Cyber Score Comparison for Accountants

Cyber Score Stack Up for Accountants: Secure Your Data & Win More Clients!

As a cybersecurity blogger, I've delved into the practices of various industries, and recently, I conducted a comprehensive study of the cybersecurity measures of 1000 accounting firms across America. This post shares my findings and highlights how accountants can use robust cybersecurity as a marketing advantage to attract and retain clients.

Why Accountants Need Robust Cybersecurity

Accountants handle a treasure trove of sensitive financial data, making them prime targets for cybercriminals. A breach can lead to financial loss, reputational damage, and loss of client trust. Therefore, robust cybersecurity is not just a necessity—it's a marketable differentiator. An accountant with strong cybersecurity measures can convince prospects that they are more secure and reliable than their competitors.

Dark Web Breaches

One of the first parameters I investigated was whether the corporate email addresses of these accounting firms were included in dark web breaches. By searching through dark web breach databases, I found that a significant number of firms had their work accounts exposed. This exposure can lead to data breaches, putting sensitive information at risk.

Findings:

• Over 83% of the firms had at least one email address found in dark web breaches.
• Imagine all the Social Security Numbers and bank account info that are just sitting unprotected 🤯

Potential Exploits by Cybercriminals: Cybercriminals can use these breached email addresses to launch phishing attacks. By pretending to be trusted sources, they can trick employees into revealing sensitive information or clicking on malicious links that could infect the firm’s network with malware.

Positive Tip: Regularly change your passwords and enable two-factor authentication. It's simple, and it puts you ahead of many in your industry.

Email Impersonation Protection

Email impersonation is a common tactic used by cybercriminals to trick employees and clients. To combat this, firms need to have proper DMARC, DKIM, and SPF settings in their DNS records. These settings help prevent criminals from sending emails pretending to be from their work accounts.

Findings:

• Only 14% of the firms had proper DMARC, DKIM, and SPF settings.

Potential Exploits by Cybercriminals: Without these protections, criminals can easily impersonate firm employees in emails. This could lead to fraud, as clients might be tricked into making payments to fake accounts, or employees might unknowingly share sensitive information with attackers.

Positive Tip: Implement DMARC, DKIM, and SPF settings for your email. It’s a one-time setup that significantly boosts your security and puts you ahead of many firms.

Secure Email Gateway

Using a Secure Email Gateway is crucial for providing spam and phishing protection to employees. By checking the MX records, I assessed whether firms were using valid Secure Email Gateways.

Findings:

• About 76% of the firms were using a Secure Email Gateway.
• 👍 That is a great sign that accountants are improving their email security!

Potential Exploits by Cybercriminals: Firms without a Secure Email Gateway are more vulnerable to phishing attacks. Phishing emails can trick employees into giving away login credentials or other sensitive information, leading to data breaches or financial losses.

Positive Tip: Invest in a Secure Email Gateway. It’s an easy way to filter out spam and phishing attempts, making your firm much more secure.

Website Security Settings

A secure website is vital for protecting visitors' data. I analyzed the HTML code of the firms' websites to check for essential HTTP security headers, which prevent session hijacking, cookie theft, and data interception.

Findings:

• Only 7% of the firms had the necessary HTTP security headers.
• While that sounds low, that is still 7x the number of Car Dealerships that have secure websites

Potential Exploits by Cybercriminals: Without these security headers, attackers can intercept data transferred between the user and the firm’s website. This could result in stolen personal information, which can then be used for identity theft or sold on the black market.

Positive Tip: Ensure your website has the necessary HTTP security headers. It’s a straightforward upgrade that keeps your data secure and gives you an edge over less secure competitors.

Web Application Firewall

A Web Application Firewall (WAF) helps prevent malicious actors from abusing a website. I checked to see if the firms used WAFs to protect their online presence.

Findings:

• Just 36% of the firms had a Web Application Firewall in place.

Potential Exploits by Cybercriminals: Without a WAF, firms are more susceptible to attacks such as SQL injection or cross-site scripting, which can compromise the website's security and potentially allow attackers to access sensitive backend data.

Positive Tip: Deploy a Web Application Firewall. It’s a robust defense mechanism that will put you miles ahead of firms without one.

Website Encryption

SSL certificates are essential for encrypting traffic between a visitor and the website, ensuring that data remains private. I checked if the firms' websites used SSL certificates.

Findings:

• Around 90% of the firms had SSL certificates.

Potential Exploits by Cybercriminals: Websites without SSL encryption make it easier for attackers to intercept data being transmitted. This could lead to stolen personal information, such as credit card details or personal identification numbers.

Positive Tip: Make sure your website uses an SSL certificate. The padlock icon on your URL bar isn’t just for show—it’s a sign that you’re protecting your clients’ data.

Conclusion

The findings from this study highlight a worrying trend in the accounting industry’s approach to cybersecurity. Despite the clear and present dangers of cyberattacks, many firms are not taking adequate steps to protect their data and their clients.

Key Recommendations

1. Regular Dark Web Monitoring: Firms should regularly check dark web breach databases for exposed email addresses and take necessary actions, such as changing passwords and implementing two-factor authentication.
2. Implement Email Authentication Protocols: Setting up DMARC, DKIM, and SPF should be a priority to prevent email impersonation and protect against phishing attacks.
3. Use a Secure Email Gateway: Investing in a Secure Email Gateway can significantly reduce the risk of spam and phishing attacks.
4. Enhance Website Security: Firms should ensure their websites have the necessary HTTP security headers to protect visitors from session hijacking and data interception.
5. Deploy Web Application Firewalls: A Web Application Firewall can provide an additional layer of security against cyberattacks targeting the website.
6. Adopt SSL Certificates: Ensuring that all website traffic is encrypted with SSL certificates is fundamental in protecting visitor data.

By taking these steps, accounting firms can significantly improve their cybersecurity posture, protect their valuable data, and build trust with their clients. Cybersecurity is an ongoing process, and staying vigilant against new threats is essential for the long-term success of any small business. Remember, robust cybersecurity is not just a shield—it's a competitive edge! When you make sure you do the cyber basics, you'll be better than most accountants in your industry.