Cybersecurity for Legal Accountants

Welcome to Accountants LawPod, where accounting professionals and law firms converge. Hosted by Lynda Artesani, Sarah Prevost, and Stephen Libhardt.

Welcome back to the podcast, everybody. And wow, we're really crawling through the winter, aren't we? And actually, I should say we're racing through the winter, but easy for me to say because it was cold this morning. It was like 54 degrees.

Oh, poor you.

I know. It's going up to 73 though, so. It felt good. It felt really good. But I know it's not like that.

My daughter's like, "It's -1." I'm like, "Ugh." I know they've been getting a dumping up there.

It's been cold and it's been snowing and yeah. And she didn't get the snow. It wasn't, it was a snowstorm that was like coastal and she's way inland. So usually it's the other way around.

Yeah.

So, but she did get snow.

Well, and this is December in Denver and our lows have been in the 40s at night and in the 60s during the day. We just don't have, They're making snow with machines at the ski resorts and it's crazy weather.

Oh wow, that's interesting. Yeah.

Yeah, that's— We need snow.

Yeah. Well, we're going to have like the flood.

Well, I don't know how to transition from snow to cybersecurity for—

Well, it is a fringe topic.

Our topic is cybersecurity for legal accountants. So it's for people like us and we are really fortunate because we hired a company to do that. Not really priced for like the individual smaller kind of accountants, but they do a great job. I can sleep at night. My clients can sleep at night. They won't get any hacking from our side anyway, hopefully. Very, very good. And then Tiara found an amazing platform that we use, which I think the benefit of that is just—

Mm-hmm.

Every time I watch them, I'm like, oh, that could happen to me because it's all the little things that happen. And it wasn't that expensive, but it's little short videos that work well with my attention deficit disorder that I seem to have as I'm getting older. But also it just seems like just to keep things top of mind and you, and you can share them with people. So what was really nice about that program is that I can send it over to the other office here at my house and let him watch it and then be on top of, like, don't forward, don't forward me junk from your friends. I don't want you to even send it to my computer, you know. And those are the little— some of those stories are scary.

Lynda, it's relevant stuff. It's like current, like—

Very relevant.

What we have seen, our clients have seen, and what we've seen.

What we've seen happen with our clients too. Yeah.

So the app that we're using, Steve, to kind of get you up to speed too, is it gets deployed. There's, um, monthly and quarterly requirements. They're short videos. We take a quiz.

You have to pass.

Oh, nice. Yeah, but they are, to what Lynda was saying, it's, they're very relevant. They're little things that you wouldn't think too much of that have passed you by, but we're all so busy as accountants that could have passed, you know, like, or a client experience. We hear about our clients having fraud occur and how does it work. And it gives you some background. The app is Wiser, I believe.

Wiser, you know, the Z, right?

With the Z. This is not a paid advertisement or a sponsor of ours.

Well, not to mention who I'm looking at right now too. So go ahead.

Yeah, but this, this has been probably the easier one to deploy. So yeah.

Now you have it on all of your employees. Yeah, all your employees' computers and they're working all around the country. Yes. So let's talk about how that works.

Okay. So with our current previous system and our current system, we have what's considered managed devices. And there is basically oversight on their side. They have the ability to automatically update and install things remotely. They have the ability to remote into any of the devices and take a look at them.

Nice.

Nice. What Lynda and I opted to do, I don't know, Lynda, it was probably a year and a half, 2 years ago. We went from probably what's more of a traditional model. Hey, you have a laptop or we'll provide you a laptop. Here you go. But it wasn't managed and it's in a managed environment. So the employee's protected. And the only things that are allowed to be on that computer are the things that we provide access to. Essentially. So it's a controlled— like, it's not connected to their personal Apple. It's their own, because we use Apple. It's their own. It's a work email that the iTunes and all that are the other things that are on. There's probably a lot more to it than I'm giving it credit for because I used to manage it. And so out of sight, out of mind is where—

Yeah, it was Apple. Apple had their own thing, but it was very complex and we didn't get the service we're getting. And Yeah, it was expensive and we didn't get the service that we get now for sure, which I think we pay more for, but so personalized. Like if we have something come across, we can go right away and send it over to them and they're on it. So they're just really good.

They manage our Google accounts as well.

Uh-huh. Your which ones? I'm sorry.

Our Google, our Workspace, our Google Workspace. They manage that. They deeply integrated and understood kind of like what we wanted. We gave them We specifically looked for this firm and we gave them our criteria and the things that we want and don't want and the light touches that we are required to use on certain apps, but we have to have access to. So yeah, it's worked really well and I like so far their little, I think it's a bumblebee that we get on our computer. Yeah.

Yeah.

Yeah.

Yeah, it's a bumblebee. That's the controller and it updates our software. Yeah. So it knows when a lot of times your software is out of date and it updates it for you and lets you know that you're—

That's a nice feature.

Yeah. And it knows what software we use. Yeah.

But we have heavily discussed, to your point, Steve, and probably in your experience because you travel, VPN protection.

Yeah.

Ways that you're allowed to log into our system. That's why we're pretty serious about what tools you have on your computer. You're not sharing that computer with your spouse or your significant other.

We— So let's stop there for a quick second.

Okay.

With the VPN, one of the experiences I've had with the VPN on a computer and working with QuickBooks is that QuickBooks doesn't like VPNs because of their security. Platforms is what I've heard. I don't know, I'm not an expert on it. But every time I turn on a VPN and then work in QuickBooks, I have problems. Even when I use different browsers.

I didn't have that experience myself.

Oh, you did not?

Okay.

I'll never forget when we went to, I think it was—

St. Louis.

Woodards.

Yeah, it was a St. Louis event, yeah.

Yeah, and Scaling New Heights. And this woman was crying in the hallway. Or in one of the rooms we were in, I think lunch. And come to find out she had done some business work for her client. Is that how it went? Yeah. And she had gone online and got hacked 'cause she didn't— she used public internet there and it got hacked right there. And it was the poor woman. I mean, she was— it was one little mistake. But this is the thing about the program that Tiara has us on where we're like educating the staff. What's really good about it is that Wiser has a quiz. So you have to watch these little short videos and then it has a quiz and then a real-life story.

I like that.

Somebody comes on and says— and it wasn't that expensive, that Wiser, right, Sarah? It was pretty cheap, like $600 for the year. And it keeps you— and it's like Sarah said, it's up to date. So things that have current events, things that are happening, it'll be that.

So you'll get to We've made changes too, Lynda.

Yeah, the first weird was one of them was when we were watching it, it had just happened to one of our clients. The whole scenario was pretty much identical to what we watched on that video, and I was like, oh, but that hit home.

That did.

And like, your, um, when you share documents, Steve, it taught us what are the security protocols. Pertaining to those documents when shared.

Nice.

On whether they be in the Microsoft hub or whether they be on a Google Workspace hub, how you set your protocols, which I think Lynda and I both went, how are we set up? What does this look like?

Yeah, it does open your eyes, I'll tell you.

It does. Now you mentioned you're doing some other things before. I didn't wanna dive too far. Well, we'll share.

I'm looking at a platform now called Verito, V-E-R-I-T-O. And they do cloud hosting for accountants' computer systems. And they are, they make sure that you're IRS compliant if you're a firm that does taxes. And they customize the packages to solo and small firms or mid-sized firms, or, you know, even enterprise firms. And they host your software, they host your computers, they do your security. They do it all. And so I'm looking at that right now. And I ran across them when I attended a conference recently.

Oh, cool.

They were one of the vendors there.

Wow.

And I just really liked what I saw. And their pricing isn't bad either. And they have 3 different levels that you can choose from depending on the type of security that you want. And I was thinking about maybe seeing if you guys wanted to bring them in. I already talked to the owner. About maybe coming into our podcast and talking about security, internet security. But they're built specifically for accounting firms. They have 24/7 customer support. So if you're, you know, it's Sunday afternoon and you're working on your 1099s and something happens, you get hacked or whatever, they're right there to fix it. So I'm looking at them and I'm really, I've been looking for a lot of different ones. And you know, the thing to think about too for people who are, watching this podcast or listening to it is you do all of these things and you become IRS compliant. Let's say you're a firm that does do taxes, and so they call it WISP, W-I-S-P reporting, and they do all— they make sure that you're compliant with that. The thing is, is to consider is if you have somebody like this in the background supporting you, reach out to your insurance provider then and let them know that you're doing this, and you probably get a better insurance rate. Mm-hmm. Or here's what can happen too, is if you don't have this protection and you get sued because, you know, you were a client, get sued because of something that you did and it comes back to you, you may not be covered under your insurance because you don't have these protocols in place. You don't have this protection in place. So that's really something to think about.

Most tax offices have had this in place because of the requirement from a couple of years ago.

Yeah.

I think the big thing is, is that the bookkeeping firms and the firms that don't do tax, any accounting firm that's non-tax, you still need to—

You do.

You still need to work towards it. You still need to comply with it. You still need to take those precautions. So we've always had in place like private portal for communication and document uploading. We've always had that, which is Licio. Anything we've ever engaged with. I feel like—

Well, you know, like you'd mentioned Lysio, and I do a lot through our Financial Cents portal for document, you know, for document storage and sharing and all of that. And I even, like when I send financial reports, I even password protect them before they go into that portal. You know, I like to just make it as tight as I can.

Yeah, because you don't want to be the reason why somebody had their data breached.

That's right.

That's so true.

And then we have a client that, you know, we've had a client in the past that they were hacked and then they got hacked again because once you're on that list in the dark web.

Yeah.

Which is why Dashlane's pretty cool because we have the password protector system, but we can actually have it, I have to have it search all my emails in the dark web to make sure I'm not there. And then I have Cloaked on my phone, which is pulling my name and anything that I, give it off of the web. So you can't just search to see how old is she, or where does she live, or what's her phone number. You know, it's stripping all that down. You have to pay for all these things, but I think that it's worth it. I mean, we just— oh, my husband was just telling me that he was golfing with a friend of his and he was— he took a call during the golf match and he's like, that's kind of rude. And he goes, oh, you don't know, someone stole my credit card. Oh. Information and— no, not stole— started to apply for 3 or 4 mortgages in his name. So he locked his credit down. But these brokers, I don't know how they got around it. They were still trying to get the loan going. And he, he was really annoyed. I guess he took the call and he's like, you can stop calling me. You can't go any further because he had locked it down because you can freeze your credit. And he froze it because, you know, thankfully, I think one of them, one of the brokers is what saved him because the mortgage hadn't gone through because, and they called and he's like, I didn't apply for a mortgage. And somebody had his information and was applying for multiple mortgages.

It's happened to us.

Or loans.

We had this happen last week for my husband.

So.

It's horrible. Not the mortgage, but. Like the loan. Yeah. And it's, I think initially he was like, Oh, sort of passive about it. Well, it's not getting better. No, and it's not getting better. So I think regardless of the criteria of the things that you need to work to, it's just your own. Like Lynda was saying, it's your own protection. And we— and that's true. We use software for the passwords. We, we make sure that that's protected and that's inside It's not shared outside links at all. There's a lot of spoofing. There's a lot of fake invoicing, a lot of fake emails that happen. I just— it's endless.

Getting better and better too because of AI. Yeah. It's getting even better. I just tried the other day, which is kind of random and completely off topic. The majority of the number one songs in 2025 were created on AI.

I don't get it.

And then with the Auto-Tune, well, you know, AI is really good at like art and the things that you think would be harder, they're better at, right? Poetry, you would think that that would be really hard to replicate, but apparently it's not. But, and then Auto-Tune, every, I don't know, I'm in spin class, I'm like, who sings this? And she'll rant, you know, be a new song. Now who sings this? And she'll say who it is. And I'm like, That's not the Lost Girl because they all sound the same because of Auto-Tune. But yeah, majority of the songs this year, number one songs, were written by AI.

Wow. That's kind of sad for the lost art portion of it.

No kidding.

And then you notice like the millennial songs when I'm in class, the millennial songs are just songs from my era or—

Redone, yeah.

And they're redone but sped up because that's what, and they sound great. I think they sound great what they've done with it, but it's like you hear it and you're like, that sounds familiar. I'm like, oh, that's that song.

Well, the thing that's interesting too is I just thought about as you're talking, Lynda, is the encryption because you've got— since AI can do a lot with a lot of things, is one big thing that we've been is turning on that 2MFA, having the encryption, the extra layer. It is so painful. It's so frustrating at times. I get it.

Well, even the software is making you do the MFA and then Fortunately, we have a password protector that's got that built in so that we're able to all have the turn of logging in and not have to go ding somebody for a password. And did it go to whose text, whose phone, whose email? A lot of times I would hear from the team and I'd be like, they're like, 6 o'clock in the morning, I need a password. It's like, ah, where is it going? Where do I look? 6 AM, I haven't had my coffee yet.

Yeah. Yeah. Steve, the thing I know you're discussing on the solo side, but it is hard to navigate as a solo because so many tools are out there that are built for teams. And I'm trying to think in my own comfort of me, like if I'm listening to this right now, what are the— where's the best place to go to get—

Well, that's why I landed on this Burrito company because You know, if you're sitting out there as a solo and you're like, oh, the first thing in your mind is it's gonna cost me money. What will it cost you if you get sued? Exactly.

Oh yeah. Or, you know, the funny thing is too, if you get ransomware, the answer to ransomware is you have to pay it and you have to hire another company to handle all of that.

Yeah. Yeah. I think what I did is I found one, I feel like I passed it off, to Tierra maybe, or I posted it somewhere in our stuff to talk about cyber and all the things that you needed to do. It was like a, it's like a one sheet, a credible source that kind of tossed it out there. I'm going to see if I can find it really quick.

While you're looking for like a smaller company like mine, this really speaks to me because I can protect contractor as part of the contractor agreement, protect their computers.

Yeah.

You know, and have them sign the NDAs and all those sorts of things to, to protect that whole environment and give them peace of mind as well. Because, you know, if it bounced back on them that it came out of their computer, it still reflects on me. So—

I always wonder about that, too, when you hear these people that go and hire direct hires in whatever country. For their global team, do they take all that extra protocol? Because sometimes—

I know that makes me nervous.

You have to, if you're gonna pick a firm, you wanna make sure you ask those questions. Like what kind of a security do you have? Are you using a US-based server? You know, all of that. You wanna ask all those questions. And I think sometimes, um, that might get missed in the cheap price that you might get with a direct hire. Uh, also I noticed the other day I got an email from Intuit QuickBooks about the backup, new backup or whatever it did.

I never heard of that.

I saw that. Yeah.

Yeah. I don't know what that is. They had a backup. I don't think it did much for what I I remember it didn't back up, it didn't back it up, up enough that of the data, but we turned them on in all our files. I don't know whatever happened to that. They might be off. I don't know if we have to babysit that. I guess it's something we should probably look into, but what good is the backup if the backup isn't that great too, right?

Exactly. Yeah. And I did, I did just see a link to that new one over the weekend. As a matter of fact, I was like, oh, what is this?

Yeah. Let me see if I can find, it was like—

But yeah, do you have a plan in place for when it, when things go south and something happens? Do you have a plan in place to protect everybody? Because it can really bring the business down. And, and then in the one of our older clients, then when it happened, it shuts the office down because nobody can get access to anything. And that's scary. We had it happen with, um, I had it happen with one of my clients that they got scammed and they also got scammed personally. And because they weren't from the US, they were told to go down to the bank. And meet somebody at the bank. I guess the bank— being at the bank gave them some feeling of this had to be real, and get all the money out of the bank. The whole story, I was like, oh my God.

Oh my goodness.

No kidding. You know, some of the things you hear about that are like, you know, send the money to Nigeria, and then they'll hear that, you know, send it in a money order. It was very much like that. And I felt so bad. I mean, they ended up not being a client because they couldn't have— they lost every single penny of personal and business money.

So I'll tell you, if you're an attorney, you know, subscribing to this podcast, over the years I have seen more than one occasion where attorneys have been scammed on client trust fund money. Yeah, in international transactions. And they, you know, they just are so trusting that, that, you know, here comes this $10,000 retainer and guess what? You get burned. Yeah, it's, you know, you've got—

Oh, you got to make sure too, like, if you're gonna Don't expose your trust account. If you're doing wiring in, have an account that's just for wiring in and you know, then it—

Get your bank involved.

Yeah. And then it just transfers automatically.

And get the bank involved.

Yeah, there's so many things you can do to protect it 'cause you don't want to have any problem like that with trust. If you have somebody steal your trust money, guess what comes outta your pocket? You have to cover, that's not your money. So, you know, it's like walking down New York City with somebody else's purse, it gets stolen. Now it's my fault because I was entrusted with holding out of the purse and you just don't want to have that happen. And it's the same thing.

I'm often— Can we back up just a little bit? I'm sorry, go ahead, Sarah.

I was going to say, Steve, I was going to say I'm often surprised at how many firms are just like, I'll just email you the password. I'll just email you this.

I know, right?

I just— or I'll fax it to you.

Or they send a copy of a check. They send a copy of a check in an email. Oh my gosh, don't do that.

It's difficult, yeah.

Or can you set up this employee and they send you everything on that poor employee, like the W-4 and all of that? Like, here you go.

I was like, We try very hard to guide people.

How do you guys handle the backup situation?

Backup?

With your records?

Your QuickBooks files.

They're all in Advanced. We usually just have that turned on, but I don't know if that— I remember looking at it because I think we tested it one time, didn't we, Sarah? We tried it to see what it actually backed up. It didn't do a lot.

It didn't do a lot. I guess—

So rewind, but even that doesn't do the whole 5 hours.

Rewind, no, rewind is not what everybody thought it was.

It was, and then it wasn't.

Right, right, right, right, right. We should clarify that.

Because Intuit did something and then it wasn't.

Yeah.

If I remember correctly, yeah.

So, hmm, that's one that needs to be researched a little more, yeah.

I think so, yeah. I mean a cloud backup.

You know, back in the old days when we were just on desktop, desktop we could back up.

Absolutely.

You could back everything up and it was there.

Steve, you're reminding me, Lynda and I, and I think we need to reach out to them. So Tiara, please take note. At ClioCon, we met a very nice group of people that do a lot of backups, backups of things that you never thought you should back up, like Monday. I say software, online software. Um, and they would probably be a good group to have to discuss kind of in space what those things are. I, I do want to say though, like, these attacks and these spoofings and all of these things that are happening, um, and the ransomware, like, taking over your computer and you're not going to get it back unless you pay. like once you're in those situations, this is where it gets— that's why, to your point, a backup of your data would be good because then you can change that. I mean, it's their job, it's their mission to make money, right? Like to steal this.

That's what they're in business doing.

Yeah. And I also, I do feel super strong about this, my thoughts and opinions on this because I've I travel overseas and I've traveled a lot of places. Lynda and I, we have our own hotspot devices that we utilize. That's one thing we always do. If I'm stuck in a situation where I do need to be on a more public one, my VPN is right there turned on. I've even turned on my VPN when I work from home sometimes. Like, I just don't know. And there's so many devices for which is giving you exposure. So I will try and find this list. I feel like, Tiara, you might know where it is. I posted it somewhere, but there's a list that I found. It's not something we're affiliated with. We have nothing to do. It was a great blog. It was a great write-up. And these people do this for a living as well, as far as cybersecurity. And they had a really good checklist. List that they just posted. And I thought that was nice. Finally something, because you can see people post things, but they give you kind of a general— this one went through like a good itemized list to share.

So yeah, when you're working, when you're interviewing a potential contract employee or, um, outside vendor of any sort like that, you know, it's really kind of amusing. You ask them, do you have protection on your computer? Oh yeah, I use McAfee. And it's like, well, What else do you have? And that— oh no, that's it. Do you use a password protector? No, it's in a book under my desk. You know, well, what if your house burns down? So, you know, we're living in a time where you've really got to be diligent about it. It's like protecting a child because your business is your child.

Yeah.

Oh, so true. That's a good point, too. One thing I will say is our staff does like the training.

Yeah, they do.

They really do. Yeah, we all talk about it too. We talk, like, my hope is, I kind of used this recently as a challenge. I was like, hey, well, maybe we can get all of our training done this week so we can talk about it at the next, you know, meetup that we have. That seemed to work out okay.

Well, as soon as the first person, because you get like a little certificate under each section you do. So as soon as that little certificate, one of them gets popped into our education channel, everybody, like it's a little competition who can get their next thing done.

I love it.

But it's actually good. I mean, I think it's good and everybody is enjoying it 'cause I think we are all learning from it. That's the biggest part of it. We are learning from it, so.

Yeah, it's very relevant data. And I do like, like Lynda said, you can share it out to other people so they can get exposure to what you're experiencing. So, and they're maybe a minute or two videos, I think at the most 3.

So let me ask you guys this with, you know, you had mentioned that you provide the computers to your employees. And that they have their own personal computers for their personal life. Do they— and I'm not, you know, not to get anybody in trouble or anything like that, but do you have scenarios where maybe somebody tries to go to a website that they shouldn't in the work computer? Does it stop them?

That's— I don't know if I can answer that.

I think I have to ask IT people.

Yeah, I just wonder. But I have been— I mean, we have protection on our domain, like I've tried to log into something and it says I can't. It'll say I, it'll give you the warning. So there is a level of security on the browser that's heightened.

And that reminds me, I'm using, let me look up the company that I've got on. I'm using a company called Logitech currently. And they're very good. And I can be like in a Google Chrome environment and it'll tell me I'm not gonna let you go to that site. Mm-hmm.

Yeah, yeah, yeah. That happens.

Yeah, and so I really feel comforted with that. They don't have the best customer support, as responsive as this other thing I'm looking at, but I do like them and I've had them for several years, but I feel like it's the time to maybe tighten it down a little bit more.

It's hard because you can get a text that can drive you. You can get a piece of email that can take you. It's just ever, it's just off just so. I mean, this happened for Utah, the state of Utah. It was an email that went out to a bunch of attorneys. It was just slightly off. It got announced, then a whole big blast went out.

Well, what about apps on phones? You know, there's so many apps out there and people just punch, oh yeah, I'll load this app right up on my phone and boom.

Yeah, we hear it all the time. I think it's the due diligence that we often share with one another. We'll see something on Instagram and we'll share that announcement with each other. And we have a channel where we post things privately and within the company, because I think we all value each other's responses and opinions about— we're all in the same boat. We all want the protection. So we often do that for each other. We'll learn something new, like something on the iPhone that we never knew. Like, oh, check this out. So yeah, but I mean, it's not a topic where like I think total experts in, we're just talking from the standpoint of business owners to others.

So yeah. Something to think about. And we're in that time of the year, it's the end of the year. Consider, you know, what you need to do to spruce up your business for the coming year.

Mm-hmm.

That's so true. Those are tactics.

Mm-hmm. So true.

And with that, I'm gonna crawl under a blanket If you liked what you heard today, don't forget to like, share, and leave a quick review. And while you're at it, hit subscribe so you never miss an episode. If you have a question or a topic you'd love us to cover, drop us a line at info@accountantslawpod.com or send us a message through our website, accountantslawpod.com. And if you want to go beyond listening, you can always sponsor an episode, or maybe a handful, and connect with our community of accounting and legal professionals who love learning, laughing, and leveling up. And don't forget to join the conversation inside the Accountants Law Lab Mastermind Group at accountantslawlab.com, where collaboration meets inspiration 3 to 4 times a week.

I found it. Of course.

Found it at the end.

I found it at the end. Um, and I, I just put in here, it's called the WISP Checklist. So to your point, Steve.

Ah, and it's from Verito. Look at that. The one I was talking about. Yeah.

Yeah.

And it'll be in the show notes, I'm sure. It's in the show notes. Tia will make sure it makes it.

Yeah. And it's just a good— it's a great high level. And they have a great blog. They have a lot of good things.

Awesome.

Cool. Bye, everyone.

Bye-bye.