Archive for the ‘SAS 70 Type II’ Category

PRIMER: How are Disaster Recovery and Backups Different?

April 16th, 2013
Posted by: Donna Hemmert

So, you are working through your go-forward IT strategy and need to make sure that you have things covered should something go wrong. Pretty quickly, you notice that the terms “Backup” and “Disaster Recovery” are quite often being used interchangeably. But, the truth is, they are different. Related, yes, but different.

Backup

Backup really can be defined very simply. Backup is just a copy of your files on another disk (or tape, cloud, etc.). In fact, if you copied each and every file to a DVD (and we are not sure why you would do that), that would be a backup. Having a full backup that is up-to-date means that when you lose a few files or a whole drive or more, you can take the time it takes to copy those files back once your systems are ready to rock. But, it can be a time-consuming disruption. You will likely need to setup a new server(s), re-install the OS, and reinstall all the applications, etc. There are two ways to backup your systems:

  • Onsite Backup: This is when you backup locally to some kind of physical storage option. These solutions are capable of imaging servers and storing data locally so you can recover from incidents.
  • Offsite Backup: This is when you backup your data to an entirely different location. This, of course, helps protects you in the case of an entire geographic location being affected by a disruption. Also, often organizations need offsite backup to be in line with compliances such as those rules defined by Sarbanes-Oxley, HIPAA, FISMA, NASD and NYSE, etc.

Disaster Recovery

So, what is Disaster Recovery? Disaster recovery is beyond backup. The big benefit of disaster recovery is that rather than taking what may be days or months to recover for an unplanned outage, Disaster Recovery will greatly shorten that time.

With Disaster Recovery, a complete image of your disk drives and servers are mirrored. This is sometimes referred to as a “bare-metal” backup, meaning the backup isn’t just the files, but the OS and everything. For example, with AISN’s Disaster Recovery service, we replicate the “bare-metal” backup image to another geographic site so in the event of a disaster in one geographic location, it can be restored from an entirely different geographic location. This gives you added protection and the image(s) allows you to restore systems more quickly – there is no need to reinstall an OS and copying files. The amount of time it takes to actually continue operations after a disaster also depends on whether you choose “Hot Site” or “Cold Site.” So what is the difference?

  • “Hot Site”: Environments are available at a moments notice. So, in the case of an outage, all data processing can quickly be moved to the “Hot Site” and operations continue.
  • “Cold Site”: Critical applications are available at a secondary location. This is similar but is supplied as basic office space, but with “Cold Site” the customer provides and installs all the equipment needed to continue operations. It is less expensive but will take longer for full operations to continue.

So, that’s really all there is to it from a high level. You really need to understand what your goals and objectives are. Do you need systems available in minutes, hours or would days be just fine? Is backup just fine, or do you need Disaster Recovery? And what level of Disaster Recovery do you need? There are lots to consider, but remember, we are always here to help you think through your IT plans.

TAGS:

CATEGORIES:

No Comments »

Top 10 Security Risks Found by Your Auditor

February 21st, 2013
Posted by: admin

GUEST BLOG

By Sarah Morris
KirkpatrickPrice

At KirkpatrickPrice, we strive to provide the proper assurance and resources to help our clients maintain security within their organization.  Recently, we held a client webinar focused on the “Top Ten Security Risks” that your auditor finds during your auditing process.  Below is a summary of the most common risks that we find.

1.      No Formal Policies and Procedures

Formal guidelines of policies and procedures help provide your employees with clarity of what’s expected of them.  They define the accountability for each employee and also establish necessary training. Information security policies are mandated by the FTC Safeguards Rule, PCI Data Security Standards, and the HIPAA Security Rule. This means they are mandatory.

2.      Misconfigurations

Standards need to be applied consistently. Organizations should utilize benchmark configuration standards from a recognized entity such as: Center for Internet Security (CIS), International Organization for Standardization (ISO), SysAdmin Audit Network Security (SANS) Institute, and the National Institute of Standards Technology (NIST).

3.      No Formal Risk Assessment

Assessment should cover assets that are critical to your enterprise to continue business operations for the following: hardware, software, human resources, and processes (automated or manual). Some important things to consider when thinking about risk assessment are the threats to your assets as well as the likelihood of vulnerability being compromised. Threats can be both internal (employees or third party contractors or partners) as well as external (natural events or social engineering). Developing a proper risk assessment can help to mitigate potential risks that you face.

4.      Undefined Incident Response

It is always important to have clear instructions on reporting procedures when determining incident response. It is suggested to build a culture within your work environment that encourages reporting of all incidents the moment they present themselves.

5.      Lack of Disaster Planning

Disaster planning is important in a situation where written plans were available for others to follow in the event that key personnel are not available. A business impact analysis can help quantify what level of redundancy is required for disaster planning. Proactive arrangements should be made to care for the staff and to communicate with third parties. Walkthroughs and training scenarios can benefit organizations so employees are properly prepared in the event of a disaster.

6.      Lack of Testing

The concept of testing applies to all areas of your security. If your security is not tested, there is no way to determine whether or not vulnerabilities are present.

7.      Insecure Code

Developing secure coding is something we find lots of companies struggling with. To develop secure coding, training must be implemented as well as specific development standards and quality assurance.

8.      Lack of Monitoring/Audit Trails

Log Harvesting, parsing, and alerting methods must be determined to efficiently deal with massive event logs. The responsibility for review must be formally assigned as part of daily operations.  Audit trails should be stored in such a way that system administrators cannot modify without alerting someone with and oversight role.

9.      Data Leakage

Some things we often forget are where the data is located and how long should it be retained? How is encryption implemented and verified? How is access to data granted and audited?  These things are all very important, and if not corrected, can keep you from complying with federal and industry standards and regulations.

10.  Lack of Training

A lack of training can prove to be a striking blow to the security of your organization. Employers should recognize the importance of properly training all employees on safety and security best practices. Standards and guidelines should be clearly set and determined in each organization. Several training opportunities are offered through KirkpatrickPrice to properly train you and your company on the basics of security awareness, awareness for managers, awareness for IT professionals, and awareness for credit card handling.

Determining your individual risks is the first step toward the mitigation process.  Maximum security of your sensitive information is KirkpatrickPrice’s number one priority.

If you’re ready to get started with your assurance process, you’ve come to the right place. We’re ready to help. Let’s work together.

Sarah Morris is a technical writer for KirkpatrickPrice, a provider of world-class audit services. Visit www.kirkpatrickprice.com.

 

TAGS:

CATEGORIES:

No Comments »

Cloud Computing Benefits for Accounting Firms

August 19th, 2012
Posted by: Julia Uglietta


By Julia Uglietta
Associate, Marketing and Sales

Accounting firms deal with data day in and day out. The volume of numbers that go through an accounting office each day is unimaginable. The number of emails that go in and out of the offices is inundating.

It’s not only the size issue that challenges accounting offices every day.  Rather, it’s also the need to work faster while remaining efficient – in addition to improving better client and interoffice communications. These goals sound fairly standard for a successful business, right?  But in fields such as accounting, where large amounts of data are being received and stored, achieving these goals can be onerous.  The good news is, however, that new technology known as cloud computing is helping accounting firms attain these goals and save money too.

AIS Network accounting

Taking business to the cloud allows accountants to work from anywhere, at any time.

Taking accounting firms to the cloud is a way to reduce costs, improve efficiency and make data more accessible.  Throughout the industry, the discussions about cloud computing and how many accounting practices are moving to an outsourced cloud computing model has people thinking.  Accountants can see clearly that cloud computing is moving up and moving fast.  Now, more firms are looking into cloud solutions before they buy that next new sever.  They’re performing a cost benefit analysis, and in the process, they’re discovering that the operational expenditure associated with implementing an outsourced model is more desirable than the large capital expenditure associated with buying and maintaining all those new servers.

Not only does migrating to a cloud-based, paperless environment cut costs for accounting firms, but it also introduces new efficiencies.  When you put your data and applications in the cloud and entrust a cloud provider to care for them round-the-clock, you’re achieving IT efficiencies such as:

  • Eliminating the need for physical storage (throw out those old filing cabinets!)
  • Upgrading to industrial strength physical security (including partial or full fault tolerance, fire protection, etc.)
  • Improving backup and disaster recovery processes
  • Enhancing data security
  • Increasing availability (through improved power redundancy,  etc.)
  • Extending IT resources with a 24x7x365 team of hosting experts

For many accounting firms, this makes the decision to switch to the cloud even easier.

The most brilliant feature of the cloud is, in my opinion, its “anywhere” accessibility – which is an aspect that most accounting firms will find appealing.  When your data and your applications are in the cloud, they are accessible via any Internet-enabled device whenever you need them and wherever you are.  It just makes life easier.  Allowing the staff to work faster (and, I might add, without necessarily increasing billable rates) allows them more time to focus on the clients’ needs.

Most customers prefer communicating with their accountant via the Internet, and in many ways, the new cloud-based dashboards, reporting applications and unified communications systems that are now available only make this easier.  By enabling better collaboration and communication among geographically diverse staff and clients, accounting firms’ processes and workflows are vastly improved and the work gets done much faster – often with greatly reduced travel costs.

Life in the cloud has changed many industries’ ways of operating.  Slowly but surely, accounting firms will ease into cloud computing and reap benefits that were previously unachievable any other way.

 

 

TAGS:

CATEGORIES:

1 Comment »

Why Is Compliance in the Cloud Important?

May 7th, 2012
Posted by: Donna Hemmert

GUEST BLOG

By Joseph Kirkpatrick
Managing Partner, KirkpatrickPrice

The world’s digital infrastructure is a constantly growing industry.  This is why the use of data centers has become exceedingly popular.  What is the scary thing about collecting and storing highly sensitive information?  The risk of a security breach.

When a company utilizes a data center, such as for cloud computing and hosting, it’s important that they are aware of the security of their organization’s data, especially because data centers often times outsource to other vendors.  What does this mean to you?  This means they may also have access to your data.  This is why cloud hosting providers must be in compliance with all applicable privacy laws when it comes to keeping data secure during the collection, storage and use of your sensitive information.

How is compliance measured?  Compliance is measured by how well organizations meet the data security standards and regulations that are meant to help you keep your information confidential and secure.  The use of data centers is very resourceful as long as you’re sure your service provider is complying with these industry accepted security standards and regulations.  Some of the companies that comply with SSAE 16, PCI Data Security Standards, and Trust Services Principles and Criteria have already taken these steps and have been audited by third parties, such as Certified Public Accountants (CPAs) and Quality Security Assessors (QSAs).

So, what steps should you be taking?  Start taking your organization’s security into consideration and ensure compliance in the cloud.

(more…)

TAGS:

CATEGORIES:

1 Comment »

Does Third Party Hosting for SharePoint 2010 Make Sense?

April 13th, 2012
Posted by: admin

By Jay Atkinson
AIS Network CEO

“To cloud or not to cloud?” is rapidly emerging as the technical question of the decade.

Industry analyst Gartner, Inc., expects 43 percent of companies to have most of their IT efforts running in the cloud in as little as four years. Due to that expected boom in cloud adoption, Gartner ranks cloud computing as the No. 1 tech priority for chief information officers.

Placing a mission-critical platform into the hands of an independent, third-party hosting services provider can uniquely position that

SharePoint 2010 Cloud

Should you host your SharePoint 2010 in the cloud?

organization to combine some of the best elements of on-premise hosting and Office 365 delivery. For many organizations, SharePoint is mission critical and the decision to shift from on-premise hosting to third-party hosting is not entered into lightly.  However, the benefits of doing so are increasingly appealing.  In comparison to on-premise hosting, third-party hosting offers superior flexibility, greater reliability and a better value.

Why a better value?  Ultimately, if an organization were to attempt to replicate the hosting infrastructure built by a third-party provider, it would become abundantly clear to that organization that outsourcing to a third party provides a much better value.  It is usually cheaper for an organization to host SharePoint on-premise – unless they want to do it right.  Replicating an on-site infrastructure that equals the performance, reliability, scalability, security and compliance environment that “comes standard” with a solid, Microsoft hosting partner’s services would be cost prohibitive.

Here, it is also important to note that for public companies or others that are audited, Sarbanes-Oxley (SOX) also drives the case for outsourced hosting.  SOX identified the Type II SAS 70 report (today’s equivalent is SSAE 16 Type II) as the only acceptable method for a third party to assure a service organization’s controls.  Many reputable hosting companies are SSAE 16 Type II-audited, which means the audit of the hosting company can be incorporated into the audit of the public company.  Relying on the audit performed on a third-party hosting company, at the hosting company’s cost, may be much more cost-effective than ensuring your own facilities and processes are SSAE 16-compliant.

Hosted SharePoint Specialists

Organizations contemplating a SharePoint deployment should recognize that there are applications hosting providers and then there are a handful of hosting providers that specialize in hosting SharePoint.  Many have Microsoft and additional compliance certifications, and that enhanced capability and level of service may be imperative to an organization requiring customized SharePoint hosting configurations, Microsoft-certified talent, and top-grade security and disaster compliance.

The hosting provider’s infrastructure is supported by many clients, thus enabling it to deliver a broad range of services at a substantially lower price (than managing identical services on-premise).

For the customer, there is little upfront capital expense and the monthly payments to the hosting company are predictable operational expenses.  The IT staff is freed up from spending precious resources and time on designing its own hosting solution architecture.  Stressing about managing backups, software licenses, hardware/software upgrades, and patching schedules is all in the hands of seasoned hosting experts who monitor the customer’s SharePoint solution in a disaster-resistant data center.

In addition to cloud hosting services, there are two general types of SharePoint hosting that a third-party provider may offer:

• Shared hosting. An organization’s applications and data are deployed on a server that is shared by several other organizations.

• Dedicated hosting. An organization either deploys its own servers or the hosting provider deploys servers dedicated for exclusive use by that organization.  Dedicated hosting may be provided by either dedicated physical servers or dedicated virtual servers.

Benefits and Drawbacks of Third-Party Hosting
A SharePoint hosting provider frees up an organization’s entire IT staff to focus on tasks that will help grow their business.  In their Service Level Agreements, most top-tier hosting providers offer disaster-resistant data centers, temperature and access controls, 24x7x365 monitoring and response, excellent connectivity, reliable uptime and availability, managed hardware/software upgrades and maintenance, routine backups and fail-over capability in the event of disaster.

The best providers develop a solid, personalized relationship with each customer, listening carefully to their needs and integrating their team of experts into the organization’s IT staff.

Benefits include the following:

• Customization. The hosting provider is capable of configuring highly complex SharePoint installations.

• Low upfront costs. Capital outlays are minimized. Outsourced hosting becomes an operational expense.  The hosting provider typically buys and manages the servers and provides the licenses.

• Staff. Highly trained hosting experts strive to integrate seamlessly with an organization’s team, thus helping to strengthen the relationship through personalized service.

• Security. An organization’s servers are typically highly secured, backed up and sitting in a disaster-resistant data center.  Many providers have SSAE 16 Type II designations as well as other compliance certifications.

• Scalable. Spikes in traffic can be sustained without the accompanying worry that the organization’s network will crash.

Drawbacks include the following:

• Portability. SharePoint hosting is complex, and organizations must enter into long-term contractual commitments with their hosting provider.  Switching providers in mid-contract, or reverting back to self-hosting, is not easy and the process of migrating data to a new hosting arrangement can be onerous.

• Slower deployments. Deploying the physical infrastructure is managed and thus not as turn-key as cloud-based hosting.

In addition to cloud hosting services already addressed by this paper, there are two general types of SharePoint hosting that a third-party provider may offer:

• Change management. Changes – either hardware or software – to the SharePoint configuration may require the hosting provider’s review and approval, so organizations must plan in advance.

• Flexibility. While third-party hosting may not recreate the level of flexibility associated with on-premise hosting, in most cases, the degree to which an organization loses out on flexibility and control is less than the degree by which it will save on capital outlays.

Just as with on-premise hosting, there is a large emphasis on customization and flexibility in the world of third-party hosting providers.  An organization will have full access to its own SharePoint environment – the way it should be – and any kind of software application that compliments its SharePoint (customer relationship management software, data mining programs, etc.) can be integrated.

Have more questions about hosting SharePoint in the cloud?  Download the “To Cloud or Not to Cloud” whitepaper and/or speak with someone in our office.

TAGS:

CATEGORIES:

12 Comments »

AIS Network Continues to Expand and Upgrade

July 4th, 2011
Posted by: Donna Hemmert

In our Northern Virginia SAS 70, Type II facility, we have spent our holiday weekend building our latest cloud to keep up with demand. It’s true – things continue to move to the cloud. We hope you enjoy the peek.

Keeping up with demand for the Cloud

TAGS:

CATEGORIES:

1 Comment »

IT Literacy for CPAs Will Enable Client Conversations About the Cloud and Collaboration

July 23rd, 2010
Posted by: Jay Atkinson

As a CPA and someone whose hosting company recently underwent a SAS 70 Type II audit, I found this year’s American Institute of Certified Public Accountants Top Technology Initiatives Survey, which forecasts key IT issues in the year ahead, highly interesting. The CPAs surveyed say they believe data security will continue to be the most pressing concern for their clients and employers over the year.

The June study was the first such Top Technology Initiatives Survey to ask AICPA members to rank a list of questions heard most often from audit committees, chief financial officers and chief information officers. According to the press release about the survey, the top 10 most frequently asked questions are:

  1. Are we ensuring that our data and technology resources are protected against hacking, viruses, or other compromises?
  2. Are we considering or implementing organizational security precautions even though we haven’t had a data breach or loss?
  3. Are our current internal controls and IT governance policies and procedures effective?
  4. Are we receiving the most relevant and current information from our reporting functions (business intelligence, dashboards, etc.) or are there areas for improvement?
  5. Have we implemented sound, appropriate privacy policies and procedures in place within the organization and for our customers?
  6. Are we appropriately considering the IT risks associated with the organization in an initial planning of any audit or attest engagement?
  7. Are we capturing the appropriate control objectives during the initial planning of any audit or attest engagement to address the IT risks associated with the organization?
  8. Should we refresh our core and financial accounting software to leverage technology efficiencies every few years?
  9. Can our data remain safe if we utilize cloud computing, or Software as a Service (SaaS) services?
  10. Can we deliver on our service and product promises to our customers if we utilize cloud computing services?

Notably, Cloud Computing/Software as a Service (SaaS) appeared in two questions, reflecting both growing interest in Web-based technology solutions for business and concerns about the new risks that they may introduce. CPAs are providing vendor due diligence for their clients to ensure appropriate controls are in place in SaaS applications and confidential customer information is being protected.

Principally, the survey makes clear that CPAs need to be literate about information technology in order to collaborate effectively with clients and their IT partners. Managed hosting companies can help in that regard by providing clear product and educational information and by ensuring that their hosting company has a SAS 70 Type II audit, an internationally recognized auditing standard developed by the AICPA.

CPAs, take note! At AIS Network, we are constantly working to revise and add new content for our Web site—content that is robust enough for IT professionals but also simple enough for the layman to understand.

In the next few weeks, we’re planning on adding some educational FAQs that, I am hopeful, will help inform CPAs and others who are asking some of these very important questions. Further, we have upgraded this month to SAS 70 Type II-certification.

TAGS:

CATEGORIES:

59 Comments »