Tag: business risk

Posted on

4 Rules of Thumb Regarding Passwords and Authentication

Many people believe passwords are dumb.  They store their credentials for easy login, or maybe even leave the password blank if the app allows. For IT managers, forcing users to come up with a strong, unique password is definitely not an easy task.  Resting on convenience over security, many people would prefer to use familiar names and dates or simple phrases they can remember.  Even when IT departments try to enforce best practices there is often a struggle between honoring those standards and influencing user behavior.

Relaxed password standards allow users to set passwords that may be as easy to guess as they are to remember, and very strict requirements for strong and complex passwords often results with users storing passwords in document files or on post-it notes on the monitor. Setting password standards and managing the policy implementation requires a balance between usability and security, but more often than not the balance skews toward simplicity. Yet passwords aren’t going away any time soon, even while biometrics and multi-factor authentication methods grow in prominence.

It is most likely that new technologies and standards will be combined with passwords to protect critical data. Using only a password to protect information may not be the ultimate in security, but it is important to recognize that passwords remain as a key element in any security model. For now, passwords should be as strong and unguessable as possible.  As technologies and standards rise up to meet the demands of users as well as enterprises, there are likely to be changes in how passwords are used. Here are 4 rules of thumb to consider regarding passwords and where authentication technologies are going.

1. Your face might be your password.

Biometrics won’t fully replace passwords right away, but the use of biometric data for authentication is growing rapidly. Face recognition, fingerprinting and voice identification are all being employed as authentication mechanisms and users are embracing the technology because it is easier to use than a remembered password.  Smartphones and PCs have sensors for reading fingerprints and cameras for seeing faces, and microphones for hearing your voice.  Many systems are also now able to use geodata with the biometric data (matching person to place), making it harder to compromise an identity while also being less disruptive to the user. While the technology isn’t foolproof, it represents a major step towards creating more secure systems without placing the responsibility strictly on the user.

2. Two pieces of ID are better than one.

The point of multi-factor authentication is that there are two different pieces of evidence a user must present in order to gain access. For example, a password may be the first piece of evidence presented, with a pass code sent to a mobile device as a second. Even as biometric authentication grows in prominence, industry participants recognize that no single method covers all the bases all the time. Multi-factor authentication is gaining in prominence as users become more familiar with the methods and the implementations become less intrusive. AI may also influence how these systems are applied. As user behavior and transaction parameters are “learned”, systems can identify activities that fall outside of normal routines and additionally prompt users for single-use pins or passwords sent to their mobile device.

3. Businesses should learn from past mistakes.

With news of hacking, ransomware and malware being daily fare, companies and their users are realizing that password security really is important and are stepping up their security efforts. The information is available to help prevent businesses from making the same mistakes that others have, offering worst case scenarios a’plenty to learn from.  Using default passwords and recycling passwords across work and personal accounts, using unsecured network connections, not encrypting files that contain password information and failing to patch or update systems and software are entirely preventable situations that put information at risk. Taking the reports seriously and identifying mistakes to avoid is highly useful in designing security for the business.

4. There’s a growing ecosystem for authentication.

With the number and type of systems requiring authentication – from industrial control systems to dating websites – there is a great and growing need to find highly secure methods of authentication that are actually usable for the user. Even in the world of blockchain there is a need for “identity assurance” and confirmation when documents or biometrics are captured via smartphone. Fast IDentity Online (FIDO) is a set of security specifications for strong multi-factor authentication, developed by the FIDO Alliance. The FIDO Alliance includes members such as Google, Aetna, Amazon, Microsoft, Bank of America and Samsung, and developed the spec as an initial basis for standardizing authentication across platforms and systems at the client and protocol layers.  

Technology is changing rapidly and solutions once reserved for government and large enterprise are now entering mainstream consumer use. You’ve probably already noticed that banking and other apps are employing the use of fingerprint and other biometric data with increased frequency as users demand easier access to applications and features from their smartphones and other mobile devices.

These technologies sometimes replace traditional password entry as the primary means of authentication or augment password use in some manner. Even MasterCard has announced a component in its payment card solutions that allows users of next-gen payment cards to register their fingerprint data on their credit card.

The push is to allow users to interact with their tasks without putting up barriers to access.

A combination of usability and enhanced protection, the new standards are developing to address not just system security but identity verification for various purposes. Corporate information must be secured and so must personal identity information; simply read the news to understand what can happen when digital identity information gets compromised.

Whether the data is business or personal, keeping hackers and bad actors away from it isn’t easy, so strengthening the most basic first layer of protection – the password – is the best place to start.

Make Sense?

J

Posted on

4 Rules of Thumb for Better Mobile Device Security

Security threats are everywhere, lurking in alley ways and around corners and even in your favorite coffee shop. Yet mobility is in demand, and people will use their smartphones and other mobile devices because it’s convenient, even if company policy suggests against it.

This is a big deal for IT and security professionals and CIOs, which is why it took a while for IT to recognize the need to address mobile device security rather than simply deny mobile device use. With data breaches, ransomware attacks, hacks and information leaks happening on an almost daily basis, businesses must find ways to protect their valuable applications and data from loss or misuse while at the same time enabling mobile device use.

The following 4 rules of thumb are not comprehensive but are four essential rules of thumb to help guide business owners in addressing mobility management and security within their organizations.

Rule 1: Make sure there are clear mobile device use policies and support them with ongoing administration and strict enforcement.

I can’t say enough about having good security and mobile device policies and keeping them modernized, relevant, and actually enforcing them. Too many businesses say they have a “security and use” policy in place, yet it is outdated and doesn’t reflect the actual tools or processes currently in use.  Even more frequently a business will develop a policy just to say it has one, but won’t actually train workers or enforce compliance.

Rule 2: Require and enforce strong passwords, manage access in real time, and force password changes with some frequency.

It is essential that all user access to applications or data be controlled at minimum by password-protected logins to the device and corporate resources coupled with periodic forced password changes. Users often prefer to not require passwords or other authentication for device access, but corporate policy should not only require them but also enforce their use.  Also, user access should be managed in real time, meaning that any aspect relating to access should be disabled or revoked immediately upon employee termination or reassignment. Too often these forgotten chores are relegated to after-the-fact IT administration, which allows users to access resources beyond their rightful boundaries.

Rule 3:  Do something to contain the applications and data on the device.

Whether the approach is with containers, cloud hosting, server-based computing or something else, it is really important to try to “contain” the applications and data accessed from the mobile device. Risk is created when users sync data directly to the device’s storage or install applications directly on the device to access corporate data. Password and other security measures prevent unauthorized access, but allowing applications, credentials or data to be stored directly on the mobile device allows those things to interact with other things on the device.  Containers, hosting and server-based computing models keep the applications and data within secured spaces, often not even storing essential items on the device but only accessing them via the device. This allows the business to provide users with the access and functionality they need to do their jobs, but also reduces the vulnerability of applications and information assets.

Rule 4: Keep device software up to date and download fewer apps.

Updating mobile device operating system versions and release levels is important to make sure the device has the most current security patches and threat protection.   Some mobile OSes even have capabilities which can help keep personal and work apps separated.  Limiting the number of apps users can download to their devices should also be considered. Users may randomly download and install applications to their devices with little regard for the quality or security of the app, and often accept terms of use without really reading them. Consumer apps from app stores may pose risks to data and the device, so IT should check regularly for problematic apps if the device is used to access the corporate network, applications or data.

Mobile and wireless are in demand

Just about every business has people who use their phones and tablets for some business use, and every one of those mobile devices and the apps running on them could open the door for a hacker, ransomware, data theft or compromise. While there are many benefits to be gained by enabling remote and mobile devices in the business workflow, unrestricted access only creates risk.

Keeping mobile devices secure for business use takes multiple approaches, as there is no single method or solution that works for every situation. Our 4 rules provide a basic foundation for business mobility management, offering a starting point for developing a more thorough and detailed plan.

Make sense?

J

Posted on

Small Business IT Governance: You really need it now

it-balancing-actBig changes are going on in the world of information technology and business.  Where social computing and  mobility are no longer purely consumer concerns, enterprise IT departments face a growing requirement to embrace user devices and access in environments which were once strictly and closely controlled.  Enterprise IT may be challenged when presented with user personal devices and demands for remote access to enterprise data, yet the governance of systems is generally well-defined and strictly performed.  In small business, however, the people, policy and process issues (collectively incorporated into “governance”) tend to be more organic, and the use of personal devices and open access is more frequently considered to be a normal part of the overall business IT profile.

It is a focus on defining controls and processes, and influencing the activities and attitudes of the people involved, which has become an essential requirement in small business.  Where management of information technology resources was not of great concern to the small business owner before, increased device and information mobility (removal of physical boundaries) and erosion of logical boundaries around personal and business computing have become a really big deal for everyone in business. Small businesses just don’t often have departments of people working on the problem.

Technology use in business has always come at a price, and as various influences continue to change how users interact with devices, applications and systems, business owners and IT managers will continue to face difficult choices between balancing security of information resources and providing a productivity-enhancing user experience.   Too many security barriers result in avoidance of security protocols, slow or immobile company computers result in users working on their own machines and portables, and restricting access for mobile users results in “shadow IT” implementations of mobile sync and other data access approaches.

Yet “shadow IT” tends to be the norm with many small businesses, where there are often fewer barriers to implementing solutions which address individual user issues or problems.  Lacking the resources or understanding to develop a strong plan for managing information systems and technology within the business, small business owners often consider the computer systems and computerized data to be tools to get jobs done rather than strategically valuable assets to be strictly controlled and protected.  These business owners are not recognizing the ever-increasing need to not simply secure business information, but to establish processes and rules which will govern how users and devices access and interact with the information and systems.

Enterprise IT departments have often viewed their small business counterparts (customers, suppliers, etc.) as potential points of vulnerability, an attitude which was once considered to be centered not on real assessments of the risk but more in terms of ego, level of sophistication, and hierarchy in the food chain.  In today’s world of real risk introduced by myriad technological and human elements in every link in the supply chain, enterprise IT conclusions regarding the risk potential of doing business with anyone – including small businesses – may not be entirely unfounded.  Whether it be commentary and information distributed by individuals via social media or malware or corruption introduced inadvertently (or not) via computerized interaction, there is the possibility of risk introduced with every system, person and process involved.  Enterprise to enterprise, these issues may be more often recognized and remediated; where the SMB is involved, not always so much.

This is a brave new world of computing, and there is truth in that even the smallest of businesses can “compete with the big guys” when the right mixture of technology and process is applied – for good or bad.  Technology enables businesses to be more productive, get more done with fewer resources and perform at higher levels. IT Governance in small business is no longer an optional area of focus, addressed only during infrequent discussions with the local contract IT guy when he comes in to defrag the hard drive on a slow computer.  Establishing the proper processes and controls to wrap around IT use in the business has become an imperative; a necessarily specific and considerate approach to how information technology is used within the business, who uses it, and what IT is composed of.

Just about every business, and most individuals, are connected in some manner via some type of network, representing a dramatic and dynamic change to the traditional composition of business IT and the landscape of vulnerabilities which threaten it.  The increased connectedness, capability and complexity of systems and networks requires a greater focus on overall IT governance – exercising authority and controls – as the impact (just like the information) can easily and unintentionally reach far beyond the boundaries of the individual business.

jmbunnyfeetMake Sense?

J

“People are nothing more than another operating system”, says Lance Spitzner, training director for the Securing The Human Program at SANS Institute.  “Computers store, process and transfer information, and people store, process and transfer information,”  How Hackers Fool Your Employees

Posted on

4 Rules of Thumb Regarding Workers Compensation Insurance for Employers

In two previous “4 Rules of Thumb” articles, I discussed a few things that businesses can do to create the best possible environment for engaging new customers and providing quality service (4 Rules of Thumb for Business Success) and provided additional tidbits for service businesses – things the company can do to make sure that the work is done completely and correctly the first time, which is what leads to happy and loyal customers (4 Rules for Building Service Customer Loyalty).

This article is focused a bit more internally to the business, discussing a few of the risks and considerations surrounding those dreaded tax burden issues: Unemployment Insurance, Worker Classification and Workers Compensation Insurance. 

Unemployment insurance is one of those items that most businesses pay attention to, because rates are impacted based on unemployment claims made and paid. The cost of unemployment insurance is usually calculated just like workers’ compensation, using standardized arithmetic formulas based on the profile and past record of the company.

Workers Compensation insurance is sort of the “elephant in the room” of compliance – it’s a big problem that is frequently the last item of consideration in business compliance and reporting. It is also an item that frequently goes without scrutiny at the state level, so little attention is generally given it by accounting and human resource professionals.

Workers Comp is one of those payroll reports where you select from a broad list of categories relating (hopefully fairly closely) to the work your people do, you calculate the cost, and you pay the fees.

Ideally you’re classifying workers properly in terms of their being employees versus independent contractors – this being the big focus of most workers comp audits and where many advisors say to pay attention. If you use a company to perform some of the work of your business, also pay close attention to the concept of joint-employer status (see article on joint employer status).

An equally big issue – the issue that impacts the business owner perhaps more than the employee – is classifying worker activities too broadly, potentially costing the business hundreds (if not thousands) of dollars in annual workers comp premiums. Improper classification of worker activities can lead not just to increased premium costs, but heavy penalties in the event of a claim finding the worker was not properly covered.

Most workers compensation policies issue blanket risk classifications, yet how these classifications are used in different industries is where the secrets of cost savings exist.  In the moving and storage industry, for example, the risk is in the warehouse. If a clerk or administrative worker enters the warehouse, that employee is now actually working under a different classification. However, if the worker often checks warehouse inventory or sells items from the warehouse as part of their sales job, they may operate under yet another classification.

There is a balance required when seeking to reduce premiums while keeping the company compliant.  Many companies consider caution to be more affordable than keeping highly detailed activity and work classification records, finding that reporting workers in higher cost work categories is more cost effective than paying for the labor intensive effort of capturing, analyzing and reporting in more detail. That is, until a worker is injured and the risk wasn’t disclosed through accurate workers compensation reporting.

When it comes to workers compensation insurance for the business, give these 4 compliance rules of thumb some strong consideration.

Rule 1: Get informed and get help.

It’s OK for a business owner to not be the expert in all facets of compliance and reporting – – you have accountants and tax advisers that can gain this knowledge from their annual CPE (continuing professional education). The potential costs of mis-handling workers compensation and other aspects of having employees are too great to risk being uninformed and unprepared.

Rule 2: Call an employee an employee

Classifying workers will turn out better for all parties in the long run even if it seems like the more expensive way to go. Misclassification of employee workers as contractors hurts everyone, eventually. There is a big problem with businesses misclassifying workers as contractors rather than as employees, sometimes to avoid paying taxes and benefits, but sometimes not just for that reason. When classified as contractors, workers are generally not covered by the various protections and do not get the benefits that employees do.

Some business owners who are unsure of the state administrative rules may pay workers compensation premiums for workers that are truly independent contractors. Other businesses may require workers to have a workers compensation account as a condition of employment. Either way it is being done improperly and one party or the other ends up bearing unnecessary cost and/or risk.

The unfortunate result is that employers are bearing larger than necessary burdens of supporting injured workers and the unemployed.

Deliberate mis-classification can save dishonest contractors upwards of 30 percent in payroll and other taxes, but for workers, taxpayers and honest employers, the practice amounts to millions in lost wages and revenue. – See more at:

http://www.ibew.org/articles/13ElectricalWorker/EW1305/Misclassification.0513.html#sthash.7u1vtjW

Rule 3: Details Details Details.

Worker classification done properly can save businesses a lot of money simply by being more accurate. Yes, there may be tradeoffs in terms of labor to perform the calculations and reporting, but it can prove to be well worth the effort.

Particularly in businesses where workers may perform multiple duties or work in a variety of locations and conditions, there is value in delving into the details of time, location and work performed to make sure the business is adequately covering itself. Filling out the report by simply selecting the broad category that “seems most likely” is not the best way to go. There are details in the rules, and the smart business takes advantage rather than being surprised by them.

A home installation satellite company did not keep sufficient records for their most hazardous business classification: tower work. During the audit, all their hours were assessed in this one classification that was six times the reported amount. – See more at:http://cath235lni.wordpress.com/

Rule 4: If there is a worker injury claim, pay attention and deal with it right away.

While it seems somewhat like getting car insurance after the wreck, there may be some risk mitigation that can occur if the issue is dealt with directly and in a timely manner – possibly avoiding a claims nightmare.

The last item is more of a suggestion than a rule, which is to be fair and truthful. Treating employees well is part of growing a successful team that will propel the business towards success.

Surprisingly enough, the benefits to the business may not only be a more productive and happier workforce, but lower risk exposure and lower workers comp premiums due to more detailed use of classifications in reporting.Tell employees and independent contractors what workers’ comp does for them – it’s essentially a medical and lost wage policy to protect them and those close to them.

Explaining to employees that keeping the boss informed about what is happening in the plant or in the field is simply part of helping ensure their proper protection.

Joanie Mann Bunny FeetMake Sense?

J

Many thanks to my friend Ted Carlson, Certified Fraud Examiner (retired), a veteran of the Department of Labor and Industries (L&I) in Washington State – responsible for Tax Discovery and Fraud Prevention field Audits. 

Posted on

The Language of Accounting: Disconnect between Accountants and Bookkeepers

The Language of Accounting: Disconnect between Accountants and Bookkeepers

There are a tremendous number of bookkeeper training programs developed over the years which propose to deliver the essential bookkeeping knowledge (e.g., double entry accounting) required in order to properly service business bookkeeping requirements.  Particularly as the CPA profession stepped away from traditional bookkeeping in favor of performing “higher level” and more profitable work, there was and continues to be a great need for skilled and experienced bookkeepers.  While it seems that accountants and bookkeepers would be a natural fit for partnering to serve small business client needs, there is often a disconnect between the two which causes the working relationship to not always prove as beneficial as it could.  What is the cause of this disconnect?  In many cases, it is due to the fact that the bookkeeper training educated the operator on the use of a software product, and not on the fundamentals of accounting and bookkeeping.

Over the past few years, I have had the opportunity to look through a lot of bookkeeper training programs, and the thing that stands out is that many of these programs aren’t really training bookkeepers on accounting principles.  More frequently, the training is focused on teaching users how to use software (usually QuickBooks).  With the number of users of the QuickBooks product, it is obvious that there is a need to educate users on the solution because people need to know how to use their software properly.  But it happened at some point in time that a majority of the industry came to believe that learning QuickBooks (or Xero or Freshbooks or Kashoo or whatever) was somehow synonymous with learning bookkeeping.

When I first started working with my father in his accounting practice, I had to use a manual general ledger, check register, etc.  It was all manual – computers didn’t come along for a while (yes, I am that old).  It was time-consuming, but it taught me the fundamentals.  I know what a subledger is.  In consumer-friendly software like QuickBooks, you don’t work in the AR subledger; you push the button that says “customers” or maybe “invoices”.   QuickBooks, in many ways, doesn’t speak accounting.  It speaks record keeping.  And this is where the disconnect begins.

An old school accountant will recall the green eye shade days and working with book ledgers and 13-column pads, but even “new” school accounting professionals know that the fundamentals of accounting aren’t available for re-invention.  A debit is still a debit and a credit is a credit.  Yes, there are intimacies involved which speak to specific treatment of items for reporting and tax purposes, etc., but the essentials of double entry and other basic accounting principles are consistent and unchanging.

The “language of accounting” includes certain precise terms with specific meaning, and this precision in the use of terms simply doesn’t exist in many bookkeeper training programs. Rather than focusing on the fundamental accounting training bookkeepers truly need in order to be of maximum value to the business, these programs focus on helping users become experts in using the software product, or even to become experts at teaching others how to use the solution.  While this software expertise may be beneficial in terms of helping accountants work with their clients who use the software, it doesn’t add enough value to the relationship to warrant partnering.  What accounting professionals need are bookkeepers who understand bookkeeping and who can apply basic accounting principles to the task.  Which software they operate is secondary to that purpose.

Professional bookkeepers, accountants, and the business client are all in a position to benefit tremendously when the service providers team up to provide comprehensive service.  The key to making these connections lies with the professional bookkeeper who must not only understand basic accounting principles, but must also be able to speak to the accounting professional in their native language.

Make Sense?

J

read more…

Opinion:   I think that every QuickBooks training program should include taking the sample data file in QuickBooks, and translating that to a manual accounting system of book ledgers and reports.  Then, have the student process a years’ worth of transactions manually and from paper-based source materials (and also make them create and use a manual paper filing system for all that information, and come up with a means to travel to obtain all the documents necessary which aren’t mailed via USPS).  The requirement would include generating the bank reconciliations from printed bank statements and cancelled check copies, creating a trial balance from the general ledger and then creating the P&L and Balance Sheet.  I’ll bet you end up with a group of bookkeepers who better understand the fundamentals of the accounting process.  The other benefit is that these folks will have a much better understanding of the problems in the outsourced accounting model which can be directly addressed and solved by today’s cloud and connected solutions.

 

Posted on

Cloud IT: Hiding Complexity and Risk

jmbunnyfeet

Cloud IT: Hiding Complexity and Risk

Cloud computing and Internet technologies have delivered previously unimagined capability for even the smallest of businesses – capability to compete, build brand recognition, and reach markets in remote geographies.  The mantra for businesses used to be “location, location, location”, but it’s become connectivity – perhaps even more than location – which now delivers business opportunity.  As technology has evolved, allowing businesses and consumers to connect regardless of time or place, the complexity of the systems and networks have also increased dramatically.  Where a business could once easily identify their various vendors or business service providers, the identification of those involved in the service ‘delivery chain’ are no longer so easily recognized.   Among the benefits of cloud computing technologies is the ability to reach beyond traditional boundaries.  The risk for many businesses is in not fully understanding how, and with whom, those boundaries are being crossed.

For many an enterprise, the convenience and efficiency introduced with cloud computing models overshadows the increased risk potential.  Service level agreements and vendor contracts are assumed to be sufficient to protect the business and its information assets, yet recent events (such as the recent reveals of PRISM and the actions of the National Security Agency) should cause businesses to look a little deeper at their entire provider network.  It’s not that the average business should be concerned about government snooping of their emails, but they should be aware of who has access to their systems and data, and which entities are responsible for which parts of the system.  It’s only prudent to know the details, and it is the best first step to mitigate business risk.

Enterprise Clouds are complex, sophisticated entities which invariably rely on a daisy-chain of third parties and contractors to help build, run and maintain their Cloud provider’s systems. The organizational and technical complexities are additive, resulting in increased systemic risk. Systemic risk is the least visible and hardest to eliminate, and those risks become real when the providers’ systemic risks become [yours].

The question is, how well does your Cloud provider manage the ecosystem of contractors and third parties that are farther down the food chain? This is even more relevant in the globalized workforce, where, paradoxically, Cloud and related technologies have greatly facilitated the outsourcing and offshoring of work to low-cost countries. http://www3.cfo.com/article/2013/6/data-security_prism-national-security-agency-edward-snowden-cloud-implications-vendor-management

Before executing a service agreement with an outsourced provider, make certain that the details of facility, connectivity, network, equipment, and other elements of the delivery and system are spelled out.  Business subscribers should know where the various points of failure exist, and which company is responsible for dealing with each.  If a carrier fails and connectivity to the data center is lost, the hosting service provider may be powerless to impact the situation, even though access to service is part of the SLA and requirement.  If a hosted software product has a vulnerability or fails to perform, the developer of the product is likely responsible, rather than a hosting service provider.  The point is that there are often multiple players in the delivery chain, and customers should be aware of this reality prior to engaging with the service.

Ultimately, the business with mission critical data in the possession of a 3rd party service provider should have a healthy helping of doubt as to whether the provider has full control over their environment.  Business owners, managers and CFOs should recognize the increased necessity of evaluating risk within their provider systems and in provider/vendor relationships, to keep trade secrets secret and prevent intellectual property from becoming the property of others.

Joanie Mann Bunny Feet

Make Sense?

J