march2021 - 12

THE LEADERSHIP ADVISOR

Security for a Work-FromHome World

IF YOU DIDN'T begin 2020 relying on cloud-based technology to allow you to work from anywhere, you almost certainly ended it that way. With a global pandemic forcing us to avoid group
gatherings, some offices went remote for the whole of the year and aren't thinking of returning
anytime soon. Even if you plan to reopen fully once it's safe to do so, it's unlikely you'll ever go

AMY VETTER, CPA.CITP, CGMA

Mindful Technologist &
Keynote Speaker
@AmyVetterCPA

back to an environment where work-from-home (WFH) isn't an integral part of your operations.
As such, it's probably time to ensure that your cybersecurity meets your current needs.
There are many ways to ensure
that your sensitive data is kept safe
from prying eyes, and the best plan
of action will vary depending on the
nature and size of your organization.
That being said, there are a number
of strategies that are worth exploring for all firms. You're probably
doing some of the items listed below,
but it doesn't hurt to brush up,
especially as your team members
are working from more places and
more devices than ever before.

EDUCATION
No matter how robust your suite of
technological defenses are, humans
will always be a vulnerable part of
the equation. Keeping your team
informed of standards and best

MARCH 2021 ■

practices will go a long way in keeping your data safe. Team members
should never use public wifi or plug
into public USB ports, like the ones
you find in the airport. And they
should never, ever open unsolicited
links, whether they come via email,
social media, text, or any other format. If they receive a dubious email,
such as one purporting to be from
a bank that doesn't feel quite right,
it's always better to exercise caution. You don't want to end up with
a phishing scam on your hands. You
can even run fake phishing scams
in order to test the vigilance of your
team. While you're at it, it wouldn't
hurt to encourage your clients to
engage in these practices as well.

www.CPAPracticeAdvisor.com

VIRTUAL PROTECTED
NETWORKS (VPNS) AND
MULTI-FACTOR AUTHENTICATION (MFA)
VPNs and MFA are two of the
easiest ways to add enhanced
security layers to your firm. A VPN
requires users to sign onto a specific
network in order to access certain
applications. In other words, a user
wouldn't be able to access their company data by simply being online;
they must sign onto your network in
order to do so. MFA requires users to
verify their identity in at least two
ways as a means of ensuring that a
single lost password can't compromise a network. Under the best MFA
systems, at least one authenticating
factor will be randomly generated

and time-sensitive, such as a code
sent to a phone or accessed through
an app like Duo. Stacking these
technologies, making a VPN accessible only through MFA, makes them
even more secure.

ZERO TRUST SECURITY
If you want to have the highest level
of security currently available, you
may choose to go with a Zero Trust
architecture. In a Zero Trust system,
no devices are ever considered to
be inherently safe. All devices and
users must prove their authenticity
at all times, use the most updated
patches of all software, with security assessing threats in real-time.
If you want to read more about the
specifics of Zero Trust, you can
follow the work of John Kindervag,
the thought leader who coined the
term. Microsoft also offers a helpful
diagram explaining the system.
The most important part of any
security system is making sure it is
implemented effectively and used
by all users at all times. There's
no reason a cloud-based operation
shouldn't be as secure as a terrestrial one, but in both cases, you have
to remain vigilant and stay up to
date in order to avoid catastrophe.
Data breaches are a threat to life of
any business, so there's no better
time than now to take a look at your
cybersecurity. ■

http://www.CPAPracticeAdvisor.com

march2021

Table of Contents for the Digital Edition of march2021