By Kevin Hedrick, CPA
This month, WBL will begin using forced encryption for emails and attachments, in addition to the other data security best practices the firm currently employs, to protect and secure our clients’ sensitive information. Later this year, we also will begin using a new secure document sharing platform for audit clients and certain tax and accounting clients. This platform will be used on a project-by-project basis to share and collaborate on documents and spreadsheets.
New Security Measures Bring Added Peace of Mind
With new forced encryption, WBL will now use a separate protocol for sensitive messages and attachments which in most cases will not require the recipient to take additional steps to view the content. Most clients will not notice the change, as all emails sent from WBLCPA email accounts currently use “opportunistic” encryption that follows current TLS standard protocols. Under this method, servers that are compatible with TLS encryption methods send and receive encrypted emails. However, emails sent to servers with incompatible encryption methods are not encrypted. Forced encryption will enhance overall security ensuring that emails and attachments are encrypted from WBL device through to the recipient’s inbox. We can either password protect sensitive attachments in addition to the standard encryption, or not password protect, based on client preference. If a client prefers the alternate encryption method, which also encrypts emails in the recipient’s inbox, we are happy to comply. Security over the emails and attachments once they are received will be the responsibility of the recipient.
WBL’s Current Information Security Measures are Among the Best in the Industry
Like banks, brokerages or health care providers, CPA firms store, send and receive confidential information electronically. Sharing information electronically with our clients is convenient and efficient, but carries with it a potential security risk that we take very seriously. While we try to balance the need for security with convenience and ease of access, we cannot sacrifice security for convenience.
In addition to the new encryption method, WBL employs technical experts and engages outside IT consultants to ensure our security measures continually meet the highest industry and regulatory standards. We use a variety of hardware and software products and procedures including firewalls, intrusion detection software, antivirus software and network monitoring by outside consultants. WBL uses a secure web portal for transferring large files, such as copies of tax returns, and storing documents securely for later access (if you would like access to the portal, please let us know). In addition, we maintain onsite and offsite backups of all important data, use whole disk encryption on all WBL computers, and use certain cloud services that are maintained using very high security standards. Staff use Virtual Private Networks and multifactor authentication in order to maintain data security when working outside the office.
Finding the Best Balance for You
With these new measures, we are raising the bar on what we consider our minimum security requirements. Our clients’ preferences will continue to play a big role in how we communicate and share information with them. Please contact us to discuss the security measures you would prefer for us to use for communication with you and we will do our best to comply within this new, more secure protocol.