2019 Accountant’s Guide to Preventing Technology Headaches

2019 Accountant’s Guide to Preventing Technology Headaches

Downtime, compromised data, security breaches, and slow-running technology cause big headaches for today’s accountants. After all, you need your technology, and when it’s not working, every hour that goes by costs your firm money.

You can’t afford to sit idle—when your technology doesn’t work, neither do you. If your competitors use more efficient IT solutions, they’ll blow right past you and take your clients away. Or worse, your reputation will suffer.

Technology helps you carry out essential tasks, exercise professional judgment, engage with clients, provide advice, and settle tax issues. If you view technology as an opportunity rather than a threat, your firm will prosper and reap the rewards of your efforts. If you don’t, you’ll fall behind the competition.

You use technology now more than ever—at least, you should. Today’s technology is invaluable, and with time it will become even more so. In the past, the accounting profession lagged behind others in the adoption of new technology. They relied on paper-based filing and printed accounting forms that were time-consuming to process.

Accounting firms like yours have now embraced new technology. Just like other businesses, you need to streamline your services to save time and process accounting information. With modern technology like cloud-hosted accounting software, you and your clients can access data directly and simultaneously. The days of shuffling papers back and forth are over.

However, along with technology-provided benefits come some challenges.

Failed backups, slow-running email, application problems, and operating-system crashes create headaches that set up barriers to your success.

Downtime is a threat—it results in a significant loss of productivity. You can’t afford to be faced with server failures, poor systems performance, accidental file deletions, or software application crashes. Without access to your data, you and your employees can’t do your jobs. Money goes out the window, and you can’t meet your filing deadlines.

Data security is another issue that can cause significant headaches. Client confidentiality is your most important duty. But with hackers and intruders who want to infiltrate your technology for their own financial gain, your technology landscape is like a minefield unless it’s adequately protected.

As a Chartered Accountant, you are governed by Rules of Professional Conduct that always have and will continue to guarantee the privacy and confidentiality of your clients’ personal information. If their financial data is stolen, you’ll face penalties, fines, and possibly civil prosecution. You can’t take that chance.

THE ANSWER IS TO CONTRACT WITH THE RIGHT IT SERVICES PROVIDER.

To prevent IT headaches, you need service and support from an IT provider who understands the Line of Business (LOB) applications you use including your financial preparation and planning software and billing systems that keep your operations efficient.

The right provider can ensure these seamlessly incorporate with other applications you use like Microsoft Office or Office 365. When you have access to expertise from an IT Service Provider who truly understands your needs, you can effectively leverage these powerful tools.

Look for an IT Service Provider who has been serving the needs of accounting firms and corporate accounting departments for years. The best choice is one who can cover a broad range of technology requirements through both professional services and Managed IT Services and who can grasp the complexities your accounting firm faces.

They should be able to help you avoid IT headaches when automating routine accounting processes, sharing financial files, deploying mobility solutions, and capitalizing on tools like electronic filing.

Your accounting practice requires a complete technology management solution including data protection and proactive monitoring of all critical functions on your network, servers, and workstations. Plus, you should insist upon a fixed-cost solution with predictable budgeting. Just as your accountants are committed to your clients’ success, your IT Service Provider must be dedicated to making you successful and view themselves as an extension of your practice.

Your IT Service Provider should be adept with:

  • Cloud Technologies that improve your productivity, efficiency, and security
    With cloud solutions, you can eliminate the cost of paper and the hassle of sifting through files, store massive amounts of information (Big Data), share important files in real time and secure your clients’ information offsite in high-security data centres.
  • Accounting Practice Management Software that helps you run day-to-day operations including the centralization of client data, tracking due dates, staffing, workflow management, automated billing, and time tracking
  • Tax Preparation and Filing Software designed explicitly for accounting firms, so you can analyze different income tax scenarios and have access to the reporting tools you need for fast, easy reconciliation

THE WORST HEADACHES RESULT FROM IT SECURITY BREACHES.

Data breaches are increasing exponentially. Cyber mafias have set up in towns like yours, operating from legitimate-looking offices. Hackers are no longer kids in their parents’ basements working on a few computers. Cybercrime is an international and sophisticated business with cartels operating around the globe.

Your data is valuable, and your accounting firm is a target. You need the expertise of an IT Service Provider who stays up to date on the latest threats. It’s imperative that you protect client information. But IT security best practices change so rapidly that accounting firms often find themselves falling behind the curve. If you do, your firm is at risk of viruses, network vulnerabilities, and data breaches. This results in more than a headache; now, you’re looking at a migraine.

Criminals have many ways of stealing your data.

Internet Exploits

Your employees use connected devices to interact with, track, monitor, and simplify just about every area of their work and personal lives. However, these technologies also provide access to sensitive, confidential information and present a wide variety of new security issues for attackers to exploit.

Third-Party Attacks

Cybercriminals have learned that contractors and other third-party providers aren’t as secure as large vendors, and lower security provides a pathway into otherwise-secure networks. Examine who can connect to your network and access confidential information, even if you believe appropriate security measures are in place.

Social Media Attacks

Social media presents two main security headaches:

  1. A website you visit or service you use can be infected with malware that spreads until your network is ripe for a data breach. Malicious social media content is expected to grow 400 percent as attackers continue to distribute their malware and steal client data.
  2. A determined hacker or team can scrape social media sites to assemble a surprising amount of personal data very quickly. This data can be used to engineer an attack.

Social Engineering Attacks

Human nature is easily the weakest link in any security chain. Was that really a utility-company employee you held the door for this morning? Are your office painters propping open a secure entrance to make their task more manageable? Did your receptionist just give all your passwords and hers to someone who called claiming to be from tech support on another floor? Will your colleague’s curiosity causes him or her to insert the USB key “found” in the parking lot into a computer connected to your systems?

Mobile Malware Threats

Security experts have been warning us about mobile malware threats for a long time, and users have grown immune to these warnings. Mobile-device use is increasing, as is the sophistication of attacks. At the risk of being the boy who cried, “Wolf,” every year a major mobile malware attack is more likely to occur. Attackers typically select the most significant number of potential victims. So, they will target mobile devices, specifically Android and jailbroken iOS devices.

Sophisticated DDoS Attacks

Distributed Denial-of-Service attacks don’t directly steal your information. Instead, they overwhelm your site or service with so much traffic that it prevents legitimate users from connecting. These attacks have evolved beyond simple flooding of traffic. They probe and then morph, based on the defences in place on your network. Such advanced and sophisticated attacks can seriously impair your accounting firm’s operations.

TO PREVENT THESE SECURITY HEADACHES, YOU NEED A SECURITY PLATFORM WITH REMOTE-ACCESS MONITORING AND RELIABLE BACKUP AND DISASTER-RECOVERY SOLUTIONS.

Be sure your IT Service Provider implements innovative, up-to-date security measures to protect your accounting firm against intruders, malware threats, and disasters. And ensure they can do the following things

Ensure:

  • You comply with accounting and confidentiality requirements when using technology.
  • You use appropriate technical means to minimize the risks of disclosure, discovery, or interception of communications.
  • Data and email are encrypted to protect your sensitive information.
  • You adopt management practices that offer protection against disclosure or discovery of electronically transmitted messages.

Prevent:

  • Unauthorized access to your electronic data
  • Computer viruses from damaging your data
  • Natural or manmade disasters from affecting your IT operations

Confirm:

  • Your files are reliably backed up and recoverable.
  • Both offsite and onsite data backups are maintained.
  • Data is restorable by performing ongoing testing.

Provide:

  • Systems Analysis
  • Mobile Device Management
  • Up-to-Date Security Solutions
  • User Support and Training

Your IT Service Provider should implement a security platform with multiple layers of protection, with 24/7 remote monitoring to detect infections and intrusions, and block them before they get in and steal or hold your data hostage. Many accounting firms are unaware that this goes on. Your IT provider will keep you informed and train your staff to recognize threats, so you know what to do if one comes across your computer screen.

Your very most basic security solution should include barriers with virus and malware detection at the firewall level and DNS (Domain Name Server) controls to ensure your users don’t visit hijacked websites. Your employees should also utilize two-factor authentication access practices to prevent criminals from getting into your network.

Nothing is more important than protecting the information on your network and the peace of mind that comes from knowing you can fully recover if a disaster hits your firm. Your IT provider must ensure your business continuity and disaster recovery solutions will meet your objectives and must implement a robust backup and secure off-site replication solution.

While computer systems can easily be replaced, the intellectual property and sensitive information stored on those systems cannot. Computer hard drives can fail, laptops can be stolen or lost, and data can be erased due to human error or viruses. It’s important for your accounting firm to have a backup system to keep data safe and avoid data loss.

Ask your IT Service Provider if they employ system virtualization and a private cloud with a fully redundant system that can be replicated across multiple data centres. If your data is compromised or damaged, a new clone of your system and data can be spun up with a new, fresh image in a manner of seconds.

Be sure your IT provider uses an Intrusion Detection System. This will catch anything that may have bypassed your firewall. They can either be used to find a break-in attempt in progress or detect one after the fact. In the latter case, it’s too late to prevent any damage, but at least you’ll be aware of the problem.

If an intruder gets into your system, the first thing they typically do is install a “rootkit.” A rootkit is a script or set of scripts that can make changes to your IT system and hide in common system utilities. They function in the background without your knowing they are there. Criminals can easily obtain these on the Internet. This is one reason you must have reliable backups of your entire IT system. If rootkits are discovered, you’ll need to re-install your system and data and start over from scratch.

Your mobile devices also require monitoring and management. If a phone or laptop is stolen, you must be able to remotely wipe your confidential data. Mobile Device Management also prevents disgruntled employees from leaving with your confidential or proprietary data.

Your IT Service Provider should also employ encryption to protect your confidential data. They should encrypt both your emails and data files to ensure the security of information. Encryption can protect your data at rest, such as on laptops or portable servers, as well as data in motion, such as over wireless networks or the Internet.

One of the most overlooked security aspects in accounting firms is their creating and retaining policies regarding email and data. You are accountable for instituting and employing a strategy that details the duration over which your client data and emails will be stored and deleted. Ensure your IT provider can implement automated solutions to handle this.

IN CONCLUSION

You understand the unique challenges and technology demands your accounting firm faces. Whether your IT headaches come from the security risks of handling and storing confidential information or the difficulties of keeping up with new, innovative Line of Business Solutions, you need an IT Service Provider who can ease your struggles and your IT headaches.

SCAM ALERT: Google Play Gift Cards

Google Play Gift Cards

If there’s a will there’s a way when it comes to scammers, especially with gift cards. Everyone loves gift cards. Consumers love how easy it is to purchase gift cards, use gift cards and even give gift cards. It’s as simple as buying a card at a brick and mortar store or clicking a few buttons and almost instantly having the funds needed to play. Scammers love gift cards too. Gift cards can immediately be activated and spent by these scammers even before the owner of the card knows what happened.

Google Play gift cards are targets right now. Scammers love how easy they are to steal so consumers need to stay one step ahead of these online crooks. Here’s one of the latest Google Play Gift Card Scam that is scouring the internet.

Google Play Gift Cards

Scam Alert: Currently there is an email scam occurring where thieves, posing as someone the recipient knows and are phishing for personal, financial, and other private information. This includes requests for Google Play Gift Cards. For example, the message will read, “I need you to pick up a couple of gift cards. Can you make this happen? The type of gift card I need is Google Play gift cards. I need 4 cards in $500 denominations…scratch the back of the card to reveal the card codes and email me the gift card codes.”

Take away: Never provide any personal information including gift card codes like Google Play in an email. What seems like the information is going to a trusted source, it could be a scam.

New Distracted Driving Laws In Ontario – You Better Read This!

Ontario's New Distracted Driving Laws

Ontario's New Distracted Driving Laws

You are driving along and you glance down at your smartwatch. Imagine the horror of it when you hear the sirens wail directly afterward — but you think that can’t be for you: you were not driving over the speed limit. But it can be for you. The police saw you glance at your smartphone, and now you are facing potential license suspension.

It’s here: stricter distracted driving rules in Ontario have the potential to be quite devastating. Here’s what you should know about the new law that took effect on January 1, 2019.

What is the new distracted driving law in Ontario?

The new distracted driving law in Ontario is not necessarily new in the sense of what is considered distracted driving, but new in terms of beefed up penalties. If an officer suspects that you are driving while distracted, then you can be pulled over and cited. The police, however, cannot seize your driver’s license on the roadside. Your case will go before a judge, and upon conviction, you will have your license suspended as well as be subject to fines and demerit points.

What actions are considered distractions according to the new law in Ontario?

When we think of distractions associated with a distracted driving law, we most often think of our smartphones, but there are many other distractions that can result in a conviction. In fact, anything that causes a driver to be less focused on the road is a distraction to driving. The list of distractions according to Ontario’s Ministry of Transportation include the following activities:

  • Holding an electronic device — like a smartphone, iPad, tablet, iPod, or another device;
  • Using an electronic device to text, talk, send posts on social media outlets, type in addresses into the GPS or look at maps or control playlists;
  • Eating; and/or
  • Reading books or documents.

Further, if you think you can be safe using your electronics at a traffic light or any other time while in stopped traffic, you are wrong. It is not permitted according to this law to use your electronic devices while stopped. You can, however, use the following:

  • A hands-free electronic device that utilizes technology like Bluetooth and requires you to only turn it on or off; or
  • A mounted electronic device — whether it’s a phone or GPS system — so long as it is secure and does not move while you are driving.

The only exception to the new law is if you need to contact emergency personnel, like the police, fire department, or medical professionals.

What are the new penalties for distracted driving in Ontario?

Distracted driving has already been an offense in Ontario, but the new law strengthens the penalties to make it more of a deterrent than what it had been. Penalties vary according to the conviction: whether or not you have any prior distracted driving offenses. Plus, aside from the penalties, you can expect your auto insurance rates to increase dramatically. The stakes, therefore, have just multiplied with this new law.

First Distracted Driving Conviction Penalties

For a first distracted driving offense, you can expect the following penalties:

  • A fine of up to $1,000
  • Three (3) demerit points
  • A three (3) day driver’s license suspension, unless you have a graduated license, like a G1- or G2, then the license suspension is for 30 days.

Second Distracted Driving Conviction Penalties

For a second distracted driving offense within five years, you can expect the penalties to double:

  • A fine of up to $2,000
  • Six (6) demerit points
  • A seven (7) day license suspension, unless you are a G1- or G2-license holder, then the license suspension is for 90 days.

Third Distracted Driving Conviction Penalties

For a third distracted driving offense within five years, the penalties increase progressively, and include:

  • A fine of up to $3,000
  • Six (6) demerit points
  • A thirty (30) day driver’s license suspension, unless you are a G1- or G2-license holder, then your license could be canceled — and it can be difficult to get the license back.

Subsequent Distracted Driving Conviction Penalties

For each new conviction, fines and driver’s license suspension increases. You could potentially — if you become a repeat offender — be looking at driver’s license suspension up to two (2) years and fines of up to $50,000.

What to Do When Driving on the Roads in Ontario

There is a reason behind the new law and that is safety. The following are some statistics provided by CAA that you should keep in mind:

  • “Drivers engaged in visual-manual interactions with cell phones (e.g., texting) are up to eight times as likely to be involved in a crash.” (AAA, 2017)
  • Twenty-seven percent “of fatal crashes in BC was due to distraction. Police across Canada say that distracted driving has caused more collisions than impaired drivers.” (ICBC, 2016)
  • Thirty-three percent “of Canadians admit they have texted while stopped at a red light, despite believing it is unacceptable.” (CAA, 2016)

These are serious statistics. The obvious way to prevent the above from happening and from you obtaining a distracted driving citation and subsequent conviction in Ontario is simple: don’t use your electronic devices while driving, but also, don’t eat, read, or write, or even groom yourself by putting on makeup or brushing your hair. Refraining from these activities can help bring down the above statistics and can help make our roads safer.

What Are The Top Cybersecurity Predictions For 2019?

Cybersecurity 2019

Cybersecurity 2019

There was something of a cultural shift in the technology sector during 2018 that will undoubtedly impact 2019. Up until last year, cybersecurity issues seemed to predominately plague significant corporations and organizations. The Democratic National Committee hack fallout and Russian bots on Facebook were coupled with big-time breaches at Equifax and others that garnered headlines. Even the recent reports coming out of U.S. intelligence agencies point to enemy states such as China and Iran stealing American intellectual property.

Cyber threats ramped up in 2018 and the World Economic Forum ranked technology breaches as a top risk to economies worldwide.

“Attacks are increasing, both in prevalence and disruptive potential. Cyber breaches recorded by businesses have almost doubled in five years, from 68 per business in 2012 to 130 per business in 2017,” the Forum reported.

Consider for a moment that climate change and severe weather events such as hurricanes and tsunamis were also listed. That should put the danger in context for any business leader. And that’s why the mainstream perception about breaches has shifted significantly.

These days, small and mid-sized companies recognize that their personal information and critical data are targeted at a much higher rate than Fortune 500 outfits and national-level organizations. Ransomware has emerged as an almost routine method to extort money, and now fraud from crypto-mining is trending high. Business owners and decision-makers are prioritizing cybersecurity because the stakes are just too high. Cyber threats are likely to escalate during 2019, and these are some dire predictions.

1: Strict Data Breach Fines

Last year, regulations such as the California Consumer Privacy Act implemented harsh penalties for companies that fail to protect personal employee data. The conventional wisdom is that businesses and non-profit organizations alike have a responsibility to safeguard the information they ask of team members.

Cyber attacks that penetrated Uber, for example, reportedly resulted in the transportation organization settling out of court to the tune of $148 million as a result of a 2016 breach. Leading online companies such as Facebook and Equifax have been under fire and they both reportedly were fined a maximum penalty of £500,000 in the UK.

Currently, Google, British Airways and Facebook once again are under government scrutiny for cybersecurity failures and hefty fines could be coming. While this may not seem like a direct and discernible danger to small and mid-level outfits, think again. Although household-name organizations make headlines, everyday companies can expect to get hit with penalties for lack of cybersecurity as well. The moment a company asks employees to provide personal information, that organization becomes responsible for protecting it.

2: Rise of the Machines

The days of a rogue hacker halfway around the world infiltrating a system are expected to evolve in to (artificial intelligence) AI cyber attacks. If this sounds a lot like the sci-fi “Terminator” movie franchise, that’s not far from the truth.

Hackers are expected to deploy machines under their control to more rapidly and covertly penetrate business systems and cull valuable information. But beyond mining, these human-controlled devices will increasingly have the ability to impact the lives of everyday people.

Consider that the IoT continues to create an accessible matrix that can be manipulated. Autonomous vehicles, smart-home technology, and even friendly Alexa are being weaved into the fabric of human lives. This opens the door for hacker-driven AI to penetrate lives outside of the workplace. The necessity of cybersecurity in our personal lives is expected to grow exponentially going forward.

3: Governments Expected to Ramp Up Cyber Weapons

The mainstream media has been brushing up against the subject of enemy states attacking infrastructure such as power grids. It goes without saying that governments across the world are not sitting idly by as others hone their hacking talents.

From voting booths to water supplies, governments around the world are expected to meddle more and more in each other’s affairs. When someone loses, expect malware, ransomware and debilitating viruses to be unleashed.

While your small or mid-sized company may not be the target of a rogue state attack, it could end up being collateral damage. Don’t be taken by surprise, secure your company and personal data before the first wave hits.

4: Email Expected to Remain Top Data Breach Vehicle

Criminal hackers view email as the gift that keeps on giving. New hires tend to need time to understand the protection protocols around email usage. And, too many outfits lack adequate policies or fail to update usernames and passwords effectively. Employee email has ranked among the most vulnerable backdoors into an organization’s sensitive data and the best way to deploy ransomware.

Even though cybersecurity and IT teams warn decision-makers about the dangers of sub-par email protections, it is expected to remain a primary threat in 2019. Every day companies cannot take email security seriously enough in 2019.

5: Tougher Laws and Regulations Expected

The 2018 U.S. congressional hearings that involved Facebook, Google and others demonstrated that lawmakers recognize that cyber threats are prevalent and current regulations appear inadequate. Intellectual property and critical data are now outpacing oil regarding value.

In the U.S., states are creating more stringent laws to deal with hacking. The federal government and countries abroad are also wrestling with policies to manage cyber threats. It’s essential for small and mid-sized outfits to follow the trend and communicate with lawmakers at the local, state and federal level. The laws that come out of cybersecurity hearings are likely to impact the business community in a significant fashion.

Should Your Business Upgrade It’s Website To WordPress 5.0.2

Should You Upgrade Your WordPress Site To 5.0.2

Should You Upgrade Your WordPress Site To 5.0.2

Only a few short weeks ago, we wrote about the introduction of WordPress 5.0 in early December and discussed whether or not your company should upgrade now, never or at a later date. Our recommendation was to wait until some of the bugs had been worked out of the system and until your business has a slow time of year to ramp up to the new way of posting with this new update. It seems that we were on the right track since WordPress has just made WordPress 5.0.2 available to the public, a maintenance release that addresses 73 known bugs associated with WordPress 5.0.

What is WordPress 5.0.2?

WordPress 5.0.2 seeks to address some of the problems that users have been having with the new WordPress 5.0 release. Most of these issues are associated with the block editor feature. Unlike previous WordPress releases, 5.0 is a WYSIWYG editor and requires no HTML or coding knowledge. According to WordPress, the new maintenance release increases the posting speed by 330 percent (for a post with 200 blocks). It also includes 45 block editor improvements, fixes 17 known block editor bugs and addresses some internationalization issues. You can view a complete list of the problems discussed with 5.0.2 on the WordPress website.

Should we upgrade to WordPress 5.0.2?

Our original opinion on whether to upgrade to WordPress 5.0 now or wait still stands. We still feel it’s prudent to expect since many businesses are otherwise occupied with end-of-the-year tasks in December and January and a radical revamping like 5.0 is likely to have a few growing pains. Also, 5.0 uses Gutenburg, which is not compatible with many WordPress plug-ins. As with any upgrade, we also recommend backing up all of your WordPress files before you download WordPress 5.0.

However, if you have already upgraded to WordPress 5.0, it is a good idea to go ahead and download the 5.0.2 maintenance release. This is likely to make your WordPress experience less troublesome and less time-consuming. To upgrade to WordPress 5.0.2, download WordPress 5.0.2 or go to your WordPress dashboard, go to Updates and click Update Now. In fact, you may already have the new maintenance release. Websites that support automatic background updates have already started to update automatically.

To learn more about using WordPress, deciding whether WordPress 5.0.2 is the right choice for you and your company, and to learn ways to make your website more efficient for both you and your readers, contact Ulistic.com or call us at (enter contact info). We can also help you with backing up your data before your upgrade.

South Carolina Insurers Must Protect Client Data

South Carolina Insurance

South Carolina Insurance

In April of 2018, South Carolina became the first state in the nation to require insurance companies to establish data security standards to protect consumers from the consequences of cyber attacks. The legislation named the Insurance Data Security Act, also put requirements in place for how insurance companies must investigate cybersecurity attacks. South Carolina insurance carriers have until July of 2019 to fully implement the Insurance Data Security Act. The law officially went into effect on January 1, 2019.

State legislators drafted and passed this new law in response to a series of recent attacks in the insurance industry that exposed the private demographic and financial data of millions of Americans. The 2015 attack on the insurance giant Anthem appears to be the most significant catalyst for initiating and enforcing the new regulations.

What the Insurance Data Security Act Means for South Carolina Insurers

Under the provisions of the new security act, insurance companies, agents, and all other licensed entities that conduct business in South Carolina must establish a comprehensive security program and put it in writing by July 1, 2019. As quoted from state legislation, the new security program must “commensurate with the size and complexity of the licensee, the nature and scope of the licensee’s activities, including the use of third-party service providers, and the sensitivity of the nonpublic information” within the control, possession, or use of the licensee.

Additionally, South Carolina insurers must base the company’s cybersecurity program on individual assessment of risk. Based on these results, the licensee must design an information security risk that reduces these risks as much as possible with the stated goal to completely eliminate the risks. It is the responsibility of each insurance licensee to determine appropriate measures related to the following:

  • Access controls
  • Cybersecurity event audit trails
  • Data
  • Device
  • Encryption of nonpublic information at rest on removable data and mobile devices
  • Encryption of nonpublic information in transit
  • Multi-factor authentication
  • Personnel inventories and mapping
  • Physical access restrictions
  • Routine system and testing monitoring
  • Secure application development practices
  • Secure disposal of all nonpublic information
  • Systems upgrades

This is a significant undertaking for insurance companies and agents in South Carolina to achieve in the next six months. Many will find that they need to reach out to information technology specialists to help them come into compliance in the time required under state law.

Requirements for Insurance Company Director Boards

The Insurance Data Security Act not only imposes what insurers must do to implement a plan to safeguard consumer privacy, but it also dictates required actions for people with specific roles within the company as well. For example, the board of directors of each insurance company in South Carolina are personally responsible for supervising the development and implementation of the new cybersecurity program. Supervising duties of the board also include issuing a directive to senior management to produce an annual written report that contains the following information:

  • A high-level overview of the cybersecurity program status and whether each agent or licensee appears to be in full compliance with the new program.
  • All material matters to include individual cybersecurity events and the response to each, risk assessments, risk management decisions and controls, service provider arrangements with third parties, and results of all testing. Most importantly, senior management must recommend specific changes to the program in response to any ongoing issues they have observed that have posed a challenge to compliance.

It is crucial to the success of the new cybersecurity program that board members and senior officials with South Carolina insurance companies take their role seriously. This is the only way to ensure successful implementation of the program as well as address any early compliance concerns.

Specific Licensee Requirements under the Insurance Data Security Act

The act also spells out highly specific responsibilities for insurance licensees. For example, every licensee in the state should have produced a written document outlining a plan on how to respond to and recover from a cyber attack. This covers attacks that threaten the security of any nonpublic information that the licensee retains on his or her person or within the company’s computer information systems. These plans were due by January 1, 2019, and must contain all of the following information:

  • The process of internal response to a cyber attack
  • Specific goals for the prevention and response plan
  • An outline of the specific responsibilities and roles of each person who has the authority to make cybersecurity decisions
  • Internal and external communication and sharing of information
  • Requirements for remediation
  • Detailed documentation of any recent cyber attacks, including each step of the response
  • Any revisions made to the plan since its original creation date or any anticipated future changes

The new law gives licensees until July 1, 2020, to create and implement a cybersecurity program with a third-party service provider. The expectation is for licensees to choose the provider using due diligence. It is the responsibility of licensees to ensure that the new service provider possesses the ability to offer administrative, physical, and technical support as required under the provisions of the cybersecurity act. This is necessary to ensure that third-party service providers protect computer systems as well as all nonpublic customer information.

Finally, the licensee must regularly monitor the work of the service provider to ensure compliance. Upon discovery of any issues, the licensee must initiate adjustments to the agreement between the two companies. The new law makes it incumbent upon every insurer in South Carolina to provide an annual compliance certification as well.

Protocol for the Investigation, Response, and Disclosure of Cybersecurity Attacks

Insurance companies, along with agents and licensees, now have only three business days after a discovery to investigate and report the events surrounding a cyber attack or event. The definition of a cyber event includes any action that resulted in an unauthorized person gaining access to nonpublic information. The purpose of the cyber attack is to disrupt computer systems to make it possible to obtain and misuse the information stored inside of them. The definition does not include any data that a cybercriminal destroyed or returned.

The Insurance Data Security Act includes a somewhat vague definition for what qualifies as nonpublic information. For example, protected data includes anything that usually receives protection under existing laws for data breach notification. However, it does not define the specific types of data.

Other information protected under this new act include any business data that demonstrates proof of unlawful tampering by an insurance licensee. This consists of any unauthorized disclosure of information, use, or access that demonstrates the licensee attempted to manipulate data for the benefit of the insurance business.

Once a licensee has determined that a legitimate cyber event occurred, it is up to him or her to initiate an immediate investigation. The investigation must include each of the following elements:

  • Determining whether the incident meets the legal definition of cyber event
  • Researching the facts regarding the event
  • Determining whether a cybercriminal obtained any nonpublic data and identifying the customers impacted
  • Promptly restoring any vulnerabilities that caused the breach of data

Both insurance licensees and third-party service providers must retain a record of all cyber events for a minimum of five years. They must also produce the record promptly when any authorized party requests to see it.

About disclosure of cyber events, a licensee must notify the Director of the Department of Insurance within 72 hours of resolving the issue. This requirement covers all insurance businesses licensed in South Carolina. Additionally, the act requires licensees to notify another government agencies or insurance supervisory boards if the data breach involved more than 250 state residents or a reasonable likelihood of widespread harm exists. The notification to the government agency or insurance supervisory board should include the following information at a minimum:

  • The date and specific details of the cyber event
  • The methods used to discover the issue
  • The types of nonpublic data compromised
  • Whether the licensee notified law enforcement, and if so, the data this occurred
  • The intended steps of remediation
  • A valid copy of the most recent privacy policy of the licensee
  • The specific plan for investigation and notification of consumers

Other States Expect to Follow Suit

South Carolina has taken a significant step toward consumer protection by implementing this law as of January 1, 2019. Several other state legislatures are currently considering the same or a similar act, so it should come as no surprise to consumers and those in the insurance industry to see widespread adoption in the future. Even industries outside of insurance may look to the act to determine its usefulness when adapted to that specific industry.

Canadian Data Breaches: Changes to the Laws Occurred on November 1st, 2018

Canadian Data Breach

Many business owners don’t realize that new laws are in place surrounding data breaches. On November 1st, 2018, these new laws went into effect for all Canadian business owners. These laws will affect thousands of businesses now, so it’s essential for all business owners to be aware of the changes and be prepared to comply. If these laws are not followed, businesses could be fined up to $100,000.

Breaches Must Be Reported to the Government

If you collect customer data such as banking information, legal or health info or such things as SIN’s, and your database is breached, you must report this to the government. The new law outlines reportable breaches like those that create “a real risk of significant harm to individuals.”

How Will These Changes Impact My Company?

You must report a breach like this to the Office of the Privacy Commissioner of Canada, along with the individuals who were affected. All those whose private legal, health or financial information was lost must be informed. They need to know precisely what information was lost, how many records were impacted and what caused the breach.

Companies must also show that they have taken the appropriate measures to prevent future breaches. If the prescribed steps are not followed correctly, the company can be heavily fined. In many cases, data breaches also damage the company’s reputation and affect consumer trust.

What Are The Specific Laws Changing?

This new law governing data breaches is not a stand-alone law. It’s an amendment to PIPEDA, the Canadian Personal Information and Electronic Documents Act.  For a summary of Canada’s privacy laws, please visit here. The specific laws related to digital information can be found here. It’s important to understand and comply with both.

Many experts have pointed out that the wording in PIPEDA does leave room for interpretation. It covers situations where “…it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.” This wording is somewhat vague and may be interpreted in various ways by the Canadian courts.

Steps to Follow If There’s A Breach

Below, is a brief outline of the steps to follow if you experience a breach:

  • The nature of the breach and what specific data was stolen
  • What your organization has done to reduce risk and harm
  • How those affected can protect themselves and reduce their risk
  • Information about the organization’s contact information
  • The procedure for filing complaints

How Did the Breach Occur?

Once the source of the breach has been identified, the vulnerabilities must be repaired. Some breaches occur due to employee carelessness. Perhaps an employee clicked on a link in a phishing email. With so many workers now using their own devices, this opens the door to breaches if a device is lost or stolen. The way to handle this issue is with a Remote Management and Monitoring (RMM) program. This can be set up and managed by {company}. This offers multiple benefits including:

  • Compliance to regulations
  • Remote wipe if a device is lost or stolen
  • Find my device technology
  • Application management such as updates and patches

{company} can monitor and manage all your technology on a 24/7 basis.  With Managed IT Services you can prevent downtime and keep your technology running smoothly. We can notify you of areas where we believe your database might be at risk and suggest ways to repair this vulnerability.

Other Ways to Mitigate Vulnerabilities

Having data stored and managed in the cloud is a good method of decreasing your company’s liabilities. The cloud offers many benefits including better security, scalability, plus it’s flexible and allows your workforce to be mobile.

How To Protect Your Data From Intrusion

With hackers around the world now scaling up their attacks, businesses must be thoroughly prepared. Simple firewalls and antivirus software are no longer enough. Most security experts recommend a layered approach to security. Follow these guidelines to protect your data from future data breaches:

  • Policies-Create and enforce security policies for your company.
  • People-Make sure your employees know what a phishing email looks like. Most workers need periodic regular training in this area, so they don’t get careless.
  • Technology-Make sure you have the right technologies in place to prevent a cyber-attack from occurring in the first place.

In Conclusion

Canadians want to know how their personal information is being used. And they have a right to know what information is being collected and how it’s being used.  In the future, these laws will most likely get even more strict for several reasons. Data breaches cost companies around the world billions of dollars each year. Cyber thieves are becoming more and more clever. They have fine-tuned their approach and figured out how to get people to open phishing emails. They can mimic the look of major companies like Spotify, Paypal, Apple and Microsoft.  Ransomware scams have been highly successful and hackers are often able to earn thousands of dollars per day by taking over a company’s database and then threatening to destroy all the information unless a ransom is paid.

What Can You Do?

There are numerous ways to protect your data from a breach. {company} can help you assess your current security protocols and create stronger measures. We can also advise you on how to proceed if a data breach has already occurred. It’s essential to determine exactly what happened and notify those affected along with Canadian authorities as quickly as possible. By waiting, you risk hefty fines and your company’s reputation could be ruined.

Things like Proactive Monitoring can help. We will continually scan and track the stability and security of your IT system for maximum uptime identifying any security issues.

The 2019 Cyber Security Guide For Financial Professionals

The 2019 Cyber Security Guide For Financial Professionals

The 2019 Cyber Security Guide For Financial Professionals

The securities industry has been as vulnerable to cyber attacks in 2018 as any other industry. According to the SEC’s Enforcement Division newly created Cyber Unit (formed in 2017 to enhance the ability of the Commission to identify and investigate all cyber-related threats to firms), 20 actionable cases were brought forward in fiscal year (FY) 2018. 225 open investigations are also being conducted by members of the Cyber Unit at the close of FY 2018.

Firms have an affirmative duty to establish policies and procedures designed to detect and deter cyber-threats. These include both the Safeguards Rule and the Identity Theft Red Flags Rule. Failure to put in place necessary protections designed to safeguard customer information and prevent fraud may result in enforcement action by the SEC.

SEC Cyber Security Enforcement Actions

This was the case with an enforcement action taken against a Des Moines, IA-based firm fined $1 million for its failure to put in place proper cybersecurity policies and procedures. The action came as a result of a cyber intrusion that fraudulently reset customer passwords. This allowed the cyber thieves access to more than 5,600 of the firm’s accounts, which allowed new profiles to be created and specific access to private documents of three customer accounts. The failure to have in place proper procedures in keeping with regulatory requirements made what was preventable inevitable.

As the old year ends and a new one begins, what are some of the cyber threats facing investment professionals? In keeping with mandated requirements from the SEC, FINRA, and state securities commissions, what should be done to keep ahead of the growing potential of a cyber attack or unwanted intrusion that threatens customer safety, privacy, and the integrity of U.S. financial markets?

The State of Cyber Security in 2018

A recently discovered data breach of Marriott International’s Starwood Hotel guest reservation database comprised the information of nearly 500 million customers. A Federal Trade Commission (FTC) consumer advisory released on December 4, 2018, announced that the breach, which began in 2014, impacts all hotel registrations made up to September 10, 2018.

Information that hackers were able to access includes customer names, addresses, phone numbers, email addresses, passport numbers, dates of birth, and the gender of the reservationist. Additionally, any Starwood loyalty program account information and reservation information entered was taken and for some customers, payment information (and possible expiration dates).

The compromise of Starwood customer information by hackers is just the tip of a very tall iceberg of incidents that took place in the U.S. and across the globe. Cybersecurity issues touched nearly every industry sector and business size, from Texas-based Jason’s Deli to social media giant Facebook. State-sponsored attacks have also been exposed in 2018, validating concerns about the integrity of the U.S. election process and the continuing influence of bad-faith actors such as Iran, Russian, and North Korea.

Those issues affecting business worldwide are those that affect financial professionals and the securities industry. Efforts must be taken to tighten up required controls that detect and deter cyber attacks. Paying lip service to these issues will result in the loss of customer confidence as further attacks expose vulnerabilities.

Cyber Security Issues for 2019 Affecting Financial Professionals

There are at least four specific cybersecurity issues that financial professionals should be aware of heading into 2019:

  • Testing a firm’s cybersecurity policies and procedures to ensure
  • Leveraging technology to police technology
  • The impact of artificial intelligence by hackers to access client accounts and information
  • The growing influence of the “Dark Web” and the exposure of personal and private information

These issues may be of particular concern for financial professionals looking to maintain strong customer relationships. Awareness of the potential for attack must be met with definitive action to strengthen systems and hold back minor and major intrusions that could have a long-term effect on business and the confidence the investing public has in the U.S. financial system.

Establishing and Testing an Investment Firm’s Cyber Security Policies and Procedures

The SEC noted in its enforcement actions taken against firms in 2018 that failed to protect client data that the failure stemmed from the lack of sufficient cybersecurity policies and procedures. Such policies and procedures are only one part of the solution to building robust IT systems capable of withstanding dedicated cyber attacks.

In addition to well-documented policies and procedures specifically tailored to the financial systems, firms and financial professionals must also work with their IT teams to test their ability to detect, address, and defeat cyber attacks. The loss of customer information to a data breach through a system vulnerability that could have been prevented hurts not only the entity breached but the industry as a whole.

As firms increasingly rely on technology to conduct business, greater reliance must be placed on constant vigilance. The mentality cannot be that since an attack has not occurred, there is no problem; it must be that an attack may happen at any time.

Using Technology to Defeat Technology

Cybersecurity issues cannot be regulated away. The establishment of policies and procedures, as discussed, is one of the ways to identify the severity of these attacks and their potential impact on business. Working on using technology to prevent technology from causing cyber attacks and other unwanted intrusions is the next level for financial professions.

It stands to reason that these attacks are the result of machines finding ways to invade other devices. This may be to spread viruses that cripple or disable a recipient system for a period of time, or to disrupt business operations by denying access to customers, or to set in motion ransomware or other types of malware for the purpose of extortion. Policies and procedures establish recognition of the potential for harm but technology sets in place the necessary firewalls and disaster recovery processes for business to continue operating (with little to no disruption).

Artificial Intelligence

Machines, currently through the aid of those with ill-intent, lead the attack on financial systems, threatening the privacy of customer data. Artificial intelligence (AI) or the ability of machines to develop routines and learning processes that make devices less dependent on human input is also growing as a potential threat.

Facebook confronted this issue in the summer of 2018 when its Facebook AI Research Lab (FAIR) was forced to shut down a project involving the use of AI known as chatbots. Chatbots are a type of AI where programs that are automated to complete a specific task can communicate with each other to make the routine more efficient. The FAIR project attempted to add a negotiation element between the chatbots, which to the horror of researchers, resulted in the AI developing its own language at a rate that was faster than what humans could anticipate and control.

The growing presence of AI in technology and the use of robots, specifically chatbots, to complete basic tasks may very well be the way of the future. Its existence, however, should raise legitimate concerns and warrant additional protections and regulatory action to ensure that the results of an accidental experience (like the outcome of the FAIR project) does not set in motion a sponsored attack that could have the potential of taking down the U.S. financial system in 2019 (and beyond).

Dark Web

The dark web, which refers to encrypted information that is unavailable through traditional internet search engines. A part of the deep web, it is a facility for transactions in private data (most of which is financial in nature) that has been stolen and may be purchased with cryptocurrency such as bitcoins. eCommerce on the dark web has grown exponentially – the Economist reported that between 2012 and 2016 the sale of illegal drugs through the darknet increased from $12 – $17 million to $120 – $180 million in four short years.

Data breaches that have occurred with all too regular frequency in 2018 have produced information that has found its way to the dark web. The marketplace for compromised identity information (i.e., social security number, date of birth, payment information, etc.) is growing at a rate comparable to what the Economist reported for illicit drug sales. Financial professionals, particularly in the age of anti-money laundering (AML) programs required to prevent terrorist financing and other illegal financial activities, will be challenged to verify the legitimacy of customer information and protect against the introduction of dark web data used to illegally open accounts or engage in financial transactions.

These are only a few of the cybersecurity issues facing financial professionals entering 2019. Greater awareness and vigilance is required of everyone within the industry to get in front of the growing influence of technology on our lives. Protecting the integrity of financial systems is more than good business. It may very well be what prevents a global financial disaster from happening, the scale for which would be unprecedented.

Have You Heard Of This Scam Targeting Amazon Shoppers?

Amazon Scam

Amazon Scam

Amazon is a gigantic player in online sales. It’s estimated that the Seattle-based online e-commerce site will be responsible for roughly 50% of all digital sales during the 2018 holiday season, one of the busiest shopping times of the year in the United States. In other words, one out of every two people shopping during the holiday season will buy something from Amazon.

But Amazon’s very ubiquity has made it a tempting target for cybercriminals and thieves. It’s also widely trusted by consumers, who benefit from the online retailer’s wide choice and speedy deliveries. As a result of the many sales made through Amazon and the trust it has engendered among its customers, scam artists are targeting Amazon shoppers.

A Scam That Sends Fake E-Mail

The most recent scam sends an e-mail to an Amazon shopper telling them that their password needs a reset. One of the most notable elements of the scam is that the e-mail looks very official, using Amazon’s logo. It tells the targeted Amazon shopper to enter their Amazon user ID and new password directly from the e-mail.

But it isn’t Amazon that receives the new password. It’s the cyberthieves who set up and sent the e-mail. Once the target enters the information in response to the scam e-mail, the cyberthieves have the information to their Amazon account.

The thieves often set up Amazon gift cards for themselves, so that they have cash to be spent on Amazon. The gift cards are sent to their e-mail accounts, so they can use it before any theft is noticed. If the target customer has a credit card or debit card associated with their Amazon account, as most people do, the scam artists may shop until the cards are maxed out.

There are several variants to the scam. Sometimes, the cyberthieves set up the e-mail to say that new shipping information is needed or that there is a problem with an existing order.

But in all cases, a crucial element is the same. The e-mail looks official, and asks that the customer’s ID and password be entered directly from the e-mail. Entering it from the e-mail is what allows the cybercriminals to capture the user’s information and use it for themselves.

What Amazon Customers Should Do

Amazon customers need to be aware of the scam. They should never enter any of their account information in response to an e-mail about a problem with an Amazon order. For that matter, they should never enter any account information, of any type, in response to any e-mail, including debit card or credit card information.

If you get an e-mail like this, log out of your e-mail and log in to your Amazon account directly from the company’s web page, www.amazon.com. That page always has up-to-date information on your account and your orders. Customers will be able to see if there is any concern with their orders or shipping address.

If customers do need to change their log-in information, they should always do it directly on the Amazon site, not in response to an e-mail.

Finally, the Amazon site has a “take action” section on their website giving direct information on how to handle suspicious e-mails and scams by cyberthieves purporting to be Amazon. To access the section, click here.

The latest scam is easy to protect against. Customers should never respond to e-mails that look as if they’re from Amazon but always go directly to the Amazon website.

5 Extremely Important Facts Every Small Business Owner Needs To Know About Managed IT Services

5 Extremely Important Facts Every Small Business Owner Needs To Know About Managed IT Services

5 Extremely Important Facts Every Small Business Owner Needs To Know About Managed IT Services

As small business owners rely on IT more than ever before, a growing number are turning to managed service providers to obtain the high-tech IT infrastructure, software and assistance they need to be successful. At the same time, there are many entrepreneurs and small business owners who don’t fully understand how managed IT services work and how they can propel a business forward. Following are five extremely important facts about managed IT services that will enable one to make wise decisions regarding when and how to use them.

Managed IT Services Save Time

Most small businesses can’t afford to hire a full-time IT technician. This means that, more often than not, regular employees must deal with IT problems. Because the average employee is most likely not an expert IT technician, it could take hours or even days to resolve serious IT issues. What is more, it is all too easy for an employee to make a mistake that results in downtime, a security breach or some other serious issue.

Working with a managed service provider saves time because MSP companies can prevent many IT issues in the first place. Companies offering managed IT services use only the best equipment and this equipment is monitored by experts to ensure that everything is working as it should at all times. In fact, most managed service providers offer a 99.9% uptime guarantee. If something does go wrong, a small business owner can count on immediate, expert assistance to get things running again. This frees staff members to handle other essential jobs such as sales, advertising and customer service, enabling your business to grow as it should.

Managed IT Services Save Money

Can working with a third-party IT service provider actually save money? A lot depends on which IT service provider is used and what services are purchased; however, for the most part, companies that use an MSP save a considerable amount of money. In fact, recent statistics indicate that small business owners can reduce IT costs by up to 40% by working with a managed service provider.

There are several reasons why managed IT service providers are so cost-efficient:

  • Small businesses that use an MSP don’t need to invest in their own equipment and then update the equipment periodically as the IT service provider handles this expense.
  • Small business owners who work with an MSP don’t have to take on one or more extra employees; this saves money that would have otherwise been spent on salaries and benefits.
  • IT service providers offer scaled services, making it possible for business owners to adjust IT spending by the company’s needs and budget.

Managed IT Services Boost a Business’ Security

Many small business owners have discovered that, contrary to popular misconception, they are prime targets for cybercriminals. Because small businesses are less likely to have strong security, hackers go after them regularly to obtain valuable customer and business data or to hold files hostage in exchange for a ransom.

Thankfully, small businesses can now obtain top of the line security at a very reasonable price by working with a third-party IT service provider. IT service providers use up to date security programs and procedures to protect company files from unauthorized intrusion. Furthermore, many offer employee training that can prevent common cyber crimes such as phishing and malware attacks.

Getting Help from the Experts

IT technology is continually improving. Hardware and software that was up to snuff a few years ago are now outdated. Naturally, most small business owners don’t have the time to keep up with technology changes that affect their industry. However, IT service providers do have the time and ability to not only stay abreast of recent developments but also invest in the newest equipment to provide the best possible service to their clients.

Additionally, IT service providers know how to handle any IT-related challenge you may face. If you experience downtime, are having trouble accessing your files or need help creating a secure internal communications plan, your IT service provider is available to provide immediate assistance. Many MSPs even offer 24/7 assistance to ensure that you get the help you need, when you need it.

Taking Advantage of Customized Service

There are many IT service providers for small business owners to pick from, making it possible for just about anyone to find the company that best suits his or her business’ needs and budget. In fact, there are even managed service providers that specialize in offering IT services to niche industries such as healthcare.

Managed service providers also offer flexible service options. A business owner can:

  • Use a managed service provider on a one-time basis
  • Hire a managed service provider to handle periodic tasks such as providing online customer service during holiday seasons and/or training employees in IT security and management
  • Delegate certain IT jobs to an IT service provider while managing others in-house
  • Have an IT service provider handle all IT-related work for the company

Managed service providers are well worth the cost. They have much to offer any company and small business owners who work with MSPs often find that they can save money, increase efficiency levels and serve customers better than ever before. Any small business owner who wants to boost his or her business may want to seriously consider the benefits of teaming up with an IT service provider and then do some research to see which exact managed service provider is the best fit for the business.