Technology has made running a small business easier in countless ways, but it's also created entirely new ways for data to be stolen.
As the owner of a small accounting firm, cybersecurity is honestly one of the things that stresses me out the most and makes me nauseous if I think about it for too long. AMD Accounting may be a small business, but the amount of sensitive information entrusted to us is staggering. As tax preparers, we have names, addresses, Social Security numbers, dates of birth, banking information, wage information, tax returns and other identifying data.
That makes us particularly attractive targets for identity thieves. And smaller tax practices can be especially appealing because criminals may assume a small firm doesn't have the same security resources as a large organization.
A criminal gaining access to AMD's information wouldn't just affect me. It would affect the people and businesses who entrusted us with theirs. And that's the part that keeps me up at night.
When the risk starts to feel a little more real.
We're still helping a client work through the fallout from the check fraud I wrote about recently. In just the last couple of weeks, we've also learned of another local Kent County organization dealing with a completely different type of scheme.
And at the same time that all of this is happening, I've been working through the renewal of AMD Accounting's cyber insurance policy. When I first purchased cyber coverage, I remember the application being one page long. This year, my renewal application is four pages, and part of it has to be completed by my IT company. Talk about a PIA.
But that change says a lot. It's not just about the insurance coverage anymore; the application is about what we're doing to prevent something from happening in the first place. The risks have changed, and so have the safeguards we're expected to have in place.
What information is your business actually holding?
This problem isn't unique to accounting firms.
Do you have employees? You probably have Social Security numbers, addresses, dates of birth, payroll records and direct-deposit information.
Do customers pay you electronically? You may rely on payment platforms or merchant accounts that could be valuable if someone gains access to them.
Do vendors send you W-9s? Those forms contain sensitive information too.
Do you conduct business by email? Think about the information, documents and password-reset links sitting in that inbox.
I don't think we always realize just how much information we accumulate in the normal course of doing business. Even if you don't think of your business as being “data driven” like mine is, you are probably the caretaker of someone else's information. You don't have to be a hospital, bank or accounting firm to have information worth protecting.
Where does cyber insurance fit in?
Safeguards can help reduce the risk, but we can't eliminate it entirely. That's where cyber insurance can fit in. Having a policy certainly isn't a substitute for good security practices, but depending on the coverage, it can provide another layer of protection if something does happen.
This is where insurance and safeguards start to overlap. My own renewal application asks about multi-factor authentication, backups, access controls, IT support, security practices and more. It's a lot to think about, especially when you just want to do the work that actually makes money. But if my insurance company wants to know whether we're doing these things before they're willing to insure the risk, that's a pretty good indication that I should be paying attention to them too.
Start somewhere.
You don't have to overhaul your entire business this afternoon. Honestly, most of us don't have the time or energy for that anyway. But there are a few relatively small places to start.
Are you still reusing passwords? Consider a password manager that can generate and store unique passwords for you.
Have you enabled multi-factor authentication on your most important accounts? If not, start with email, banking, accounting and payment accounts.
Do you know whether your business has cyber insurance? If you're not sure, ask your insurance agent. If you do have coverage, make sure you understand what it covers and whether it still makes sense for your business.
Do you know what would happen if your computer, email account or payment system were compromised tomorrow? If you're not sure, that's a conversation worth having with your IT provider.
None of these ideas are new or particularly exciting. They're also not the reason most of us went into business, and they're certainly not the things we want to spend our time on. But technology has made them a critical part of running a business today.
Protecting your business costs money and takes time. I know that because I'm doing it too. There will always be something more pressing to deal with, and it's easy for things like cybersecurity to keep getting pushed down the list. But the last few weeks have been a good reminder for me that having safeguards in place doesn't mean we're done thinking about them. It's worth stepping back periodically to look at what we're protecting, where we might be vulnerable and whether the safeguards we already have in place still fit the risks we're facing.