Cybersecurity for CPAs: Don't get complacent

This month's look at the cybersecurity frontlines demonstrates how the new remote work world has unlocked many possibilities, but also many risks. 

When the pandemic first hit, accounting firms — like many other businesses — were forced to adjust to remote work in order to survive. This led to many firms seeing increased risk due to the large amount of sensitive information they held, which people were now working with in their home office environments. Since cybercriminals go where the data is, measures were needed to protect staff from attacks, especially phishing attempts. 

With a hybrid work environment still alive and well post-pandemic, this accounting firm still believes in proactive measures in its fight against cybersecurity risks. To battle the ever-evolving threats that are present and balance a hybrid work environment, a three-prong defense was created. This defense is anchored by stressing education to all employees. 

Like a lot of other firms, many employees have returned to the office at one Chicago-based tax and accounting solutions firm. Although a lot of work is now being done in one location, this does not mean risk has been eliminated, given the myriad personal devices still in employees' home offices. While the firm has stressed the importance of cybersecurity at home, it did not want people getting complacent at the office.

Education and awareness campaigns that began with the lockdowns continued, using multiple tools, videos and resources as proactive ways to train employees on how to avoid falling prey to cyberattacks. Meanwhile, the firm also leveraged IT systems and software such as multifactor authentication and antivirus programs that include EDR as an extra step. Then, if the worst happened and even those measures failed, the firm invested in insurance as a final safety net. Most of the time, third-party IT firms' insurance covers the firm itself, not the financial loss of its clients resulting from an attack or incident, which underscored the importance of the firm getting its own coverage. 

This story of preparation and proactive thinking comes from digital-first  professional liability insurance provider Embroker, which sees a need for continuing educational efforts. Cybercriminals and risk are constantly evolving, so cybersecurity strategies need to transform with them.