Sign North Carolina Banking Moving Checklist Online

Industry sign banking north carolina letter of intent secure

[Music] welcome to the taxing subjects podcast I'm Ryan Norton and today we're gonna be talking about the taxes security checklist now before we begin you know data security has been something of a hot-button issue for the tax industry over these past few years the Security Summit which is just a partnership between the IRS state tax agencies and members of the private tax industry it was founded in 2015 to deal with the significant increase in tax related identity theft incidents and this checklist the taxes security checklist is the latest in a series of outreach campaigns by the summit now joining me for this discussion is Drake software vice-president of internal operations Jaimie Gibson who is also a member of basically every Security Summit working group welcome to the show Jamie thanks Ari glad to be here well it's great to have you back you've been on before talking about data security and today we're gonna talk about this new checklist and I think it's going to be a really good way for people to consider how to protect their practice their data but we have a lot of information so let's just jump into it and the first thing we're going to do is just at a high level talk about just those five steps and we have the security six creating a data security plan educating your staff about phishing emails the signs of data theft and then finally creating a data theft plan and so let's just start with the first of that five which would be the security six okay what is the security six did broadly broadly its six steps that the IRS states and industry have come up with to try to educate tax preparers and accounting offices as far as the things that they need to be doing to secure their systems and their clients data and for protect themselves and their business and a lot of these things would probably sound familiar to anyone who may not even be in the tax industry but who has looked into how to secure your computer or your home network or even just your office network but the first step anti-virus software what can we talk about with that so antivirus software talk about low-hanging fruit right everybody everybody should have anti-virus software running I mean it comes installed by default on every Windows operating system on Macs and one of the challenges as running virus scanners or mount malware checkers can take a significant amount of time so a lot of folks end up turning off their monthly virus scanner or turning off real time by or scanning and malware checking because they need to have their computer operating at maximum capacity right in addition to that keeping the antivirus software up to date that's the one yes we we talk a lot in the summer about what we call zero-day attacks have you heard of a zero-day attack I have okay so for those of you who may not know what it is a zero-day attack is a a new type of malware or virus off where trojan what what have you that is brand-new to the market and virus scanners have not been able to adjust their programming and release updates in enough time to protect the end user that maybe get the phishing email or that may get a website that has been compromised that wants to download malware or Trojans so even though zero-day attacks are very hard to prevent in the first 4 to 18 hours most virus scanners and malware checkers do release updates within 18 hours so as long as you're keeping your antivirus software as up-to-date as possible it it's as much protection as there possibly could be out there absolutely and most of the attacks that we see even especially in tax practitioner offices right now they're not zero day attacks these are scams that are sometimes even months or years old and folks continue to fall for them and as long many of them are protected by their antivirus software but not every one is again because they've turned it off or they haven't kept it up to date right and as someone who knows about the need for updating not just your antivirus but also like your operating systems which is key I understand the the feeling you first sit down to do your work and you have that update queued and you're like well I've got a meeting that I have to get ready for in 30 minutes and if I hit this button then I'm not gonna be prepared and I get that impulse but what kind of risks can you say these people might incur if they don't like I personally remember they want to cry ransomware incident which was tied to a Windows Update yes many of the operating system updates that are put out are typically to patch security holes that been found by hackers and fraudsters and to your point sometimes installing those updates takes forever I can't tell you how many times I've been in the same situation that you are in I was actually giving a presentation at a conference a couple of months ago and my laptop that had my presentation on it was installing updates 20 minutes before my presentation I had to wing that one I think I made it okay but I feel I feel the pain of that and one thing that we can do to get around that as you can tell your your computer what time of day to install updates of course then again that means you have to leave your computer on maybe overnight which is not necessarily great practice so carving out time kind of planning to say okay I'm gonna install updates manually and I'm gonna check every Monday at 10:30 and clear my schedule for from 10:30 to 11:30 and every Friday from 9:30 to 10:30 and clear my schedule for those times I found that since my my oopsie doops at my presentation that that works really well for me I just blocked it out on my calendar and say I'm not accepting any meetings nor am I gonna plan to actually get any real work done sorry boss during that hour and like you're saying just treat it like any other aspect of housekeeping your business because that's the facial right you have to carve out time to clean out the microwave and the employee break area so same thing and now the next one on our list jumping from antivirus software is firewalls and now firewalls are something that people they probably have heard about but they might not understand what they are could you briefly explain like firewalls to the to the listeners what is a firewall and why is it important that you have it so a firewall is a piece of software installed on a computer maybe a standalone computer or a network that basically it's only function is to block unauthorized incoming traffic to either that computer or to that network meanwhile allowing the user that's authorized to use that computer or network to continue communication in any form that's digital to the outside world basically all right now the next one might be contentious for some people two-factor authentication two-factor authentication I'm gonna I'm gonna switch your wording there to multi-factor authentication and there are there are some sites out there some of you may be familiar with them you jump through three to five different types of authentication before you're allowed to access your account so multi-factor authentication is based on this something you have and something you know and something you are so your email and addressing your password you you know that but there needs to be like a physical piece to that and whether that's a hard token which is like a Yubikey or RSA token that actually plugs into your computer or whether it's some kind of soft token which would be Google Authenticator or the RSA app I'm not saying that people have to use Google or are say those are just the ones that come to the top of my head so that many websites and all tax software products do support multi-factor authentication the summit security summit we made a decision last year and this year to make that optional and what we found is so few people opted into using multi-factor authentication we that we almost thought that we were telling the IRS incorrect information because it was like 1.4 percent of people so we put our heads together a lot with the communications subgroup within the Security Summit to try to reach out to the tax preparer community to say you know we we know this is optional but this is really for your protection we know it's going to take you an extra five seconds every time you log in because you know okay my username is Jamie my password is password 1 2 3 4 5 and then it says okay so what's your multi-factor code and I'm like digging through my purse or whatever yeah so it does take some getting used to and at Drake we actually implemented multi-factor authentication for logging into our network a couple years back and we really expected it to be like a super tough lift you know people having to remember their their tokens or their phone and we had a couple bumps for a few weeks but everybody's really gotten used to it and and I get the emails every time somebody locked themselves out using multi-factor and it happens maybe three times a week so it's really just getting into the habit of it and the amount of protection that multi-factor offers you've whether it's desktop software whether it's a website whether it's accessing and countless of some sort you're pretty much about 99.9% protected as long as you're using either a hard token or soft token so that's good news and those aren't my that 99 percent is actually industry-wide not just tack software like as far as all account driven services so that's great so basically you just tell people we know you don't love typing in your password no one does I don't love it but but you're used to it you get used to this too it'll be just because well no one loves it they have that rhythm right you sit down let do it you're in yeah it's gonna be dead a lit and then plugging in or doing whatever your token requires right the multi-factor authentication page you're in you're doing you're sure so one thing I do want to say though as far as hard tokens goes if you leave them plugged into your USB Drive there's no point even having mfa so for for that reason for a lot of folks it's a lot easier to do a soft token on their phone or on the dongle of some sort and just from a personal experience I've actually used those before because of of all things online video gaming world of warcraft not trying to plug them or anything but they had a hard token and you could download the soft open so it really is one of those things where it becomes just second nature it's not an issue once you are used to doing it it's just another habit right alright now the last three would be backups drive encryption and then VPNs and let's just start with backups okay so I you can't just start with backups it kind of bleeds over into drive encryption and ransomware and so on so forth but it's pretty surprising how many folks are not doing a physical backup of their data and by a physical backup I mean a backup that is accessible outside of the network or the hard drive on which the data resides doing a backup prevents you from so many things from the simple computer crash to the power surge - now ransomware - any number of things and we recommend at Drake backing up daily daily which again carving out time to do it it's one more thing on the daily task list but we hit we have had a lot of ransomware attacks recently in the tax software space on our tax preparers computers where they couldn't pay the ransom or didn't want to pay the ransom for whatever reason and just said ok I'm just throwing that computer in the trash and then I'm like oh no I've lost everything yeah and they say well do you guys have a backup of our stuff we've said too you know sure don't so it's it's important for so many reasons like I said anything from a hardware failure to natural disaster you know and we were talking about hurricane season right now as a thing people are having to deal with that even from previous hurricane seasons recovering data yep basically recovering your business yep unfortunately in the digital world that we live in now you're only your business is only as stable as as your retention in protection of your data for your clients and for your business right and having that backup probably 98% of us are never gonna need that backup we're never gonna need it but the 2% of us that that do I mean is a it can kill your business yeah and making the backup isn't like you said it's not a heavy lift right find a service you can find software what you need to do it yeah and like you said Drive Encryption is tied to that yes could you explain what drive encryption is for people who might not necessarily know anything about it so driving encryption is a technology that basically uses mathematical functions to encrypt the data that's at rest on an actual hard drive which makes it in the event that your laptop is stolen or somebody gained unauthorized access to even your desktop or network it just provides an extra level of authentication to say is the person that's accessing this device authorized to do so based on those mathematical functions and the reason why those two things pair up so well with backups and data encryption is again as you said if they do if you have a literal physical hard drive that you've used as a backup and someone steals that then they can't access the information that's cut that's correct and finally the one that really trips us up even if you know something about tech you might not really understand what a VPN a virtual private network what is a VPN for the layman so a virtual private network is basically a tunnel into a system where you Ascenta kate yourself and can access certain data or transmit certain data without being exposed to the entire virtual or cyber world there's a couple different ways that VPNs are are used some of them are used by fraudsters to try to use your account access that they may have already compromised just boof themself as being used so they they buy software that says I want to impersonate that I'm in Franklin North Carolina so that when I access ride Norton's account the IP address matches his geolocation another way that they are used is for folks to actually access their own systems from a remote location the intent of the VPN at first that was used in that way it was for protection right so I I have a I have a sore throat or the contractors coming to my house today but I work to do so I can VPN into work in a pretty safe connection in that once I connect my Virtual Private Network anything that happens on my physical laptop is there's no data exchanged outside of the VPN so that that was the intent of it but what's happened with certain software so that we all use for screen sharing for support reasons you know TeamViewer GoToMeeting things of that sort instances of the software aren't always secure again because they're not kept up to date or it's the free version and so if if you're using one of those types of software or have installed it in the past and not kept it up today it's another vector that the fraudsters can use they compromised your username and password they're in your machine like that and from the software side from the compliance side and the fraud prevention side we can't tell whether or not it was you or whether or not it was a fraudster because it's your IP address because they're literally on your computer acting as you well since we've kind of briefly explained VPNs well and the security six we'll just kind of go through the last few items on the checklist from the taxes security together campaign and the next one just be and this one's one that a lot of people are probably coming to grips with now which would be what is involved in creating a written data security plan it's not as ominous as it sounds in there there's a lot of guidelines and that are free easily found on Google there's paid software but basically what's involved in it the first thing you have to do is understand what your data is where your data is located so the you know what you're writing a plan for is your data on a network is on USB keys that are floating around on your employees keychains as only on your hard drive with a single user login so the first thing is is to figure out what data you have and where it's located and I just spoke to the digital aspects but remember the paper aspects as well you know we talked about dumpster diving and and other podcasts that we' e done so once the data has been mapped out as to where it actually exists then the next steps are are basically to try to come up with scenarios in which that data could be accessed by unauthorized users and what you would do to react so that in the event that it does happen to you you're not trying to think of stuff from scratch to say okay so one of my employees have to be fired and they still have their USB key what do i do what do I do and if you've thought through that beforehand it's it's kind of just a road map guide for the for lack of better terms to say these are the scenarios I can think of where my data could be compromised and these are the steps I believe that I should take in the event that that happens and not to shamelessly plug it but we do have a rudimentary framework for a security guide on trade software comm only taxing subjects blog that you can go to download under the Downloads tab when you go to Drake's software comm back slash belong not that I'm going to shamelessly thing that we've worked on it's a it's a really great guideline now yeah I might have helped write some of it so you know not that we want to brag but that's a definite resource like if you say if you hear this and you go well I still don't know what to do right absolutely you can go hit the the website up absolutely absolutely and the other thing to say about the data security plan is that it isn't optional it is not optional required by law to have it you are by IRS regulation you every tax office is required to have a data and it's because you're considered a financial entity because you're handling financial data yep you have to be a bank to be considered a finding I've never worked for a bank before but I would say that having somebody's tax information rivals anything the bank has because basically you have as the tax preparer you know everything there is to know about that tax preparers home situation right financial situation what their kids names are where they go to daycare everything that anybody would want to know about somebody is typically contained within a tax preparers data set you you are the custodian of absolutely the data that can be used to successfully yeah scam banks yep to get a credit card loan successfully scam the Treasury to get a refund absolutely so just it's it can be real bad news if someone gets a hole that day absolutely one of the things that catches people what is the phrase the weakest link in the security chain is always people sure absolutely phishing emails they target people because they know that if you have a good firewall installed they know if you have taken proper security steps it may be hard to crack your network but it could be easier to crack people it is 100 percent easier it's the whole reason that the cyber security is even a thing is because as you said the human is the weakest link and this whole technology can solve a lot of things but it can't solve the way human brain works or what human activity actually is and so phishing emails are something that it seems a lot of times to me I'm like how are we still dealing with phishing emails like what have we not figured out as a group of technology experts out in the world how to stop phishing emails but it goes back to what I'm saying earlier about zero day attacks there's always gonna be phishing emails that get through that have scripts embedded or malware and embedded for all types of malicious activities and the main vector for many of those programs is through phishing emails and the fraudsters have gotten so sophisticated at them that that it's it's difficult for security experts to even recognize a lot of them I have a friend who who works for a company in Florida whose CFO I'm not even kidding why are two hundred and thirty thousand dollars based off of a phishing email last week it's a it's an old scam and this is a see it this is this is a CFO this is not this is not a person who is uneducated and doesn't know how to protect data and protect their company that's how good the email was so ongoing education of phishing emails is is something that we do at Drake software and that I am assuming most companies do but really in the end it's about keeping the light on staying vigilant whether you you know as as humans to take that extra time before you download unknown attachments or click that link or respond to an email with any type of information that could give them any access to the keys to your kingdom right and before we started recording we were joking about just the deluge of emails you get yes it's just you have so many and so it's it's that's what they're preying on they know that business professionals get lots of emails and you kind of become numb to the number and you just want to click through it and get it off your list move on sure and that's dangerous it is I can't tell you Ryan earlier I get hundreds of emails every day and and there there's times when when I've come this close to responding to something going check yourself yeah check yourself so so just just look for the signs of those things and like Jamie said stay vigilant you can't even trust attachments for people you know absolutely not running a virus scan on that attachment if if you're expecting it so careful because they may not know that they're infected with malware right and it's they're just going about their business you needed to get this spreadsheet and and even personal emails like I've talked about in in previous podcasts about the pictures of my niece that came through in a zip file from from my sister it looked it said it was for my sister and it was it wouldn't be out of the ordinary for her to download all of them or upload all the pictures of Kinzie into a zip file and send it to me and you know yeah so you just never knows and we actually there are there are different types of software that you can install in your network or in your standalone computer that basically run a run a check on anytime we try to install or your computer tries installing type of update or open a zip file or launch any type of script that will kind of quarantine there's those files and there's actions for you before they take place so that you can review them and hopefully know whether or not it's something that is okay to install on your on your computer or not so like you said that may not catch a zero-day attack but the number of zero day attacks is far out outnumbered by this the stuff that's been out there because they again they know that people will click yep one of the last few things we want to talk about today would be just some common signs of data theft could you just go through like just a handful I know the IRS just released like a list of 12 I think sure and we can just kind of go through some of the common ones sure people unfortunately I I couldn't remember all 12 off the top of my head being put on the spot anyway [Laughter] and specific for tax repairs and Tax Office's one of the when the first things is when clients were returns start to reject has already been filed with the IRS or state that's very common it's it's actually called IRS reject 902 and we see a massive amount of those and a lot of them are false positives I'm taxed repairs accidentally sent the same tax return twice or what what what have you but as long as you're managing your filed returns you you should have a pretty good idea if you start to get back a lot of clients have already accepted tax return and you know that you don't file them and another thing that you can do is through IRS eServices you can compare the number of returns that have been filed using your electronic filing identification number to the number of returns that you know you've filed given it's not exactly real time but and it it should be fairly close in a ballpark meaning you know might take a four to 24 hours to post the last three returns you filed but you know you'll have a fairly good idea of it and that one's a big one too and we've talked about it before but they target tax professionals so that they can use your software and your database yeah to file those fraudulent returns and try to get refund okay and if they have access to it yep they're gonna do it yep they sure well there's also and I done the identity verification called ID to verify program through the IRS where if first if for some reason a taxpayers filing hit the IRS is taxpayer protection program filters in some cases the IRS is send out a letter asking the taxpayer to verify it was them that filed the tax return so if you have customers or tax payers who receiving these letters and coming to your office and you know you haven't filed their return they haven't filed somewhere else that's a really great sign and this is a newer program too to the IRS and it seems to be fairly effective even if there is snail mail involved but the IRS will never email you or your clients so that's something to keep in mind are there signs that manifest on your actual machine that you may have had a data theft an sedan sure so some of those signs are our real-time and the some of them can be discovered after the fact so an example of a real time in this ties back into our VPN conversation is that somebody has unauthorized access to your computer through a VPN program and you may be sitting there speaking with your your client I'm interviewing Ryan and blah blah blah and out of the corner of my eye I see my mouse moving around mm-hmm on my computer screen I'm the only one sitting there somebody could be in your computer it's not holding it's not haunted it's not haunted so some other signs could be seeing activity on tax returns with timestamps when you weren't in the office maybe from 2:00 to 4:00 a.m. and you're like well that's kind of strange and so those just kind of a handful of things you can kind of look out for again the IRS did publish a list of 12 items you should be able to find that on their IRS tax tips I think yeah taxes security - together as well you can get to it off the main page of irs.gov there you go one of the last things we'll talk about what are some data security scams that exists right now that may if they're not new maybe there are newsworthy sure sure so I actually wouldn't tell you story about something that happened me about three weeks ago now I was think was like a Saturday afternoon it definitely wasn't a work had been near my phone and I got back to my phone and I had a phone call from Verizon from a you know their 800 number and out of my you four eyes and so it automatically pops up on my phone as as Verizon like that's strange so I I listened to the voicemail said hey we had a problem processing your automatic payment call us back and it gave a different number I came this close to falling for it I thought no I'm gonna call their main number so the girl who picks up says yeah this is a recent scam and people are falling for left and all right - I was I was thinking I work in security I almost fell for it for this plan so back to being vigilant right right like I said I was this close to just calling back the the number and my transcript did voicemail it's right there and so that's one of the scams that's out there that's not directly tax related but that's how sophisticated that they are are getting right now well again what we're seeing a lot of in the tax industry right now is a lot of ransomware attacks and if you follow the news and the tech world you know 23 and Texas government the city of Atlanta and the city of Baltimore and the city of Baltimore released the actual monetary cost publicly I've let the ransomware to attack cost and I was eighteen point two million dollars makes you sick and in and it makes you sick and the way ransomware works is it's other than the creator of the actual ransomware virus or software if you will that's installed on your machine the keys to unencrypted the data are only in the mind of the creator they can't they can't be reversed I think I saw a stat somewheres like some tons of man years to try to reverse a well-written hashkee so yeah and that just kind of goes back to a number of things because the like you said the vectors they can use to try to affect you with that can be phishing emails it could be if they run a script or something that takes advantage of an unpatched vulnerabilities which is with that one a cry thing we talked about that is that is how they did it like that people didn't patch their windows because they're like oh it's gonna be 30 minutes I got time right right and and and I think it's important to know I was right and I also keep dancing around this is that not one not there's not one piece of this that's gonna protect you it's all everything has to come together it's all part of the same picture so please stop clicking on things like you said - you've got that phone call but you instead called the main number and that's one thing you might have seen a phishing email - because they try to spoof like sales she might get something from Burks and it says click on our flier here and it'll take you to the sales what you can do instead oh got an email from Burke's there's a sale huh I'll just go to my browser type in the actual Burke's website and go to that instead alright stop clicking Orion stop clicking you know it's like the big red button you just have I can't help myself we we've tied my niece that red means hot it's kind of protect you know our phones and stuff like that she's two and a half and if she sees anything reg gets hot away from those red buttons that's right alright I think that's it for us today Jamie thank you so much for being here again for having me see you all on the next taxing subjects podcast you