easily understand and contribute input concisely is an effective one.

More Engagement

One of the most important aspects of a meeting is being present in the moment. Staring at your screen makes this impossible. Employees fixated on their laptops won’t be able to make eye contact, and their body language may be off-putting during a meeting. Banning laptops during meetings is just one way to promote engagement and the sharing of ideas.

Better Comprehension

Writing notes by hand has been scientifically proven to help in information absorption. While taking notes during a meeting may at times be necessary, using a laptop to do it is not. Encourage teammates to use pen and paper to increase comprehension.

Tips To Take Control

Business owners and managers can do a number of things to further promote engagement during meetings. Once you’ve made the decision to ban laptops, you may want to put a solid system into place. Establishing a firm “no laptop” rule during meetings will help things remain consistent across the board. You may even consider a check-your-laptop-at-the-door rule that will help drive the point on home with your colleagues. If you are hosting a remote meeting where laptops are necessary, implement a rule that states all other apps and windows must be closed. This small step alone can help increase comprehension and cut down on distractions.

Banning laptops may seem futile if you are wasting time in other ways. A good rule of thumb is to let employees know how long the meeting will be, as well as whether or not there will be breaks. Not only is this common courtesy, but it can also help minimize the anxiety that may come with not having instant access to emails and texts.

If you know that your meeting will consist of need-to-know information, encourage fellow employees to use pen and paper. By providing these tools ahead of time, you’ll make it that much easier for your team to follow through.

These small steps can do wonders for promoting productivity and helping your employees make the most of their time in the office. While laptops are commonplace in today’s office setting, and often vital for productivity, leaving them off the table for a while (literally) can act as the first step toward more meaningful meetings.

October 24, 2018October 23, 2018

Do You Have Good Computer Habits?

Woman working on computer in Google Docs

We know it’s important to have good habits in many parts of our lives, from our work to our daily hygiene. However, quite a few of us forget that we need to have good computer habits, too. Developing wise practices in connection with our computers and smartphones can make our lives much easier and help us to stay much safer on the internet.

Back Up Your Files

One thing that many people fail to do is back up their files. All it takes is one catastrophic computer crash and days or even months of work can be lost. Priceless family photos, fun videos with friends, key work files, and important school assignments that were a work in progress can be lost. Backing up your files isn’t that hard nor is it expensive. And, to make things even better and easier, you have many different options from cloud-based backups (such as GoogleDrive, OneDrive, or DropBox), convenient USB thumb drives, portable hard drives, and even specialized backup drives. A good practice is to make sure your files are backed up daily, or at least weekly.

Keep Your Software Updated

Software updates can be a pain, but they are vital to ensuring that your computer and software runs smoothly. In fact, one of the major reasons that updates are released is to fix bugs and issues that could make your computer vulnerable to cyber threats. Hackers know about these bugs and vulnerabilities. If you don’t allow your system to install the patches and fixes, then you are making yourself a prime target for a cyber attack.

Keep in mind that you don’t have to perform updates in the middle of your work anymore. Most software (and smartphones) will give you options for when the update should take place, so you can choose times when you aren’t busy on your computer.

Be Smart When Using Public Wi-Fi

Public Wi-Fi in places like fast food restaurants and coffee shops can be tempting to use when you need an internet connection, but they can also be dangerous. These public Wi-Fi networks are a common target of hackers, and even hackers with minimal skill can quickly figure out things like your social media credentials and more.

If you do have to use public Wi-Fi, take safety precautions such as turning off network discovery, file sharing, and printer sharing and make sure your firewall is turned on. Don’t be an easy target for hackers.

Make Use of Antivirus Software and Passwords

Would you leave your front door unlocked if you lived in a high-crime neighborhood? Well, the internet is a high-crime neighborhood. Failure to use updated anti-virus software and good passwords is the same as leaving your door unlocked. You can’t afford to make it easy for the wrong people to access your personal and financial information.

Your first line of defense lies in the passwords you choose. Don’t use easy to guess passwords, and don’t use the same passwords for everything. Include letters and symbols with your passwords to make them harder to crack, and add some numbers for good measure.

Your second line of defense, much like a deadbolt for your front door, is anti-virus and firewall software. They don’t have to be expensive in order to do a good job of protecting your computer. It is also vital that you keep your anti-virus and firewall software updated and don’t ignore alerts they provide.

Be Careful with Email

Going back to our analogy of living in a high crime area: if your doorbell rang in the middle of the night, would you fling the door open and invite whoever it was inside? You would probably want to make sure who it was, and even check their ID if they claimed to be some kind of official demanding access to your home. Strangely enough, far too often we inadvertently provide access to individuals with malicious intentions when we click on links in emails without making sure where those emails are really from.

In short, don’t open an email unless you have a good idea of who it is from, and beware of clicking links in emails even if they seem to be from friends. Be cautious about opening attachments, too. In short, be as careful with your email as you are with your front door.

Conclusion

You work hard to keep yourself safe from physical dangers such as criminals and disease. It makes sense that you should work just as hard to keep your electronic devices safe, too. Backing up files (including documents, photos, and videos), keeping your software updated, and being smart when on public Wi-Fi is a good start. Add to that antivirus and firewall software, robust passwords, and the careful use of email and you are on the road to developing excellent computer habits that will keep your files, data, and personal information safe.

October 23, 2018

Google My Business Reviews: The 3 Critical Things You Need to Know

Google My Business is an excellent tool for establishing and tracking your company’s online presence. Included in Google My Business are tools to help you manage customer reviews. However, in order to get the most out of the review tools, you need to know (1) how to find your reviews, (2) how to encourage customers to share reviews, and (3) how to be alerted when you do receive reviews.

1. How to Find Your Reviews

In order to both see and manage your Google My Business reviews, you need to pay a visit to this site: business.google.com. Login, and once you are in, you can see your own My Business page. This allows you to, among other things, see and respond to the feedback your clients have provided through Google reviews.

You’ll find a link to Reviews on the left-hand side of the dashboard (it has a star icon beside it). This will open up a dedicated review page that allows you to write and edit constructive responses. Note that this also allows you to select one of three basic views: All, Replied (that would be, of course, reviews you have already replied to), and Haven’t Replied (which would be the reviews that you haven’t posted a reply to yet).

If you are still new to Google My Business or just don’t have very many reviews yet, you will want to start requesting reviews from your customers. With more and more people depending on the internet for reviews of everything from cell phone plans to home repair services, it is important that your company have reviews from real customers posted on Google.

2. How to Encourage Customers to Share Reviews

Trying to get great reviews can be tricky. Google My Business web pages do not offer a way to directly request a review from a customer. There is a workaround, however. To get a URL to promote to your clients, start by searching for your company from within Google maps (maps.google.com).

This reason you need to go to Google maps is simple: at the bottom of your company listing in Google maps, there is a link to post a review of your company. Once you are on your company’s map page, copy that URL. Then open up a URL shortening service such as bitly so that you can shorten that URL. With bitly, just paste in your URL and click on Shorten. You will receive a very short URL that you can copy and paste to your company’s website, emails, invoices, email signatures, business cards, and other materials. This makes it much easier for your customers to respond with feedback without having to search for your business on Google. The easier you make it for people to provide reviews, the more reviews that will begin to come in.

3. How to Be Alerted When You Do Receive Reviews

Once you are actively promoting reviews, you need to know when reviews are posted so that you can respond to them. It is important to quickly acknowledge reviews, both the good ones and the bad ones. Poor reviews especially need attention, and your company should try to make contact with the disgruntled customer and, if possible, take the discussion offline. However, you want others looking through your reviews to see that when a customer is dissatisfied, your business will reach out to fix the situation – even when the review is unfair. It is very important that a negative review does not sit out on the internet with no response.

Fortunately, there is a way to receive an alert as soon as a review is posted. To receive alerts about reviews, start by returning to the Google My Business homepage where you should still be logged in. Look toward the bottom of the right-hand side where it says Settings (there will be a gear icon next to it). Click on Settings, which will open the Email Notifications page. About halfway down, you will see an option that says Customer reviews. If you click the checkbox on the right-hand side of this option, you will receive email alerts when a customer posts a review. That is all you need to do to be alerted when a customer posts a review.

Conclusion

Your company’s reputation online is very important, and it is critical that you receive feedback in the way of reviews. Google My Business has the tools you need to manage those reviews, including tracking them, responding to them, and being alerted when they are posted online. There isn’t a direct way to request reviews from your customers, but smart use of a link in the Google Maps listing of your business, combined with a URL shortening service, can help you gather those reviews you need.

October 23, 2018November 15, 2018

What Is HIPAA, And Why Should I Worry About It?

The Health Insurance Portability and Accountability Act (HIPAA) is a Federal statute, and associated regulations, that, among other things, control what healthcare providers and other “covered entities” do with “protected health information” (PHI). The HIPAA regulations are fairly straightforward, but there are a lot of them. There is a good summary here, with links to the relevant portions of the Code of Federal Regulations (CFR). This article covers only the basics.

Who Does HIPAA Apply To?

“Covered entities” are health care providers, health plans, and health information clearinghouses. The latter are usually aggregators of health information from hospitals, doctors, and the like. “Protected health information” is any information that relates to an individual’s past or present health status, treatment, and payments for any treatment an individual receives. Past, present, and future healthcare records are covered.

Data falls under HIPAA protection for 50 years after the death of the patient. The form in which the information exists does not matter – it can be written, oral, or electronic. If the information is in electronic form, additional requirements for protecting it apply.

Why Should I Worry About All This?

People are concerned about following HIPPA guidelines and they should be. It’s important to protect the personal and healthcare information of all patients. In addition, the Office of Civil Rights (OCR) within the Department of Health and Human Services (HHS) can impose large fines and other penalties for HIPAA violations. Hospitals and health systems have been fined in the millions of dollars for HIPAA violations. And HIPAA violations, if they make it into the news media, always create bad publicity.

What Can I Do To Remain Compliant?

Training of staff on HIPAA rules and practices is by far the most important step. The second is making sure that PHI stored in electronic form is protected. That involves things like:

Using encryption when data is stored or transmitted
Making sure that staff have only the access needed to do their jobs
Making sure that access to systems is, at a minimum, protected by strong passwords
Protecting records with the latest technology such as swipe cards or biometric identifiers

What Do I Have To Do To Conform To HIPAA?

You need to:

Formulate your privacy practices
Notify patients of privacy practices
Obtain consent or authorization when required
Make sure that your arrangements with business partners meet HIPAA requirements
Make sure you distinguish your normal health care operations, where consent is not required, from disclosures, where consent or authorization is required
Make sure you follow the HIPAA “security rule,” which covers PHI in electronic form

It goes without saying that your legal department needs to be involved in all of this. The Notice of Privacy form should inform patients and staff of what your practices and guidelines are. The notice should be given in written form to patients when they are first encountered.

“Arrangements with business partners” concerns companies that may have access to PHI in the course of providing services to a health care provider. These include companies that provide storage of documents, destruction of documents, or electronic handling of documents. You are required to make sure that they understand the HIPAA requirements and conform to them. You can think of it as the HIPAA requirements “flowing downhill” from you to your business associates.

What’s The Difference Between Consent And Authorization?

In many cases, no consent is required. This includes disclosure of PHI for treatment, payment, and health care operations. A covered entity may, but is not required to, seek consent from a patient for these purposes, but it is common to do so.

On the other hand, an authorization is required for any use of PHI other than the ones listed above. An authorization is more formal than a consent, must be written, and must contain several elements, which are covered here.

Authorization is required when the disclosure is for any purpose other than treatment, payment, or health care operations. This includes disclosure to a third party, such as a life insurance company, an employer, or a provider not affiliated with your healthcare organization.

Please note that electronic transmission of PHI is covered by the authorization requirement as well. If authorization to send the information on paper is needed, authorization to send it electronically is needed as well.

What Are The Takeaways?

HIPAA compliance is not optional.
Penalties for violating it can be very costly.
HIPAA applies to PHI in any form – paper or electronic.
Obtaining consent is generally a good idea; authorizations are required.
Depending on the services your business partners provide to you, they may be required to conform to HIPAA as well.
It is always better to err on the side of caution when dealing with HIPAA.

If you still have questions, be sure to visit the HIPAA website. Today, there are many organizations that can help you learn about and comply with HIPAA guidelines. For instance, many managed IT services providers have tools to help with compliance.

October 23, 2018

Section 179 IRS Tax Deduction: What Does It Mean For Your Business?

Today’s business owners carry many burdens, but tax time can cause a headache like no other. Filing taxes is often a cause of stress for small business owners and those just starting their empires, and with an ever-changing set of rules and regulations to follow, it can be difficult to understand it all. It’s important, though, to pay close attention to changes in tax codes. One change, implemented just this year, is already presenting big benefits for business throughout the U.S.

H.R.1.’s Section 179 was signed into law in January of 2018, marking a change to the previous tax laws followed by business owners throughout the U.S. The IRS 179 Deduction was enacted to help small businesses lessen their taxable income, thereby reducing their tax burden. At its core, the tax code now allows business owners to take a deduction equal to the full purchase price of a qualifying piece of equipment. Not only does this encourage small businesses to invest in new equipment, but to also invest in themselves. Numerous small businesses are already reaping the benefits.

What Does Section 179 Do For Businesses?

Due to its signing, Section 179 will see an increase in deductions from $500,000 to $1 million, while equipment purchases will be subject to an increase of up to $2.5 million. Small businesses ought to take advantage of these new changes by investing in their growth, and one of the best ways to achieve this is through technology.

With these new regulations, businesses are now able to file a deduction equal to the total purchase price of a piece of equipment. Qualifying equipment may include laptops, routers and phone systems, among others. In order to take advantage of these new tax benefits, you’ll need to buy, lease or finance and use your equipment by 12/31/2018.

What Type of Equipment Qualifies?

A wide range of tech items qualify for the deduction, and qualifying equipment doesn’t need to be owned, either. Business owners can still take advantage of deductions even for items that are financed or leased. This includes both hardware and software. One stipulation is that the equipment must hold a service contract for business in order to qualify and that equipment must have been in service between January 1 and December 31 of 2018. If the equipment was purchased under a Capital lease, dollar buyout or cash sale, it still qualifies.

Items eligible for deduction include those that help promote and maintain productivity. To take full advantage of these deductions, businesses ought to invest in equipment with the potential to improve efficiency and security measures. Routers and firewalls, for instance, should be replaced every few years to stay in tune with the most current security standards. Other equipment like scanners and switches, both of which are constantly improved, should be upgraded every few years to maximize productivity. With items like these, newer often means faster, and in a bid for productivity, newer and faster can’t be beaten.

Laptops and ultrabooks are covered by the new tax code, and businesses would do well to frequently upgrade to models that boast longer battery life and other features that can aid in productivity and efficiency. Workstations and additional monitors are also eligible for deductions. To take advantage of this, organizations may want to consider providing a 2nd monitor for employees to further enhance productivity.

This also applies to backup equipment and appliances built for disaster recovery. If your business doesn’t yet have a reliable system in place to keep your business afloat in the event of an emergency, it’s something you should definitely consider.

Other items like storage can also be deducted. Storage Area Networks and Redundant Array of Independent Disks are just two examples of storage systems that are deductible for businesses.

Is There A Bonus Depreciation?

In regard to business tax codes, bonus depreciation can be unpredictable. In 2018, bonus depreciation is being offered at a full 100 %. While the Section 179 Deduction applies to both new and used equipment, the same has not always been the case with Bonus Depreciation. Up until just recently, Bonus Depreciation only covered new equipment. Now, it also applies to used equipment, which has proven useful to large businesses that may surpass the Spending Cap under Section 179, which is currently set at $2,500,000.

Tax codes for businesses can be complicated, but the goal of Section 179 is a simple one: encourage businesses to spend more in order to do more. Businesses large and small would be wise to make the most of these tax benefits and leverage them to plan for the future. A certified accountant can walk you through these changes and help you make educated decisions when investing in equipment for your business.

October 23, 2018

Why Should Law Firms Consider Outsourcing Their IT Services?

The phrase, “Technology…you either love it or hate it” is a concept that no longer works in the modern world. In fact, it really is not even relevant. Technology has worked its way into nearly every business. The legal sector is no different. Of course, legal professionals may have held out longer than others.

The contemporary law office barely resembles traditional practices. In fact, technology continues to handle larger amounts of legal work at a greater frequency. This frees attorneys to work on more personal aspects of the job. Unless they are technically-savvy, most lawyers delegate these tasks to support staff. Generally, however, it is only the largest law firms that hire an onsite IT team.

This is why many offices prefer to outsource their IT services.

How Are Resources Utilized When Law Firms Do Not Outsource?

When a firm hires an IT-specific employee, this is a major commitment. This individual becomes a member of the support staff and is paid regardless of whether his or her services are required. Otherwise, if one of the partners chooses to take on the task, it is at his/her financial detriment. He/she would be using the time that would otherwise be directed at serving clients, etc.

Additionally, as new technology is required, the firm would need to personally handle it. The on-staff tech (or benevolent partner) would need to take time, and possibly classes, to learn everything about it. This all results in a bit of a mismanagement of resources, which is especially true when there are other options.

Would the Law Office Incur Additional Fees or Experience Downtime?

When a firm outsources their IT services, the provider takes all the responsibility. They spend the money. They invest in the education, software licenses, training, and certifications. This enables them to troubleshoot and resolve problems with the firm’s computers, Internet, servers, and software issues rather than the firm’s.

Generally, outside IT service providers are made up of a team of experts rather than one overworked technician. This allows them to have a variety of individuals who offer a range of experience and skills. They also have access to more advanced technology and tools. Since it is their primary focus, they have to keep up with all of the latest innovations. Otherwise, they lose their edge.

Since there are many people with different perspectives, team members are able to consult with and advise each other. With so much at their disposal, it makes it much easier to identify and resolve the core problems more quickly. This means that there is little if any, downtime or interruptions for the firm.

Does Outsourcing IT Service Provide Business Continuity?

By outsourcing their IT services, a law firm will receive support 24-hours a day, 7-days a week, and 365-days a year, whether they need it or not. This level of support is not possible from even the most diligent in-house employee. An outside source would also have additional resources available that an inside tech would not have.

Since the work to troubleshoot an issue is outsourced, the rest of the office can go about business as usual. Nothing else changes. In fact, business continuity is one of the primary reasons to outsource. It ensures the law office is able to continue as if nothing is amiss. This makes it a particularly responsible option.

What Are the Top IT Outsourcing Options?

When choosing an outside IT firm for a law office, it is important to take due diligence. There are many options, and they are not all equal. Fortunately, there is a resource that has already ranked the top choices. The Everest Group researches each. This makes a time-consuming personal analysis almost unnecessary.

The Everest Group is a management consulting and research firm that advises businesses around the world. Every year since 2008, the Everest Group has evaluated outsourced IT service providers according to 26 characteristics. These include the technologies they use and the geographies they cover, among others.

The top 10 for the year 2018 include the following IT firms:

Accenture
TCS
Cognizant
Wipro
IBM
HCL
Infosys
CapGemini
DXC Technologies, which is a merger of CSC and HPE
NTT Data

Although these are the top 10 in this reporting year, there are many reputable providers. The Everest Group keeps tabs on the up-and-comers who may unseat the 10 as well. Checking previous winners provides a more comprehensive picture of who has performed reliably.

In Conclusion

For some law firms, there is peace of mind having their own in-house technician or IT team. Most offices, however, would benefit from outsourcing their IT services. Ultimately, it conserves money, time, and other resources. Rather than researching the various options, a busy attorney would do better to peruse the years of lists compiled by the Everest Group. With several reliable performers on them, there is no reason not to.

October 22, 2018October 22, 2018

10 Easy Steps Implementing Your Successful SOP with SharePoint

Standard Operating Procedures (SOPs) are necessary for every industry. The written procedures keep a company on track. The importance of having them is to guarantee the organization remains compliant with all federally mandated regulations, legislation, and ever-changing laws. But too often many businesses will continue to struggle with getting the correct and appropriate SOP created, distributed and understood by their employees.

What is an SOP?

Standard Operating Procedures are clearly defined instructions. Their purpose is to, execute consistency of the performance, of a specific function. A detailed written and enacted SOP are used to fulfill compliance requirements, mitigate safety and health risk, and directly work consistently and efficiently across an entire organization. This guide provides you with ten easy steps to review when implementing your organization’s SOP.

Step 1 – SOP purpose is clearly understood and explained

Are you wondering why an SOP is required? In your organization, you want problems solved before they arise. So, what issues need addressing and what does it need to accomplish. Here are some examples:

Reducing costs
Increasing quality
Ensuring safety
Reducing risk
Protecting the environment
Providing a training source

Step 2 – Consider your audience diversity

Before your Standard Operating Procedure gets written, you’ll want to look at your intended audience. Does this audience have prior knowledge of the subject matter? Will they have the necessary language skills to understand? Also, what is the size and shape of your audience? Remember, some parts of the SOP will make sense to one group, but not another.

Step 3 – Format and layout must be useful

There are no right or wrong ways when designing or presenting your SOP, but here are some easy reminders to consider:

If you have a pre-existing format that is working well, then there is no need to change it, but do consider slight enhancements. Sometimes a new visual does grab the readers attention.
Does your process have multiple routes? That’s okay. Consider using a flowchart layout. Many individuals learn better with visual content.
How long is the process? Short or very long? Then use hierarchical steps. To provide clarity, give a list of main steps with sub-steps underneath that helps.
Is the routine simple which only requires just a few steps? Then using a simple list may be the most beneficial way.

Step 4 – Suitable authors must be used

To write an SOP; you need to have the necessary knowledge. While you may have been assigned to create, and even own this SOP, always bear in mind, you need to have the required expertise to write it. Guarantee that experts in the relevant areas get brought into the authorizing process. Using SharePoint tools to expedite that collaboration is crucial to success during this phase.

Step 5 – Supply appropriate content and structure

There will always be specific needs for unique situations. But, these examples below are necessary details that must get included in your SOP:

What is the scope of an SOP
What is the SOP procedure
Are there any Health and Safety Considerations
Are there any equipment needs
Glossary of terms and Hints and Tips

Step 6 – Use a writing style the reader can easily read and understand

All content in your document must remain clear and easy to read. Not doing so will make it hard for your reader understand any references, making comprehension difficult.
Avoid personal pronouns, such as He, Him, She, Her, Them, and You.
Establish steps that explicitly help with ease of reference and maintenance in the future.
Avoid walls of text. Insert diagrams, flowcharts, and bullet points.

Step 7 – Mandatory SOP testing

Your personnel must get SOP tested, especially by the people who will use it, and guarantee comments are taken on board and updated within the SOP as needed and required.

Step 8 – Make it known to your entire staff where to find the SOP

Organizations that have implemented a Standard Operating Procedure, typically have a known location where to find the material. But do not assume everyone in your organization knows where to look. It might be at a SharePoint site either department or organization level, but make sure everyone knows where to look.

Step 9 – Check that the SOP was distributed and read

While a repository is required, placing your SOP on SharePoint to be read does not go far enough. Immediately after your SOP gets updated or put in place, an email should be crafted and sent to all the relevant user groups to read the document. Then a response back from all recipients they have read and understood the material. You could use a SharePoint based tool to manage this whole process for you.

Step 10 – Guarantee staff fully understands

After each staff member has read the SOP, next comes sitting with them to make sure they clearly understand and expected of them. There is a need to guarantee your team has a clear understanding of what is meant by the Standard Operating Procedure. Testing your staff after reading the material, gives you an idea of what they do or do not comprehend, and how you can address any concerns.

Did you find this article informative? If you liked this one, check out our other content we think you’ll find interesting.