What CPAs Should Know About Encryption and Data Integrity

As the roles of CPAs and other accounting professionals change thanks to advancing technology, it’s more important than ever that they understand the fundamentals of cybersecurity. As accounting work continues to migrate more into the cloud, CPAs need to be more tech-literate and know how their clients’ data is protected in the cloud.

Clients expect their accountants to be knowledgable in how personal information is safeguarded, especially if that majority of documents passed back and forth are digital.

Encryption

Encryption is a form of digital cryptography that algorithmically scrambles data into an unreadable or unusable form, with the only way to decipher the data being through the use of a corresponding key. Anyone who intercepts the transferred data can’t decrypt it without the key, rendering it useless to them.

Encryption can be broken down into two categories: symmetric and asymmetric. Symmetric encryption utilizes a single key to encrypt and decrypt data, while asymmetric utilizes two – a private key and a public key.

Since symmetric encryption uses a single key for encryption and decryption, when transmitting data, the receiving client must already have the sender’s key in order to read the data. In asymmetric, the recipient’s key, which is public and available to all, is used by the sender to encrypt the data, which is then transferred and can only be opened with the recipient’s corresponding private key. 256-bit AES is the encryption standard adopted by the federal government and countless other entities, including FINRA and the SEC.

eFileCabinet utilizes a constantly maintained SSL/TLS security protocol for its file-transfer features and files stored on the server are encrypted under 256-bit AES. When sharing a file, the receiver is directly brought into the secured environment to download the file. In other words, when using eFileCabinet to share sensitive documents with clients, it doesn’t put the document into a lockbox and mail it to them along with the key. Rather it brings the client to the bank vault, where they open the lockbox under tight security.

Data Integrity

When storing financial information, accountants need to be positive that documents remain accurate, secure, accessible, and consistent. There are several areas of data integrity that they should be aware of and ensure are protected from things like human error, hardware error, cyber-attacks, and other threats. 

The physical integrity of data requires protections to ensure that if the hardware that stores data fails or is interrupted, data can still be recovered and accessed. There are several ways to ensure physical integrity, but the most common and often best way is through diligent backing up of data. Data should be backed up to, if possible, multiple storage destinations that are in separate locations. Anything from natural disasters to power surges can compromise access to data, so having it cold-stored in an off-site location is invaluable. Other strategies to ensure integrity is to use redundant-centric hardware such as RAID servers and to have procedures or software in place for fast data recovery.

The other area of integrity that needs to be protected is logical. These are protections that involve cybersecurity, to prevent attacks from malicious parties, as well as access control to prevent tampering from internal sources, intentional or otherwise. It also involves protections to ensure data is accurate and that human-error is prevented.

Permissions for limited users as well as governance rules that prevent certain files from being edited or deleted until a designated amount of time, ensure the integrity of documents that need to retained and untampered. 

Rubex by eFileCabinet is a document management system that utilizes encryption and several of the protections required for data integrity, including consistent backing up of data and strong access control settings. To see Rubex in action, click here to schedule a personalized demo.