What are the most common cybersecurity threats faced by accounting firms? Part 2

Click here to read Part 1 of this article:
What are the most common cybersecurity threats faced by accounting firms?

Insider threats

Some of the most significant risks originate from within organizations, whether through intentional fraud, negligence, or lack of security awareness. This is especially true and impactful for organizations or departments working closely with money or sensitive information. Insider threats include risks from current employees as well as former employees who may retain system access.
How to mitigate or avoid insider threats:

• Access control: Operate on a need-to-know basis. This might be hard to balance because the more people know their environment, the better they can adapt to it, but it also increases risks in case of a breach. Limit access to sensitive data based on role-based permissions and regularly audit the justification for access. In our projects, we have a concept called “continued business justification” – the very same applies to access to sensitive information.
• Employee monitoring: Use behaviour analytics tools to detect suspicious activity. This can however, easily come off as being untrustworthy with your employees, and of course everyone has a right to privacy up to and above the level of which local laws provide. As with access control, balancing is the key here.
• Security training: Regular trainings are not a requirement to meet an external standard or pass an audit – by now most people would agree they are a necessity. Educate employees on safe cybersecurity
• Strict offboarding procedures: Immediately revoke system access for departing employees. This is especially important in todays extremely fast changing technological environment, where it takes quite literally minutes to subscribe to a new service over the internet. It is therefore extremely important to keep track of newly implemented systems and services, even if it somewhat impacts implementation timelines.
• Whistleblower policies: Encourage employees to report suspicious activity. Process Solutions has a whistleblower policy and true anonym access for the employees to it.

Data breaches and weak authentication

Everyone must have run into not being able to register to a service right away, because their initial password did not meet requirements. In our previous article, we mentioned Multi-Factor Authentication, as a minor inconvenience compared to the benefits. Strong password requirements, password renewal policies might annoy users a little, but they are worth the benefit. Weak passwords and lack of proper authentication measures leave firms vulnerable to unauthorized access and data breaches. Multi-factor authentication and strong password policies are crucial defences against these threats.
How to mitigate or avoid data breaches:

• Strong Password Policies: Enforce complex password requirements and regular updates.
• Multi-Factor Authentication: Implement MFA for all critical systems.
• Data Encryption: Encrypt sensitive data both in transit and at rest.
• Access Logging: Continuously monitor and log access attempts.
• Security Audits: Conduct regular security assessments and penetration tests.

Unsecured Remote Work Environments

With the shift to remote and hybrid work models, unsecured home networks and devices have become a significant vulnerability. At Process Solutions we have our “Work from Anywhere” program for completely remote employment, as well as regular home office opportunities for employees. Being able to use company platforms and applications from virtually any network rather than our own “office” network poses a whole new set of challenges. Many of us have experienced the implications during the first days of COVID lockdowns back in 2020. Firms must ensure secure connections and implement proper security measures for remote workers.

How to secure remote work environments:

• VPN usage: VPN is a Virtual Private Network which your employees can, and should connect to if you implement one. We strongly recommend doing it and of course, PS has its own. Require employees to use a corporate VPN for secure remote access.
• Device security: Provide company-managed devices with security software pre-installed and remote management possibilities – like pushing updates to company-owned devices.
• Zero trust architecture: Implement zero trust security models where verification is needed for every access request. Make sure to use this sparingly if and when it is really required – consult a cybersecurity expert if you aren’t sure. While this provides the most security, users can get very annoyed with the continuous login requests and it may even impact efficiency, at the cost of maximum security.
• Endpoint management: Use mobile device management (MDM) solutions to control access.

Supply chain and third-party risks

Attacks targeting third-party software or services used by accounting firms can provide attackers with a backdoor into systems. Or even, attack targeting third-party providers, such as an accounting firm, to get to a “main” target can be a serious threat if you are not working with vigilant service providers when it comes to outsourcing. Managing vendor risks and ensuring third-party compliance is essential.
How to mitigate third-party risks:

• Vendor risk assessments: Conduct cybersecurity evaluations before partnering with vendors. This may require using specialist cybersecurity firms, depending on the type of product or service you are sourcing. We at PS often receive preliminary assessment forms even during proposals, and require them ourselves from our vendors.
• Contractual security requirements: Include cybersecurity obligations in contracts with vendors. In fact, we recommend audits in case the service or product includes sensitive data. We ourselves have been subject to, and passed many security audits by our customers, which of course we are happy to cooperate in.
• Software Patching: Ensure third-party software is regularly updated to fix vulnerabilities.
• Network Segmentation: Isolate third-party integrations from core systems. In today’s interconnected world this is getting easy to avoid segmentation requirements due to quicker implementation, but it rarely worths the risk. We for example have extensive experience with integration with off-network applications, and in our experience, if the initial design considers network segmentation, integration is not that much slower, but much more secure.
• Access controls: Limit vendor access to only necessary systems and conduct regular audits to assess whether the previously mentioned “continuous business justification” still applies.

Emerging threats: Deepfakes and disinformation

A targeted attack from a more sophisticated attacker can use public recordings of your CEO to create a video or even use their style of speech to mislead employees. Disinformation campaigns and deepfake technology are emerging as top global threats. These sophisticated attacks aim to deceive the target audience, potentially disrupting business operations and stealing customer information.
How to mitigate deepfake and disinformation risks:

• Employee awareness: Train staff to recognize deepfake videos, emails, and fraudulent communications.
• Verification processes: Implement multi-step verification for critical communications.
• Digital forensics tools: Kind-of like fighting fire with fire: use AI-powered tools to detect deepfake media.
• Media literacy training: Educate employees on verifying sources before sharing information.
• Social media monitoring: Monitor online platforms for misinformation targeting the firm.

Conclusion

To mitigate these cybersecurity risks and prepare for the many threats faced by modern companies, firms should implement comprehensive security measures, including employee training, advanced endpoint protection, secure cloud solutions, and proactive threat monitoring. Staying informed about evolving threats and maintaining a culture of security awareness is crucial for protecting sensitive financial data and maintaining client trust.

If internal cybersecurity expertise is lacking, engaging an external cybersecurity firm is highly recommended to enhance protection and resilience against cyber threats.

 

Relating PS Blog posts:

What are the most common cybersecurity threats faced by accounting firms? Part 1

Hidden risks of information security and data protection in accounting and payroll services

Accounting and payroll outsourcing in the focus of information-security

 

Click here for more PS Blog posts about the most actual questions of accounting and payroll outsourcing