Protecting Yourself Against Data Theft

Protecting Yourself Against Data Theft

by Michael Ehart, CISSP, etc.

There has been a rash of reporting of data theft lately that has a very strange effect of causing many to become complacent about their data protection measures because, after all, their system is working.

The problem is that there is no way to know if your data is bulletproof. You can only be certain when it is not, and you have evidence that your security has been breached. The vast majority of data theft is undetectable and unprosecutable, because unlike physical theft the stolen data is still there. If someone sneaks into a museum in the dead of night, dressed in spandex and night goggles and makes off with a Bottecelli, in the morning there is a big square of unfaded wall, an empty nail, a light dusting of tracked-through laser-detection talcum powder and no painting. 

The problem with stolen data is that most of the time there is no way to know that your system has been breached, or if it has been, that anything is missing because nothing is actually missing.

So what do you do to keep your data secure? The threats come in three flavors, and there are steps that you can take to protect yourself from each one.

1. The Barbarians at the Gates. There are people out there who don't like you. There are people out there who don't care about you, but want what you have. And there are people out there who don't care about you, or what you have, but want inside just because they can. These are the folks that firewalls were invented to thwart, and I assume that you have covered this loophole. Firewalls, encryption, strong passwords, and some sort of Intrusion Detection System (IDS) cover you there. If you don't understand or like this stuff hire someone who does. A competent IT security consultant can set up security for most small offices in a few hours of system hardening. Do make sure that the contract includes some basic training for your users concerning the changes and best practices.

2. The Enemy Within. Far more likely to cause you grief is the viper cherished in your bosom. No one knows for sure, but I would guess that the retail model applies here--- 90% internal theft. After all, who else holds the keys to your kingdom? Training, monitoring, set usage policies and careful terminal check-out procedures can help, but you never know. If you have 20 employees and they all seem perfectly content, either you are the shining example all other bosses should aspire to or at least 5% of your workforce is adept at hiding their dissatisfaction. I know which one seems most likely to me.

3. Stupid is as Stupid Does. And Stupid seems to be doing more than his fair share lately. Data theft is the classic crime of opportunity. "It was just laying there, so I took it." Or "The web site was unsecured" or "The safe was left open" or -one that I recently was asked about- "I left the box of records in the back seat, and someone borrowed my car." I love consulting, but dang, please make it harder for me, will ya? No more post-it notes with passwords conveniently stuck to the monitor, or so cleverly stuck under the keyboard. No more backup tapes on a shelf behind your desk, or stacked on top of the server. No more shared passwords for the entire office. 

Once again, if you don't know about this stuff contract someone who does. It is so very much cheaper and less stressful to spend a few bucks and a few hours hardening your system and providing a few hours of common sense training for your crew than it is to learn about your data disclosure from the guy with good hair and too many teeth holding the mike and standing sideways in your lobby so his cameraman can get a good shot.

Michael Ehart is a Certified Information Systems Security Specialist (CISSP) and carries certifications as a HIPAA Professional and HIPAA Security Specialist (among other things). Visit Michael Ehart's HIPAA blog Comply With Me

Finance and Accounting Support in Franchise Systems

Finance and Accounting Support in Franchise Systems

There has always been somewhat of a love/hate relationship between franchise operators and their franchisees.  While many entrepreneurs elect to leverage a known brand, documented operating procedures, and combined purchasing power that is often a benefit of a franchise operation, the reluctance to “open the books” to the franchisor is largely based upon a fear that “big brother” will use the information to take advantage of the business owner.  

Logic would indicate that both parties would recognize the validity of sharing financial and business performance data for the benefit of the entire system, where benchmark data and performance comparisons can become the basis of tremendous business intelligence.  But some franchisors, as their networks expand in size, find that their success in selling units begins to outweigh their concern for individual unit performance, and the brand value creates sufficient momentum to overcome a few bad business experiences.  Especially in larger systems, the franchisors don’t often consider the benefits of providing back-office and accounting support for their franchisees, because they simply don’t feel they have to. Reliance on quality accounting and financial data, however, may begin to take on an entirely new meaning, given the nature of the economy right now. 

High unemployment and low consumer confidence have caused spending decreases which have impacted even the strongest of established businesses.  With credit markets being as tight as they are, business owners are unable to obtain the financing required to expand their businesses when required, to new locations or with additional personnel.   The 2010 Franchise Business Outlook[1]  suggests that, even as the economy starts to recover, franchised small businesses will continue to face these financing struggles.  The forecast is for “a slow recovery with marginal increases in the number of establishments, jobs and output.”

Looking to Washington for help, a number of small business organizations, along with The International Franchise Association, are “calling upon Senators to include more provisions in new job creation legislation to help small businesses access credit.” [2] The fear is that if credit access for small business isn’t made available now, the best opportunity to create sustainable business and subsequent job growth will be lost.  Reliance by small businesses upon credit is unquestionable.  

According to the IFA, “the depletion of [SBA loan] funds last fall is proof that the SBA programs were, and continue to be, critically important for our nation’s credit-worthy entrepreneurs”.  However, without sound business accounting and provable data, even the most business savvy entrepreneur may find their business “unbankable” and must therefore rely upon personal credit guarantees to support business growth.

Possibly the strongest point in the argument for franchisors facilitating accounting and financial management assistance to the franchisee centers on Item 19 of the FTC and state Franchise Disclosure Documents (FDD)/Uniform Franchise Offering Circular (UFOC).  Item 19 is the Earnings Claim, which are estimates or historical figures detailing sales, expenses, and income a prospective franchisee might realize as the owner of a particular franchise.

The Earnings Claim is often considered to be the single most important factor in buying a franchise.  As with purchasing any business, it is critical to have a realistic and supportable projection of sales, expenses, and profits earned.  Particularly in a case where a potential new franchisee has no experience running a business, or no applied experience in that particular type of business, the earnings claim becomes the only guidance available.  Unfortunately, the only source for this information is the franchisor itself, which often introduces doubt as to the veracity of the data.  It is difficult to determine which could raise more doubt about the sincerity of the franchisor: using unverifiable data, or not providing an earnings claim at all.

When a franchisor elects to provide services to their franchisees, such as back-office accounting support or financial management oversight, then the opportunity to obtain data for the earnings claim, performance benchmarking, and royalties verification become realistic goals.  Further, the ability to verify and substantiate the data can prove invaluable in a tough franchise market where buyers want good, verifiable information, and Item 19 helps sell units.

Offering accounting support to small business owners isn’t a new concept, but the technology to facilitate a truly seamless relationship has only become available in recent years.  As Internet and Web-based application services emerged on the market, businesses flocked to them in order to gain the benefits of anytime, anywhere access to applications and data.  However, the poor performance and lack of features left some business users without the tools they needed to handle all their requirements efficiently, so many returned to manual or local PC-based systems. 

Application hosting approaches offer a technology model which adapts trusted and proven software and systems to a cloud-based, collaborative online working model.   This technology model allows the businesses to continue use of applications with the functionality required to support the business, but improves the IT environment by managing and securing the systems within a secure facility, and utilizes the resources of the service provider to facilitate the ongoing management and support of the systems.  

Owners are able to retain their investments in software applications and processes, while introducing new efficiencies and flexibility in their working model.  The evident benefits are the ability to access information from any location, to have multiple locations work seamlessly together, and to allow outside accountants or other service providers to work seamlessly in the organization.  

Application hosting services also offer centralized management and administration, professionally-secured systems, and deliver reduced costs of IT management, predictability in ongoing IT costs, and an improved ability for the business owner to focus on the business.  Further, the solutions delivered allow for the integration of data with reporting systems designed to assist in the translation, analysis, and comparison of data from a single business to an entire franchise system.

In summary, the franchisor market must look more closely at the fiscal management and reporting systems of their franchisees, and provide avenues to better-address accounting and bookkeeping responsibilities in order to gain credible performance data and useful benchmark metrics.   Only through the ongoing participation of accredited accounting and financial personnel can the business financial data provide the information – and the insight – required to support aggressive business growth in this difficult economy.   

The key is seamless integration, and the technology solution is the cloud-enabled model.

J

---

[1] Report that measures the economic impact of franchising in the United States, prepared by PricewaterhouseCoopers (PwC), and commissioned by the International Franchise Association Educational Foundation.  http://franchise.org/uploadedFiles/Franchise_Industry/Resources/Education_Foundation/2010%20Franchise%20Business%20Outlook%20Report_Final%202009.12.21.pdf

[2] Franchise.org Press Release http://www.franchise.org/Franchise-News-Detail.aspx?id=49246



 

QuickBooks POS in a Hosted Environment

entrepreneur.com

QuickBooks Point of Sale in a Hosted Environment

Retail operators and multi-location store owners often face difficulties in attempting to bring cohesion to their accounting, financial, and operational data.  In so many situations, the retail location –  where inventory is sold and money is exchanged – is far-removed from the administrative location where the financial systems and business reporting exist.  It seems that the best case scenario is to create a means for the remote (retail) locations to operate with real-time access to centralized customer, inventory, and financial data from a primary source. Application hosting services can provide this centralization,  and a platform for standardization, of systems.  Further, the application hosting model can deliver security and managed service which ensures that the systems are available and performing as required. 

Even though hosted applications and centralization of the systems and processes in a POS environment may appear to be the right answer, there are caveats and considerations that speak to the realities of today’s technologies.  These caveats should be strongly considered prior to undertaking any reformation of systems and processes relating to the retail locations.

The first fundamental reality which must be addressed is connectivity.  While a retail or store location may enjoy Internet or network connectivity, there should be great consideration given to the wisdom of connecting these locations only and exclusively via remote access systems.  Retail is a dynamic business, and the sale is made when the customer is ready and willing to buy.  Any retail location must be able to process this sale in order to meet the immediacy of customer demand.  If the systems in use are exclusively accessed remotely, then the connectivity to those systems become of paramount importance in the ability to do business.  At the very minimum, any remotely-served retail location should have redundant connectivity options, with local personnel being familiar with the connection failover process.

A second strong consideration for a hosted or remotely-deployed POS or retail system is local device support.  Devices, such as card readers, scanners, cash drawers, receipt printers, etc. typically require local PC/computer drivers in order to function.  When served by a remote system, this connection between the host and the local devices may not function.  Limited device support for POS hardware can significantly impact the location’s accuracy and efficiency.

Another area of consideration for POS and retail systems centralization is integration or synchronization of POS data with core accounting and financial data.  Depending on the software solution in use, this integration may require that the POS software/data and the financial software/data reside on the same computer and/or within the same network.  This may be one area where a hosted implementation may offer a great deal of benefits, but the benefits to be derived are often a function of the design and behavior of the applications integrating.

QuickBooks Point-of-Sale, for example, was designed for use on a single-user PC environment.  The application is not well-suited to a hosted deployment for multiple users, as the software only allows one instance of itself to run on each computer. While there is a “multi-store” option for this solution, the option requires all stores be connected via a LAN/WAN connection to the same network. RDS (remote data sharing) functionality might possibly be used to allow communication between locally-run POS locations and the “master location” at a hosting service provider, but this method of communication has previously been found to be somewhat problematic and platform-specific (see notes following relating to multi-user/store configuration and Vista OS).  Further, the potential poor performance of RDS connections often negatively impacts the value of the integration.  

In many cases, the suitable answer is to keep the POS systems running on the local computers and network, and run the financial applications and the POS integration at the host.  With an installation of the QuickBooks financial application and the point-of-sale solution with the hosting service provider, the core financial data is able to be secured and protected in the virtual environment without risking lost productivity (and lost sales!) due to connectivity failures at the retail locations.  The end-of-day process at each location is to then move a copy of the POS data file to the host system, where it would be integrated with the QB financial data.  In environments where is is desirable to have the POS systems reading customer and/or inventory data directly from the QuickBooks financial data files, the recommendation is to keep an available copy of the financial data file in the POS network, on the local computers.  This copy of the data file provides the point-of-sale systems with necessary customer and product information, and would be copied/updated during the same end-of-day process where POS data is moved up for integration on the host system. 

This process is very similar to the way in which a localized system might be utilized, where the POS application runs at the front counter and the accounting application and data run from a back-office system.  In this scenario, many businesses elect to simply log off from the front counter system so that they can launch the POS application from the back-office computer, and then integrate the POS data with the QB financial data on that same computer.  Even in remote network configurations (WAN configuration), this is often a method which delivers better performance and stability than utilizing the remote data sharing service.

J 

CRM Solution Gets High Marks from QuickBooks ProAdvisors

Results CRM offers robust features, yet is simple to use for small business users

Results CRM Solutions offer more functionality and features than most CRM solutions oriented for small businesses.  In most cases, a robust solution like this would require lengthy configuration and training efforts in order to make the system useful.  With Results CRM, however, a business can be up and operational within minutes.
 
The solution was recently reviewed through Intuit's ProAdvisor program, and got a rating of 9.75 out of 10!

From the review:
Results is extremely full-featured. Products with this level of functionality often have a complex architecture making them hard to learn and use. With Results, navigation and search functionality are simple and allow you to easily and rapidly access the data you desire.

Salvaging Business Intelligence

"Software-as-a-Service is becoming more and more accepted as a deployment option for enterprise systems. But if the application is truly mission-critical, be sure you have an escape plan in advance" says Frank Scavo of the Enterprise Software Spectator.In his recent article "SaaS: plan to get out before you get in" Scavo discusses the issue of vendor lock-in involving the use of software-as-a-service (SaaS) for mission-critical applications. He points out that "If you thought vendor lock-in was a problem with traditional on-premise ERP software, think about the issue when it comes to SaaS. Under a perpetual license agreement for on-premise software, you always have the option of going off maintenance but continuing to run the software, and perhaps maintaining it yourself.But with SaaS, there is no such thing as going off maintenance. If you stop paying, access to your mission-critical system gets cut off."

"Therefore, I think it is important for buyers to think about what will happen if and when they decide to migrate from their SaaS provider. Specifically, there are two things I believe that buyers should ensure are in their license agreements:

First, if the SaaS provider offers an on-premise version (e.g. Oracle On-Demand), ensure that there are terms and conditions that allow you to transition to an on-premise version. This covers cases where you want to continue to use the software but are no longer satisfied with the hosting arrangement.

Second, if the SaaS providers does not offer an on-premise deployment option (e.g. Salesforce.com), be sure the provider gives you the ability to extract all master file and transactional data to an open format (e.g. XML). The ability should be repeatable--not a one-time right--so that you can develop migration programs to facilitate conversion to a new SaaS or on-premise solution. "

Small Businesses should be particularly concerned about whether or not the solution will fit the needs of the business for an extended period of time and through a variety of business conditions. The small business should also determine if there is a way to continue use of the solution (or transition from the solution) if the solution or the provider stop meeting the needs of the business. Small business owners are particularly at risk, because the SaaS solutions oriented towards small business users often don't have the on-premises options that some of their enterprise counterparts offer. And small businesses are the ones who are most likely to need to transition to another solution as the business grows. Further, the small business user often lacks the technical knowledge to manage the conversion effectively, and doesn't typically employ skilled in-house IT personnel to handle it for them. The result: consulting dollars get spent, just to retain the data the business already has.

The issue is that you are either a customer or you are not, meaning that companies can't keep their old SaaS solutions around just for historic data unless they wish to continue the subscription with the SaaS application. This is of particular concern with finance and accounting applications, as they are the core of the business intelligence, and the source for tax data, compliance, etc. Keeping the financial data for long term access is a requirement for most businesses.

Any small business - actually any business - electing to adopt SaaS-based solutions should give great care and consideration to how the business information might be protected and utilized in the event of a transition away from the online service. "In general, a lack of standards hampers the portability of data and applications between systems", says James Staten, an analyst at Forrester Research. He indicates that, while the popular hype implies that moving to the cloud doesn't require any heavy lifting, that's not true in some forms of cloud computing. "Particularly with software and platform as a service, vendors use unique and proprietary interfaces, application programming interfaces (API) and databases. Users and 3rd parties must program to those specifications in order to take advantage of the system. If they grow dissatisfied with the service, or if the vendor goes under, data and/or applications would need to be reformatted in order to switch providers or move it back in-house, which could be complex and costly."

Application hosting services may be a means to deliver the benefits of managed online application services to the business without also delivering the risks involved with SaaS application adoption. By providing access to business applications in a managed, secured environment, users gain the benefits of easy access and simplified IT management without also facing difficulties when discontinuing the service. Hosted applications offer the ability to return to an on-premises operating model, delivering the flexibility and the scalability the business needs without the concerns of loss of valuable business intelligence.