Data Security During a Pandemic

Cyber Thieves are active during COVID-19.
Protect your data.

With cyber thieves active during COVID-19, we as tax professionals must be diligent in reviewing critical security steps to ensure we as an industry are fully protecting client data whether working in the office or a remote location.

Many business owners have expanded telework options this year to keep personnel safe, practice recommended safety guidelines, and use technology to virtually serve their clients.

During this period, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has urged organizations to maintain a heightened state of alert as cybercriminals seek to exploit Covid-19 concerns.

To help you protect your data while you continue to protect yourself, your employees, and your customers from COVID-19, we are sharing six basic steps that should be taken for every work location.

The Security Summit – a partnership between the IRS, states, and the private-sector tax community – have issued the basic “Security Six” protections that everyone handling sensitive data should use.

The basic “Security Six” are as follows:

1. Anti-virus Software

Although details may vary between commercial products, anti-virus software scans computer files or memory for certain patterns that may indicate the presence of malicious software (also called malware). Anti-virus software (sometimes more broadly referred to as anti-malware software) looks for patterns based on the signatures or definitions of known malware from cybercriminals. Anti-virus vendors find new issues and malware daily, so it is important to have the latest updates installed on your computers.

Once an anti-virus package has been installed, you should scan your entire computer regularly by doing:

Automatic scans – Most anti-virus software can be configured to automatically scan specific files or directories in real time and prompt users at set intervals to perform complete scans.
Manual scans – If the anti-virus software does not automatically scan new files, users should manually scan files and media received from an outside source before opening them. This manual process includes:
- Saving and scanning email attachments or web downloads rather than opening them directly from the source.
- Scanning portable media, including CDs, for malware before opening files.

Sometimes the software will produce a dialog box with an alert that it has found malware and asks whether users want it to “clean” the file (to remove the malware). In other cases, the software may attempt to remove the malware without asking first.

When selecting an anti-virus package, you should learn about its features so you will know what to expect. Remember, keep security software set to automatically receive the latest updates so it is always current.

A reminder about spyware, a category of malware intended to steal sensitive data and passwords without the user’s knowledge: Strong security software should protect against spyware. But remember, never click links within pop-up windows, never download “free” software from a pop-up, and never follow email links that offer anti-spyware software. The links and pop-ups may be installing the spyware they claim to be eliminating.

A reminder about phishing emails: A strong security package also should contain anti-phishing capabilities. To avoid being a victim of a phishing attack, never open an email from a suspicious source, click on a link in a suspicious email, or open an attachment in a suspicious email.

2. Firewalls

Firewalls protect against outside attackers by shielding a computer or network from malicious or unnecessary web traffic and preventing malicious software from accessing systems. Firewalls can be configured to block data from certain suspicious locations or applications while allowing relevant and necessary data to pass through, according to CISA.

Firewalls may be broadly categorized as hardware or software. While both have their advantages and disadvantages, the decision to use a firewall is far more important than deciding which type used:

Hardware – Typically called network firewalls, these external devices are positioned between a computer and the Internet (or another network connection). Hardware-based firewalls are particularly useful for protecting multiple computers and control the network activity that attempts to pass through them.
Software – Most operating systems include a built-in firewall feature that should be enabled for added protection even if using an external firewall. Firewall software can also be obtained as separate software from a local computer store or software vendor. If downloading firewall software from the Internet, make sure it is from a reputable source (such as an established software vendor or service provider) and offered via a secure website.

While properly configured firewalls may be effective at blocking some cyber-attacks, don’t be lulled into a false sense of security. Firewalls do not guarantee that a computer will not be attacked. Firewalls primarily help protect against malicious traffic, not against malicious programs (malware), and may not protect the device if the user accidentally installs malware. However, using a firewall in conjunction with other protective measures (such as anti-virus software and safe computing practices) will strengthen resistance to attacks.

Be aware that anti-virus software and firewalls cannot protect data if you or an employee falls for email phishing scams and divulges sensitive data, such as usernames and passwords. The first line of defense in protecting your data is the user.

3. Two-factor Authentication

Tax software providers, email providers, and others that require online accounts now offer customers two-factor authentication protections to access email accounts. You should always use this option to prevent your accounts from being taken over by cybercriminals and putting your clients and colleagues at risk.

Two-factor authentication helps by adding an extra layer of protection beyond a password. Often two-factor authentication means the returning user must enter credentials (username and password) plus another step, such as entering a security code sent via text to a mobile phone. The idea is a thief may be able to steal the username and password but it’s highly unlikely they also would have a user’s mobile phone to receive a security code and complete the process.

The use of two-factor authentication and even three-factor authentication is on the rise. You should always opt for multi-factor authentication protection when it is offered, whether on an email account, software account, or any password-protected product.

4. Backup Software/Services

Critical files on computers should routinely be backed up to external sources. This means a copy of the file is made and stored either online as part of a cloud storage service or similar product. Or, a copy of the file is made to an external disk, such as an external hard drive with multiple terabytes of storage capacity. For another layer of safety, data that is backed up should also be encrypted.

5. Drive Encryption

Given the sensitive data maintained on business computers, users should consider drive encryption software for full-disk encryption. Drive encryption, or disk encryption, transforms data on the computer into unreadable files for an unauthorized person accessing the computer to obtain data. Drive encryption may come as a stand-alone security software product. It may also include encryption for removable media, such as a thumb drive and its data.

6. Virtual Private Network

This is critical for people who work remotely. If you or your employees must occasionally connect to unknown networks or work from home, establish an encrypted Virtual Private Network (VPN) to allow for a more secure connection. A VPN provides a secure, encrypted tunnel to transmit data between a remote user via the Internet and the company network. Search for “Best VPNs” to find a legitimate vendor. Major technology sites often provide lists of top services.

Insurance

You should also review your professional insurance policy to ensure the business is protected should a data theft occur. Some insurance companies will provide cybersecurity experts for their clients. These experts can help with technology safeguards and offer more advanced recommendations.

A Final Note

Our best security measures are not guaranteed to be foolproof. We must not let our guard down when it comes to protecting our sensitive data.

Stay safe. Stay well. Stay home.