Use Caution When Storing Financials in the "Cloud"
P. Simon Mahler
Lecturer | Consultant | Author | Key Note Speaker | Small Business Champion | Economic Development | Podcast Host | Social Impact Design |
Businesses used to fret about sensitive documents, often keeping them stored under lock and key in safes, desks, or file cabinets. Today, so much data is exchanged electronically that hard-copies are usually produced only when necessary. But the need to protect this information is more important than ever, particularly since so much data is being stored in the "cloud"--on Internet servers rather than on-site.
Is the "Cloud" the right place for you?
Like many small business owners who understand the basics of advanced technology, a question one might be asking is: What are some key characteristics of why my small business may like to use the cloud as a means to protect our critical financial information? According to the experts, the benefits of using the "cloud" can be significant just for general business purposes. When you consider factors like agility, cost, productivity, and security as just some of the cost saving factors, it can really add up for unforeseen opportunity for any small business.
But let's take the "cloud" concept a degree further and discuss the hot topic of having your accounting services managed on a "cloud" system. Why most of you are used to the desktop measure of keeping track of your financials, and may see that as a great way to manage your financials, having the "cloud" as your tool could be a wise decision when it comes to being a niche company that is agile and unique.
According to First Fruits Accounting CEO Adam Diaz, he shared his list of pros and cons as to why one should consider moving to the "cloud" when it comes to their accounting. He says "the advantages of "cloud" accounting include the ability to access your financials from anywhere, always being backed up and supported, and most have smooth bank feed features however, it varies from platform to platform. Add in the ability to make it mobile friendly for your customers or your business, which comes at a cost of functionality, and you could end up being very dynamic when it comes to running an efficient business."
Are you convinced yet? Already, nearly a quarter of small and medium-size business data resides in the cloud according to software security firm giant Symantec. So what could possibly be the challenges of cloud accounting for my small business?
According to Adam Diaz of First Fruits Accounting, he says "with every upside, there are some downsides to consider. Disadvantages of cloud accounting typically include slower running speed than desktop applications because it is browser based. This is not a big deal if you are not in a hurry or only are doing a few transactions. Being in a browser based environment all day can become tedious and slow." He furthers mentions that "an additional drawback is the potential threat of information being misplaced or hacked." While this may or may not be a concern of yours when doing your accounting in the cloud, he does see the potential there as a possible threat, and so does Symantec.
While cyber criminals rank highest among the threats to cloud-based data, Symantec recently assessed the many routine ways by which file-sharing can increase the vulnerability of sensitive data falling through a proverbial "digital crack" and ending up in the wrong hands. Among them:
Mobile Devices. Symantec found that 54 percent of employees are now relying on mobile devices for line-of-business applications. Because employees may be using their own phones or tablets, it can be difficult for companies to control data that is accessible by mobile devices. Countermeasures such as remote wipe (erasing all data on a device from a separate location) or locking access to shared folders can help prevent data breeches, and limit the damage in case a device is lost, stolen, or misplaced.
Competitors. Most accurately, the source is a former employee passing data to a competitor. According to Symantec, more than half of employees who stole intellectual property, did so by using email, remote network access, or network file transfer to remove the data.
Cloud Vendors. When evaluating cloud vendors to manage your accounting, make sure you can remove access or wipe information once an employee leaves. Also assess how much the vendor emphasizes data privacy and security. A small start-up vendor may be less expensive than a well-established firm, but also lack the resources and commitment to fully protect their customer's data.
A good source with keeping up with cloud security trends and protective measures is the Cloud Security Alliance (cloudsecurityalliance.org), a not-for-profit organization dedicated to promoting the use of best practices for providing security assistance within cloud computing. The website offers several downloadable guides and reports to help you shape a security strategy suitable for your small business.
Get Focused. Get Busy. Get Launched!
P. Simon Mahler, recently nominated as an 'Expert' Influencer in North America for small business, currently volunteers for the SCORE organization as part of the "Mentors to America's Small Business." Dedicated to building stronger economies in small communities and launching his next start-up, Pando Logic, Simon is committed to the future success of each and every small business in small towns across the country. He is always available to take calls for action and is willing to mentor to every small business out there across the globe. Find him on social media and connect to get growing!
Here are a few other posts written by Simon that may interest you:
Owner at Irrigation Logic
9 年Great article! Adam Diaz, MT even showed it to us in class!
Manager at CZA Energies
9 年nice!!!
facilitator at tri-O-lithic Developers
9 年good points...wonderful discussion...this should be discussed on an ongoing basis!!!
IT Leader | Cloud Infrastructure | Information Security | Servant Leadership | Workflow Optimization | Change Agent
9 年This article is a good introduction to the topic, but skims the surface of a number of facets to the challenge of deciding whether cloud service is the right answer. First, we're all under pressure to determine what our "special sauce" is insofar as value to the business is concerned, and to find others to manage those we don't consider to be our core competency. Second, we now live in a world where our customers and employees are demanding ready access to all manner of services for consumption and productivity, and that opens us up to real risk of exposure through threats to the endpoints used to access said services. The way to reconcile it is to answer a few questions: 1. What is the risk of exposure of the data? I don't imagine any data classification process results in financial data being labeled as anything other than sensitive/confidential data, but the question is what damage is caused if it were to be breached. If I'm a multi-billion dollar public company with a well known brand, that's arguably a much different risk profile than a startup. 2. How am I able to control the endpoints? A perceived advantage of an on-premise platform is that it typically requires resources getting onto the corporate network to access the data, which is (mistakenly) considered a safe haven. As Johnny Kessel points out, e-mail can easily be the end of us if we still allow data to be forwarded indiscriminately without systems such as DLP in place to prevent data leak. On the flip side, a SaaS platform usually means you're trying to enable a mobile workforce, and so now you have the challenge of securing all your endpoints to ensure these are trusted devices accessing the data. Even if you don't embrace BYOD, you still need controls to validate that it's one of your authorized resources using the device. 3. How much do I trust the vendor's security controls? Due diligence sounds like an obvious requirement, but I can't count the number of times I've heard of colleagues blindly signing contracts with SaaS vendors without involving TechOps or CorpSec teams to vet their controls. You still run the risk of them being negligent, but you assume that risk with your own staff too. I've neglected other facets here but the point is that there are several points to consider before coming to a conclusion as to whether SaaS for financials makes sense. Ultimately, if you decide the risk/reward calculus works in your favor, you turn to contractual terms to be your safety net where you've properly executed on controls you still maintain and your vendor fails you, though at that point being front page news may negate any value of any terms you negotiate. If you're uncomfortable with any of the three points above, SaaS probably isn't the best fit for your org.