5 Steps CPAs Can Take to Fight Hackers: Accountants Play an Essential Role in Helping Organizations Develop and Implement Strategies to Protect Computer Networks and Data
[ILLUSTRATION OMITTED] In today's world, software is written and released much more quickly than ever before, so the risk of security holes is naturally greater. Unless you've been living under a rock--or in the town of Bedrock--you are no doubt aware of the growing threat posed by cybercriminal activity. As a CPA, however, you may not know the role you can play in bolstering your organization's cybersecurity efforts. Whether in public accounting or business and industry, CPAs are key stakeholders in cybersecurity. Public accountants, of course, are responsible for safeguarding their clients' most sensitive financial data. Management accountants such as CFOs often oversee risk management, under which cybersecurity typically falls. And in organizations of all types, CPAs play crucial roles in developing budgets that help determine how cybersecurity measures are implemented. Improving cybersecurity starts with accepting that your organization is not immune from cybercrime and educating yourself on the biggest threats to your computer networks and data. You can then begin taking concrete steps to shore up your cybersecurity defenses. This article looks at the five biggest cybersecurity risks CPAs and their organizations face, then offers a five-step battle plan for the fight against cybercriminals. 5 TOP CYBERSECURITY RISKS FOR CPAs Ignorance You might think that most business leaders are well-aware of the threat posed by cybercriminals. After all, high-profile breaches at Sony, Target, and innumerable other organizations have generated a flood of media coverage and social media chatter. Despite that, far too many business professionals still don't grasp the size and severity of the threat. One of the toughest mindsets to overcome is one that believes the organization either has nothing worth stealing or is too small to be targeted--or both. Wrong. Everyone is at risk. Still think you're too small to be a target? Hackers usually target anyone with a vulnerability in their IT systems. And when they do pick a target, hackers sometimes choose small organizations solely to gain access to other organizations. The bottom line is that you don't know what you don't know. If you don't realize you are at risk, you are not likely to take steps to identify and subsequently mitigate the risk. Passwords Passwords continue to be a major security risk for organizations. The Verizon RISK team's 2013 Data Breach Investigations Report found that 76% of corporate network breaches directly resulted from lost or stolen credentials. Weak, easily hacked passwords are also a concern. SlashData's annual "Worst Passwords" report, which is compiled from millions of leaked passwords, has found that since 2011 the most frequently used passwords are "123456" and "password." And not only do people use simple, weak passwords, but they also often use the same one for everything, further magnifying the risk A breach exposing passwords on a social networking site might seem unrelated to your business. But what if an employee's password was exposed in the breach and his or her place of employment or bank was identified on a profile page? The compromised password could be used to attempt to log in to other systems (see the sidebar, "An Approach to Strong Passwords"). The impact of weak and repeated passwords is magnified now that so many cloud systems are in use, because the bad guys no longer have to be inside the network to use discovered passwords. Add in what is now standard remote access to systems by vendors, and the problem again grows larger. Several major breaches have involved compromised vendor credentials. As hard as it is to believe, Sony actually had a folder called "Password" on its breached network. It's hard to imagine how this could happen in an organization so large, but during our IT security audit work, we routinely see not only passwords written down in all kinds of places, but also unsecured password documents stored on employee computers and mobile devices. …