Cybersecurity for CPAs: Don't leave the door open

What good is a door you don't close? What's the point of going through all the trouble of having a secure space if someone can just walk right in? This month's Cybersecurity for CPAs involves a company that, effectively, left the door open. 

The company needed to make some changes to the system that involved taking down its security firewalls for a little while. There's a wide variety of reasons why a company might do this: software patching or updates, configuration changes, hardware upgrades, data migrations and more. Regardless of the reason, though, the result was that the thing meant to keep the company's systems safe from the wider Internet was taken down so the tech workers could do their jobs. Unfortunately, once they were done, they neglected to put them back up again. The company was exposed and had no idea about its vulnerable position. It was only a matter of time before Russian cybercriminals swept into the network and pilfered sensitive information like social security numbers, birth dates–the ingredients for identity theft. As is their wont, the attackers demanded the company pay a ransom for the data. This was bad enough, but making it worse was that the company didn't have enough money to fully pay the ransom, and they didn't have insurance coverage to help compensate. 

The company, so far, has spent at least $100,000 to try and recover at least some of the data and blunt the negative impact of the attack, but it's been too little too late. The company's ability to survive is currently in question because customers didn't really trust it with their information. 

This real life tale was brought to you by accounting-focused cloud services provider Rightworks, which offers cybersecurity solutions among their many service and product offerings. The story underscores the importance of remembering that neglecting even the most basic of cybersecurity tasks, like putting the firewall back up, can have outsized consequences. Firms and their clients (like the one detailed above) need to make sure they follow every step to secure their own data and that of their clients. This can be done through training as well as through solutions that offer enterprise-level data protection.