Companies should take a holistic approach to cybersecurity

Today’s businesses have two broad choices regarding cybersecurity: wait for something bad to happen and react to it, or proactively address the threat. Not surprisingly, we recommend the latter approach. The grim truth is cyberattacks are no longer only an information technology (IT) issue. They pose a serious risk to every level and function of a business. That’s why your company should take a holistic approach to cybersecurity. Let’s look at a few ways to put this into practice. Start with leadership Fighting the many cyberthreats currently out there calls for leadership. However, it’s critical not to place sole responsibility for cybersecurity on one person, if possible. If your company has grown to include a wider executive team, delegate responsibilities pertinent to each person’s position. For example, a midsize or larger business might do something like this: The CEO approves and leads the business’s overall cybersecurity strategy, The CFO oversees cybersecurity spending and helps identify key financial data, The COO handles how to integrate cybersecurity measures into daily operations, The CTO manages IT infrastructure to maintain and strengthen cybersecurity, and The CIO supervises the management of data access and storage. To be clear, this is just one example. The specifics of delegation will depend on factors such as the size, structure and strengths of your leadership team. Small business owners can turn to professional advisors for help. Classify data assets Another critical aspect of cybersecurity is properly identifying and classifying data assets. Typically, the more difficult data is to find and label, the greater the risk that it will be accidentally shared or discovered by a particularly invasive hacker. For instance, assets such as Social Security, bank account and credit card numbers are pretty obvious to spot and hide behind firewalls. However, strategic financial projections and many other types of intellectual property may not be clearly labeled and, thus, left insufficiently protected. The most straightforward way to identify all such assets is to conduct a data audit. This is a systematic evaluation of your business’s sources, flow, quality and management practices related to its data. Bigger companies may be able to perform one internally, but many small to midsize businesses turn to consultants. Regularly performed company-wide data audits keep you current on what you must protect. And from there, you can prudently invest in the right cybersecurity solutions. Report, train and test Because cyberattacks can occur by tricking any employee, whether entry-level or C-suite, it’s critical to: Ensure all incidents are reported. Set up at least one mechanism for employees to report suspected cybersecurity incidents. Many businesses simply have a dedicated email for this purpose. You could also implement a phone hotline or an online portal. Train, retrain and upskill continuously. It’s a simple fact: The better trained the workforce, the harder it is for cybercriminals to victimize the company. This starts with thoroughly training new hires on your cybersecurity policies and procedures. But don’t stop there — retrain employees regularly to keep them sharp and vigilant. As much as possible, upskill your staff as well. This means helping them acquire new skills and knowledge in addition to what they already have. Test staff regularly. You may think you’ve adequately trained your employees, but you’ll never really know unless you test them. Among the most common ways to do so is to intentionally send them a phony email to see how many of them identify it as a phishing attempt. Of course, phishing isn’t the only type of cyberattack out there. So, develop other testing methods appropriate to your company’s operations and data assets. These could include pop quizzes, role-playing exercises and incident-response drills. Spend wisely Unfortunately, just about every business must now allocate a percentage of its operating budget to cybersecurity. To get an optimal return on that investment, be sure you’re protecting all of your company, not just certain parts of it. Let us help you identify, organize and analyze all your technology costs. © 2025

January 11, 2017 The IRS issued information of a new variation of phishing scheme that is targeting accounting and tax preparation firms. 

These schemes are set up to collect sensitive client information which will allow the fraudsters to then prepare fake tax returns.

The latest emails typically have two parts.

1. Tax preparation solicitation: The emails are asking tax professionals things like, "I need a prepare to file my taxes. can you help me?" If the tax preparer responds, a second email is then sent.

2. Data collection and hacking: The second email will either have an embedded web address for you to click or contain an attached PDF, word document or excel document. This document contains the embedded web address.

TIP: You can hover your mouse pointer over the url provided or the attachment to reveal the link's true address. If it is not one that you recognize, do not click it. It will normally not end in ".com" or it could be a shortened url, which is a method used to shorten or hide the location of the true destination of the link.

Typically the emails appear to be from a legitimate client or organization. Chances are they have been victimized and have at one time or another had their accounts taken over by fraudsters. The emails do a very good job at masking the deception. The fraudsters will use any method possible to get you to click on their link or attachment.

The IRS has urged tax professionals to scrutinize each email and consider creating internal policies on how to address these types of emails seeking service.

For more details we have included the link to the IRS' "Protect Your Clients; Protect Yourself"