What To Do If Your Firm Gets Hacked

[Elrod]

  Imagine this. Your firm starts receiving calls and emails from clients saying they’ve been the victim of tax refund identity theft.

See more at........http://www.cpapracticeadvisor.com/news/12219907/what-to-do-if-your-firm-gets-hacked

[Jack from Ohio]

Our firm has NO internet connection to our data server in the office.  We do NOT collect client information on our website.  We do NOT allow access to our system from outside the office.

Problem prevented.

[Medlin Software, Dennis]

Jack - Nope, problem not prevented.  You still have to practice safe hex.  Received a new computer (late '80's) where the hard drive already had something nefarious on it.  It was the person/store who put together the computer who caused the problem.  Could get something internally, via using some sort of media for backup (assuming you are backing up).

Safe hex is the only prevention.  No software or hardware action can protect you.

[Jack from Ohio]

28 minutes ago, Medlin Software said:

Jack - Nope, problem not prevented.  You still have to practice safe hex.  Received a new computer (late '80's) where the hard drive already had something nefarious on it.  It was the person/store who put together the computer who caused the problem.  Could get something internally, via using some sort of media for backup (assuming you are backing up).

Safe hex is the only prevention.  No software or hardware action can protect you.

Server was brand new.  I built and configured it.  Backup to external HD only.  No internet method of access to the server.  No external method of access to the server.  HD is also encrypted using Small Business server 11.  I have no fears of my clients' information being hacked or stolen from outside sources.

Our website does not connect to our server and does not collect or store client data.  I have chosen the KISS method of hacking protection.  The more complex and intertwined servers and the internet in any manner are, the easier to be hacked.

[Gail in Virginia]

Just curious, Jack, if you have no connection to the internet how do you update software and e-file returns?

[Abby Normal]

He can download the updates on another computer with internet access and just copy it to the networked computers, but I don't know how he would efile without copying data files to a computer connected to the internet. Does not seem worth it to me.

[SaraEA]

I would think that if workstations can connect to the internet, and those same workstations can connect to the server, the server can get hacked.  There are a lot of really brilliant hackers out there.  Jack has a multitude of precautions to thwart them, but I've given up hope that anything on a computer is 100% safe.

[Pacun]

13 hours ago, SaraEA said:

I would think that if workstations can connect to the internet, and those same workstations can connect to the server, the server can get hacked.  There are a lot of really brilliant hackers out there.  Jack has a multitude of precautions to thwart them, but I've given up hope that anything on a computer is 100% safe.

Correct. Users will get infected and hacked then the server will be exposed.

[Terry D EA]

I am not a computer specialist by no means. I agree that no matter what you do you are never 100% safe. One sure fire way is the shut the computers/servers down every day when closing the office. For most of us, that is not feasible.

[Roberts]

On 6/16/2016 at 2:17 PM, Gail in Virginia said:

Just curious, Jack, if you have no connection to the internet how do you update software and e-file returns?

Yes, I'd love to know how you efile if you aren't connected to the internet.

Downloading an update onto a zip drive and installing onto your server is NOT that much safer.