Posts by admin

Editor's note: Melissa Derr is Director of Digital Forensics and Response at Critical Defence, LLC. We're delighted to share her expertise in cyber security with our audience.

Even though small to mid-size businesses (SMBs) are a primary target for cyber attackers, they remain underprepared to prevent, detect, respond to, and recover from an event. A 2017 report from the Ponemon Institute reported that 54% of SMBs had reported they suffered a data breach in the past 12 months, costing on average just over $1MM in direct expenses, plus additional indirect costs of over $1.2MM.

The numbers are staggering, but the realities remain: most SMBs lack proper budgets to implement the effective security controls that larger companies can afford, nor do they have the staff capable of protecting their technology. So, what can you do about it? Here are a few relatively simple solutions to get you started in the right direction.

1. Identify key risks

Before you can even begin to protect your SMB from cyberattacks, you need to first identify potential vulnerabilities, threats, and risks to your company. Vulnerabilities that most SMBs will find applicable to them are unpatched software, poor employee digital hygiene and unmanaged/unidentified devices on the company network. Cyber threats to most SMBs include the loss of proprietary data/intellectual property, loss of customer data, and loss of control over corporate technology assets.

Once vulnerabilities and threats have been identified, you can more fully understand the organization’s cyber risk. You should plan to patch software as soon as updates are available, encrypt sensitive data at rest, train your employees to detect potential social engineering tactics and phishing emails, and establish a policy prohibiting unmanaged devices on your company infrastructure. Once the policies are in place, make sure you are doing your best to regularly enforce them.

2. Educate Employees

Educating your employees about your key risks and cybersecurity policies is essential. According to independent researcher Ponemon Institute, the number one cause of a breach at SMBs was a negligent employee. Whether it be by clicking a link in an email, web-browsing at insecure websites, downloading software from unofficial sources, or accidentally sending an internal email to an unintended external party, your employees have more impact on the security of your organization than you might realize.

Employees should be aware of the policies you have regarding good digital hygiene, including prohibiting password reuse, safe web-browsing practices, and password length requirements.

While formal cyber security awareness training is ideal, it could be cost prohibitive for smaller businesses. The US Department of Homeland Security’s “Stop. Think. Connect.” campaign, however, is a free resource with sample fliers and internal communications to help you get started.

3. Deploy an endpoint monitoring solution

Detection and remediation is essential to your SMB’s security posture. Monitoring and updating all your endpoints is not at difficult as it used to be; a number of reasonably-priced, cloud-based solutions are available. Earlier this year, PCMag reviewed 10 of the industry leading endpoint protection platforms for small businesses, starting as low as $1 per endpoint per month. These tools can provide anti-virus coverage, quarantine or remove malicious files, email filtering, URL protection, and patch management all in a web-based management console. If you only have room in your budget for one security tool, an endpoint protection solution is your best bargain.

4. Have a back-up plan

No one ever wants to plan for the worst, but as half of all SMBs reported they had suffered a breach, chances are you’ll need a recovery plan. A recovery plan is needed to outline how you will continue business operations in the event of a cyberattack. How will you process payments if your payment system is compromised? What happens to your intellectual property if all your systems are infected with ransomware?

One easy solution is to take regular backups of business-critical systems and data, and store them OFFLINE, so you can recover with relative ease in the event of an incident. You may want to consider building in redundancy in the event of failures. And most importantly, regularly test the solution to confirm it will work in the event you need it.

Cyber attackers have set their sights on small and medium sized businesses. But small businesses often lack the proper budgets, staff and expertise to secure themselves properly. By implementing a few basic solutions small businesses can greatly enhance their security posture. While this is not a comprehensive list of everything you can do to secure your SMB, we hope this provides you with a good place to start. Attackers will continue to target SMBs, and it’s in the best interest of both the consumer and the SMB to be protected. Additional resources are available through the Nations Cyber Security Alliance.

About Critical Defence

Critical Defence, LLC is a global provider of cyber security services including, but not limited to Assurance, Response, Compliance and Training. Additional information can be found at www.criticaldefence.com.

In 2013, Michael Krigsman estimated that the global cost of failed IT projects was around $3 Trillion. The stats from the year before, according to the Standish Group, estimated that 1 out of every 6-7 IT projects ends in failure.

These numbers, collected by Adam Bluemner for FindAccountingSoftware.com, might make you question whether you should risk upgrading your digital tools. Certainly such a major decision requires a sober look at the realities, with the possible expense of a bad software roll-out being measured against the ongoing expense of less effective tools. But even more consideration should be invested into preparing for success.

That's the help provided by Bluemner's article, "How to Ensure Success in Your Accounting Software Project." He points out that a company doesn't have to stress out if they don't have a giant-sized budget or a brute-force legion of tech staff to make an accounting software implementation go well. Concentration on solid project management is the key. Bluemner highlights the Standish Group's MVP factors: executive management support, user involvement, and optimization.

Executive Management Support

This is more than just getting permission. Support from top members of your organization will not only help remove roadblocks for a software upgrade, but will also ensure that any planned upgrade is lined up well with the larger vision of the company's progress. It's never good when the shiny, new accounting program zigs, but the company overall needs to zag.

To help get this executive support, you can explain a few vital factors about upgrading an accounting software. Modern tools maximize efficiency, automating repetitive processes. This can create an impactful cost reduction, which most decision-makers will find attractive. (For help in estimating this ROI, you can use FindAccountingSofware.com's calculator.) Also, while some IT projects deal with unproven technology that makes it hard to predict the results, most accounting software packages have been deployed many times, making this a low-risk upgrade.

User Involvement

While high-level employees can offer guidance on direction, the front-line employees are often the best source of information about benefits that can come from automation. The repetitive or complex processes they deal with each day are what you'll want the new accounting system to address. So these folks are the best place to get input on what the ROI from an improved software package can be. Also, you can invite them to participate in software demos. These users will be able to point out weaknesses and strengths, and respecting their expertise will increase their interest in helping the project succeed.

Optimization

This refers to an optimized project — one with careful plans and focused scope. These preparations might seem to delay getting things done, but they can have a crucial benefit once the ball starts rolling. You should organize a needs analysis interview to verify the key requirements for the new accounting system. This also enables you to identify the fundamental baselines:

• Scope — What functionalities are high and low priority for your company? What benefits will each of these features bring to your business?
• Cost — To meet your functional needs, what is the estimated cost?
• Timeline — How long will the deployment take, including installing, configuring, and training?

Bringing experts into this conversation is one of the best ways to make sure these measures are relevant and accurate. And the best vendors will provide this type of consultation as a free service.

You don't have to leave your project's success or failure up to a roll of the dice. With diligent preparation, you can be sure that deploying a new software system — whether it's accounting, CRM, or ERP — will be a win.

One of the complicating factors for a new system is integration with other legacy software; not being fully integrated is also one of the most common causes of inefficiencies. While updating the accounting package will have definite benefits, bringing all the operational software up to par at one time greatly enhances those benefits. aACE 5 is a robust yet affordable business operations suite that includes accounting, CRM, ERP, and more. As an easily customizable, cross-platform solution, aACE 5 can help streamline the flow of information for companies in professional services, wholesale distribution, light manufacturing, or other industries.

If this information we've shared makes sense to you, as sharp small and mid-sized business owners will recognize, then the next step is to find out more. Our past clients are almost unanimous in calling aACE 5 a five-star product, as you can see in our Capterra reviews. We've devoted many hours to understanding and supporting their unique business needs and we're willing to do the same for you — SME's like yours are a vital part of the American economy. So before the distractions of the day make you lose track of this opportunity, contact our sales team for more information.

"In 2008, our company began searching for a technology partner that could help us migrate our 'closed' accounting software to an integrated, FileMaker-based solution. Our project required a high level of detailed data conversion with tens of thousands of records. The success of this migration was highly dependent on finding the right skill-set. [aACE Software's] attention to detail and ability to understand our goals was exactly what we needed. With insight and understanding, they helped us make one of the most significant technology updates in our company history!" ~ Bryant Wilson, CEO, On Hold Co.

The worst thing you can do, when your customers want to talk about one thing, is to force a conversation about something else. And it's obviously not a very nice way to talk with your co-workers, neighbors, or family. However the tech industry may be making this kind of gaff with its marketing.

According to one observer, there seems to be a significant disparity between what companies are trying to promote for technology improvements and what customers feel would actually be a valuable enhancement. Code is a company based in Manchester, England. They specialize in helping companies offer the most valuable digital products and services possible. To do this requires staying in touch with what makes a digital product/service valuable — that is, what customers are interested in. At the end of 2016, they made some observations and predictions about tech trends. Then they had the humility at the start of 2017 to double-check their claims against reality.

The resulting infographic shows a noteworthy disparity: digital promotions are talking about one thing while the actual consumers sampled want to hear about something else. The most striking example of this disconnect is a comparison of the number of late 2016 news mentions versus the level of customer interest about augmented reality tech:

• 24,200,000 mentions in news coverage — the most prominent topic
• 12.9% of customers interested — the least interesting topic

 The immediate conclusion is that folks who spend their days watching the tech scene aren't the most in-tune with customer interests. This means that if your small or mid-sized business isn't already developing a virtual reality aspect of your products or services, you're probably just fine. No matter what the hype, buzz, and gurus might say.

In fact, the survey by Code gives some excellent advice on what you should focus on. The clear majority of customers said they want to see improvements to existing offerings. For different companies, this will mean something unique. Obviously, a light manufacturing company, a professional services business, and a retail organization won't be able to make the exact same improvements. But every SME can use the same principles to start gathering input from your clients and use that feedback to guide improvement.

From the Code survey, some additional, generally applicable findings are that consumers want:

• more responsive customer service
• better information about what they're buying
• less intrusive tech
• more convenient interconnections between their various online accounts

This final preference from consumers is just as relevant to your own staff. Outside of work, they are consumers, so they understand that technology can be designed to be clean, clear, and easy to use. Those expectations transfer over to the tools they use on the job. If your business operations software doesn't facilitate their work, then its causing needless friction and reducing your team's effectiveness.

aACE 5 is an outstanding example of software developed based on user feedback and organized for clean, straightforward functionality in accounting, CRM, and ERP. It integrates every aspect of your business, ensuring that information from the warehouse is usable by staff in the accounting office and the leaders in the strategic planning session. aACE 5 is built on FileMaker, so it runs smooth on Mac and PC, on desktop and mobile. It can be customized easily to integrate the unique, hard-won expertise that you've accrued through your past years of business.

This powerful functionality is paired with competitive pricing that makes it a compelling alternative to open-source solutions like xTuple, browser-based solutions like NetSuite, or client/server solutions like QuickBooks, Dynamics, and Sage.

Get more answers about how aACE 5 can accelerate your business velocity today.

"Their system covered our work process from start to finish. aACE has the ability to support our company, help us manage our business as we continue grow, and be easily customized to our workflow." ~ Lili Hall, President, KNOCK Inc.