Construction

Article Dean Dorton

Why You Need Construction-Specific Software

Every construction company on earth, from small contractors to mega developers, uses accounting software. What’s surprising is how few use the right software. Many have something less-than-optimal in place. And for some, the software hurts accounting as much as it helps.

That leads to an important question: does your construction company have the right accounting software in place? The answer is complicated. Ultimately, it boils down to this: if you don’t have construction-specific accounting software, think about making a change.

Why Horizontal Solutions Are Never Adequate

Horizontal accounting software strives to be a Swiss Army knife for financial management. It packs a bunch of basic tools into one package in order to meet the most popular accounting requirements. QuickBooks is the most common example, but there are many others.

All-in-one accounting solutions are great for companies getting off the ground. Not only do they offer essential accounting features at an accessible price point, but they streamline those features to be simple and efficient. By design, they make it easy to get accounting up and running no matter what industry you’re in. That’s the biggest strength of horizontal accounting software, and it explains why so many construction companies use it. It’s also the biggest weakness, though.

By doing everything adequately, these solutions do nothing particularly well – a classic jack of all trades but master of none scenario. In accounting, as in construction, mediocre tools cause lots of unexpected problems. Even bigger than the problem of under-powered features, however, is the fact that horizontal accounting solutions don’t address the unique requirements of construction accounting.

Just a few examples include progress billing and integrating payroll into job costs. Construction companies deal with both on a regular basis, yet very few horizontal accounting solutions include purpose-built solutions or even adequate functionality. They make the fundamentals of construction accounting harder. Similarly so with things like managing work orders, inventory, and projects. When horizontal solutions address these issues at all, it’s not in a construction context.

Horizontal accounting software offers lots of features. What it doesn’t offer is true solutions to make accounting simpler, smarter, and more scalable for construction companies. That takes a different kind of software.

Benefitting From Construction-Specific Software

Construction-specific accounting software comes with features that are not just adequate or appropriate for construction but customized for this industry.

The benefits of using an accounting solution built for construction are hard to overstate. Accounting becomes simpler, faster, and more accurate for the in-house financial team, helping them accomplish more work in less time. The quality of their financial insights and planning improves as well, putting a construction company in a much stronger position through smart money management. Everything runs better when companies can use accounting to their advantage – and that starts by having the right software in place.

Software like Sage Intacct: a financial management platform with a full-suite of construction-specific tools. For builders of all sizes, it’s the closest thing to a complete accounting solution available. See how the right software could transform your company – schedule a demo.

Article Dean Dorton

Accounting for Real Estate and Property Management – Are you in the Cloud?

Why should your real estate or property management business use a cloud-based accounting solution? Good question, but here’s a better one – why shouldn’t you?

Technology is transforming the way we buy, sell, and manage property. And due to things like the ongoing pandemic and the evolving real-estate economy, players in this industry are reconsidering what it takes to be successful. By all accountants, the agents and managers that will thrive are those that learn to use technology to their advantage. That comes as no secret, which is why many are reevaluating the technology they have compared to the technology they need – and making updates or additions as necessary.

Which circles back to our original question. As real estate and property management companies take a critical look at their current accounting software (or lack thereof), many will decide it’s time for something different. They could choose to implement an on-premises solution…but why would they with all the cloud has to offer? Far from being equal options, the cloud has many advantages over on-premises equivalents, especially for the purposes of accounting and the particulars of real estate:

  • Visibility – No longer does data get stuck inside a specific folder, computer, or office. When all data lives inside the same cloud-based accounting platform, you gain visibility into anything and everything, all from one location. Nothing escapes notice.
  • Accessibility – With anywhere, anytime accessibility to cloud data and applications, real estate professionals have access to everything they need even when working remotely or from the field. Location never has to compromise access to information or informed decision making either. And in a work-from-home world, the cloud ensures accounting doesn’t skip a beat.
  • Speed – In hot real estate markets where there’s no time to wait, the cloud accelerates (and improves) decision making by serving up data and insights on-demand. And since data in the cloud updates in real-time without needing someone to handle it manually, the facts at hand are always current and complete.
  • Security – Real estate businesses are full of sensitive data and increasingly under attack from cyber threats of all sorts. The cloud improves cybersecurity by putting data and apps inside cloud environments that the provider (not the user) takes responsibility for securing.
  • Scalability – The cloud lets users scale their capabilities up or down to perfectly match their needs. It can scale quickly, effortlessly, and at a predictable cost (unlike on-premises) so that accounting never suffers from insufficient tech capabilities.
  • Automation – Since tech developers are focusing on cloud-based solutions, these solutions contain some of the best automation available. Accountants can take advantage of this automation to save time, prevent errors, and accomplish more by setting routine accounting obligations to run independently.

The case for the cloud is strong. It becomes even stronger with the right tech partners onboard – someone that can help a business new to cloud accounting take full advantage of what it offers. Pick a partner with deep experience in the real estate industry on top of extensive cloud expertise. Pick Dean Dorton.

Philip Massey,
Software Services Director
pmassey@ddaftech.com • 919.796.5408

Article Dean Dorton

In 2016, the Financial Accounting Standards Board (FASB) issued Accounting Standards Update (ASU) 2016-02 changing the way companies account for leases.  In 2020, the FASB issued ASU 2020-05 that delayed the effective date of the new leasing standard.  As a result of this delay, most private companies will be implementing the new leasing standard starting with calendar 2022 year ends.  For many private companies, especially those within the construction industry, the new leasing standard will require significant analysis of operations and transactions to identify the agreements that will be classified as leases under the new standard.  Of particular interest is the impact that the standard has on related party leases.

It has become normal within the construction industry for the buildings, and even the equipment, used by the operating construction company to be held by a separate, related entity in order to mitigate risk and provide for certain tax strategies.  The use of these related real estate and equipment companies will likely result in significant lease transactions between them and the construction company being evaluated under the new leasing standard.  The recognition of lease liabilities and right-of-use assets on the balance sheet of the construction company, as a result of the new leasing standard, could have a significant financial impact, and may impact working capital ratios thereby impacting debt covenants and bonding capacity.

Key areas which need to be considered when performing the evaluation of leases under the new leasing standard include the following:

1. Use of written lease agreements – All lease agreements, including those with related parties, should be formalized with a written agreement between the lessor and lessee.  This will make determinations under the new leasing standard easier to perform.

2. Lease terms – The new leasing standard requires that a related-party lease be classified and accounted for based on its legally enforceable terms and conditions. In other words, the classification and accounting for a lease with a related-party lessor should be the same as what the classification and accounting would have been if that lease were with an unrelated lessor.

There are two critical areas that should be considered when it comes to the length of all leases, but especially a related party lease:

a. Understanding the legally enforceable terms and conditions – A lease will be recognized under the new leasing standard based upon its legally enforceable terms and conditions.  The lessee is required to consider whether there are any implicit legally enforceable terms and conditions in addition to the terms and conditions in the written agreement.

For example, if the construction company leases a facility to perform pre-fabrication work and the lease has a term of one year with no option to renew, but the construction company has incurred significant costs related to leasehold improvements that will retain significant value over their useful life of 20 years, consideration will need to be given to whether there are implicit legally enforceable terms and conditions that would cause the lease term to be evaluated as 20 years instead of one year.

Another example would be if the construction company leases construction equipment on a month-to-month basis from a related party and that equipment is going to be used throughout the period of construction of a project that is expected to take two years to complete, consideration should be given to whether there are implicit legally enforceable terms and conditions that would cause the lease term to be evaluated as two years instead of one month.

b. Impact on capitalized leasehold/tenant improvements – Leasehold/tenant improvements should be depreciated over the shorter of the useful life of the asset or the term of the lease.

For example, using the example in 2(a) above, if the construction company determines that the lease for the pre-fabrication workshop is truly a one year lease, then the leasehold improvements related to the workshop would have a maximum depreciable life of one year (i.e. the lease term of one year is shorter than the useful life of the assets).  The treatment of the lease as a one year lease would likely result in significant depreciation charges/write downs of the leasehold improvements.

This treatment could also flow through to any leasehold or tenant improvements within the lessor entity in any GAAP financial statements they issue. For example, if the lessor entity has capitalized improvements made on behalf of the construction company and those improvements are specific to the construction company and would likely be unwanted/useless to any alternative lessee (for example signage), there could be the need to recognize impairment charges on those improvements to write them off over the one year term of the lease.

3. Lease payments – Companies will need to analyze lease payments within the agreements to determine if they are fixed, in-substance fixed, variable based upon a rate or index or variable based upon other than a rate or index.  This analysis is critical in order to correctly identify the lease payments that are used in classifying the lease and measuring the related lease liability and right-of-use (ROU) asset.

a. Fixed lease payments – Fixed lease payments are included in the calculation of the ROU asset and lease liability.   Payments that vary solely based on the passage of time (e.g. escalating rents) are not considered variable lease payments, and would be included in the calculation of the ROU asset and lease liability.

Example: Lessee is a private company with a calendar year end. Lessee enters into a lease with Lessor on January 1, 20X6, which is also the lease’s commencement date. The noncancellable term of the lease is three years. Lessee must pay Lessor $100,000 on January 1, 20X7. The lease payments on January 1, 20X8 and 20X9 are increased by 2% each year.

The amount of the lease payments that should be included in classifying the lease and measuring the related lease liability and ROU asset are $100,000 for year 1, $102,000 (i.e. $100,000 increased by 2%) for year 2 and $104,040 (i.e. $102,000 increased by a further 2%) for year 3.

b. In-substance fixed payments – A lease agreement may describe a payment as a variable payment, but upon closer look it is apparent there is an amount that must be paid (e.g. a minimum amount that cannot be avoided) or there is an amount that will be paid because the variability lacks economic substance. These types of variable lease payments are in-substance fixed payments and are treated as fixed payments when determining lease payments for the calculation of the lease liability and ROU asset.

Example: A lease requires a lessee to pay rent equal to 1% of its sales, subject to a minimum sales figure of $5 million. The in-substance fixed payment is the minimum amount the lessee will be required to pay of $50,000 ($5 million × 1%), which should be included in lease payments on the commencement date to calculate the ROU asset and lease liability. Any potential payments above the minimum amount are based on the lessee’s sales and should be accounted for as variable lease payments based on other than an index or rate (see below). Another way that this payment term could be worded in the lease agreement, but still result in the same outcome, would be if the lessee was required to make a payment of $50,000 or 1% of its sales, whichever is greater. In this situation, there is an in-substance fixed payment of $50,000 that will be required of the lessee.

c. Variable based upon a rate or index – Variable lease payments that depend on an index or rate are initially measured and included in lease payments by reference to the index or rate at the commencement date of the lease. Any additional lease costs arising from subsequent changes to the index or rate are recognized in the period those costs are incurred (i.e. similar to variable lease payments based on other than an index or rate as discussed below). Common examples of indexes and rates on which variable lease payments are based include: the Consumer price index (CPI), the prime or LIBOR interest rate, interest rates on direct Treasury obligations of the U.S. government (with or without a spread) and market rental rates.

Example 1: Lessee is a private company with a calendar year end. Lessee enters into a lease with Lessor on January 1, 20X6, which is also the lease’s commencement date. The noncancellable term of the lease is three years. Lessee must pay Lessor $100,000 on January 1, 20X7. The lease payments on January 1, 20X8 and 20X9 are $100,000 adjusted for the cumulative increase in the Consumer Price Index (CPI) since January 1, 20X7. No refunds are provided if the CPI decreases.

There is a fixed lease payment of $100,000 per year paid in arrears. The amount of the variable lease payment that should be included in the lease payments used in classifying the lease and measuring the related lease liability and ROU asset should be determined initially by reference to the CPI at the commencement date, and assuming that it will not change over the term of the lease. Given that the variable lease payment is based on the increase in the CPI after January 1, 20X7, the variable lease payment on that date is zero. As such, the amount of lease payments used in the classification and measurement of the lease on January 1, 20X6 is $300,000 (annual payments of $100,000 over the lease term of three years).

Example 2: Lessee is a private company with a calendar year end. Lessee enters into a lease with Lessor on January 1, 20X6, which is also the lease’s commencement date. The noncancellable term of the lease is three years. Lessee must pay Lessor $100,000 on January 1, 20X7. The lease payments on January 1, 20X8 and 20X9 are $100,000 increased each year by the 1-month LIBOR rate. At the commencement date of the lease the 1-month LIBOR rate is 2%.

The amount of the variable lease payment that should be included in the lease payments used in classifying the lease and measuring the related lease liability and ROU asset should be determined by reference to the 1-month LIBOR rate at the commencement date of the lease (and again assuming it will not change over the term of the lease). As the rate on January 1, 20X6 was 2%, then the lease payment for year 1 would be $100,000, for year 2 would be estimated as $102,000 (i.e. $100,000 increased by 2%) and for year 3 would be estimated as $104,040 (i.e. $102,000 increased by a further 2%) for the classification and measurement of the lease on January 1, 20X6. Any difference in the lease costs arising from differences between the actual LIBOR rate and 2% (the LIBOR rate at lease commencement) in years 2 and 3 are recognized in the period those costs are incurred (i.e. similar to variable lease payments based on other than an index or rate as discussed below).

d. Variable based upon other than a rate or index – Variable lease payments that vary after the commencement date for reasons other than an index or rate are not included in the lease payments used for classification or measurement purposes. When the only payments in a lease are variable based on other than an index or rate, there are no lease payments on which to base the recognition and measurement of a lease liability and ROU asset.  Therefore, there would be no recognition of a lease liability or ROU asset.

Example: Lessee is a private company with a calendar year end and has no interim financial reporting requirements. Lessee enters into a lease for the exclusive right to use a specifically identified production printer. Lessor does not have substantive substitution rights related to the production printer. The lease is entered into on July 1, 20X6, which is also the lease’s commencement date. The noncancellable term of the lease is three years. There are no purchase, renewal or termination options. On a monthly basis, Lessee must pay Lessor $0.10 per page printed by the production printer in the previous month. For example, in August 20X6, Lessee pays Lessor $0.10 per page printed by the production printer in July 20X6.

The only payments required under the lease are variable lease payments based on other than an index or rate. As a result, there are no lease payments that give rise to recognition of a lease liability or ROU asset. The variable lease payments are included in lease costs as the printer is used. For example, if Lessee used the production printer to print 2,720 pages in July 20X6, it should recognize lease expense of $272 for that month. This same example would apply for construction equipment being leased based upon an hourly usage rate.

Much like the previous changes to revenue recognition, the new leasing standard can be a complex accounting standard to navigate.

Learn about Construction Services

Simon Keemer, CPA, CGMA, ACA
Assurance Director
skeemer@deandorton.com • 502.566.1036

Article Dean Dorton

Recent and highly visible ransomware attacks such as the one on Colonial Pipeline should serve as a wakeup call for organizations that do not see themselves as “typical” targets of cyber-attacks.

The size and industry of the organization often does not matter for cyber criminals who are always looking for opportunities.

According to the 2020 Verizon Data Breach Investigations Report (*), 67% of all breaches come from three attack types: credential theft, errors, and social attacks. The average cost for a data breach is $2.64 million for organizations under 500 employees. Phishing and ransomware remain two of the top Cyber risks for most industries, including the Construction industry.

The first thing that organizations can do is to perform a Security Assessment to ensure that they understand where their vulnerabilities are and to assess their resilience against cyber attacks.

Key controls to consider are:

  • Multifactor authentication (MFA) – for all remote access to systems and information (including emails) to mitigate credential theft attacks.
  • Strong password policy – making sure weak passwords cannot be used and that users cannot reuse passwords.
  • Endpoint security – many cyber attacks start with a user clicking on a bad link from their devices. Having a strong endpoint detection and response software on all endpoints is critical.
  • Vulnerability management – the “cyclical (never-ending) practice of identifying, classifying, prioritizing, remediating, and mitigating” software vulnerabilities.
  • Logging monitoring – this detective control can allow organizations to quickly react to suspicious activities and can provide information after an attack to determine what was accessed by the threat actors.
  • Security Awareness – employees and business partners need to understand how to identify and report potential security issues. Security Awareness is especially important if you are working with a workforce that might not be totally comfortable with computers.
  • Resilient backup – employ a “3-2-1 strategy” which means having at least three total copies of your data, two of which are local but on different mediums (or devices), and at least one copy off-site.
  • Incident Response and Business Continuity Plans – contain specific information and playbooks on how to react when an incident occurs and how to quickly resume operations.

Having cyber insurance coverage is critical, but this is becoming more complex: organizations have to be careful to make sure that they have the appropriate coverage for common attacks scenarios. We often see sublimit in coverages specific to ransomware and even no at all coverage for email frauds. Insurance companies are also asking for more assurance that security controls to be in place during the underwriting process.

Many organizations have transitioned to a hybrid remote work since the pandemic started and the security controls need to be reviewed and tested for this new environment.

Of course, these measures should apply to contractors and subcontractors working with organizations. If their companies do not have the level of sophistication needed to mitigate these risks, they put their customers and partners at risk.

Construction organizations must improve their security posture and implement measures to mitigate cyber risks.

Gui Cozzi | Cybersecurity Practice Lead
gcozzi@ddaftech.com
859.425.7649

Article Dean Dorton

Construction projects are complex. The groups of stakeholders and specialty skills involved in a project from start to finish can be overwhelming. Trying to keep supporting information and processes organized, secured, and accessible by the right players during the lifecycle of a construction project is critical to reaching success.

Content, processes, and analytics work together to support success. 

Content
The information needed to start, deliver, and complete a construction project varies depending on the type of work. A common theme across all types of projects is a need to provide the correct information to the correct team, in an efficient manner. This is especially true with construction projects. Contractors need access to the bid requirements, engineers and architects need details of the property layout, a project manager needs to know what tasks are scheduled for the day, finance needs to know which payments are due next week, and the list keeps going. Delays in finding or having access to this type of information will cause frustration and increase costs. A plan for organizing information and ensuring the correct stakeholders have access is important for ongoing success. 

Process
Physical construction processes executed correctly are paramount to the success of a project. A poorly installed building foundation can have catastrophic implications; an improperly sloped drainage zone can lead to damage and possible liability; poor materials can lead to shortened lifespan of constructed features. The same is true of the business processes: slow or erroneous business processes cause issues and can delay progress or increase costs. Processes that involve duplicate data entry, printing of materials, or tabulation/collation of data may all be areas prone to error and delays.  

Business processes can be large or small. For example, the management of the lien waiver process with contractors is a simple, yet cumbersome process. If done incorrectly, it can leave a property at risk. An additional example is the sign-off on building plans, floor plans, and estimates. Delays on these approvals can slow the project progress until agreement is reached. 

Analytics 
Business processes and various tools generate a lot of data. Taking this data and molding it into something useful is the job of analytics. Good analytics will help you answer the questions that are most important to your construction project. Analytics sourced from a single data source, a construction project management tool for example, can be manageable. However, when that data needs to be combined with the financial accounting for the project to determine current and forecasted profitability of the project, it can become more complicated.

Good analytics allows for decisions to be made with facts instead of perception. 

Depending on an organization’s size and maturity, analytics may be used in any of these 4 areas: 

  • Descriptive (simple) – this is a view into what has happened or is currently happening (how many labor hours have been used this week?) 
  • Diagnostic (moderate) – providing insights into why a particular thing is happening (why is my flooring expense exceeding estimates)? 
  • Predictive (complex) – what is likely to happen in the future (based on the current burn rate, when will my labor budget be exceeded?)  
  • Prescriptive (more complex) – what should be done to reach an outcome (how can I deliver in a shorter timeframe?) 

Dean Dorton’s Collaboration and Data Analytics practices can build a strategy and roadmap to help your organization get the most out of its processes and data. If you would like to meet for a free initial consultation, please contact us here: Lets Connect

Article Dean Dorton

For small businesses, the result of a cyber incident can be disastrous. While larger organizations and enterprises may be able to absorb the monetary costs and reputational damage that is caused by a cyber incident, most smaller businesses are unable.

“The National Cyber Security Alliance has recently released statistics that show 20% of small businesses experience such an attack every year, and that 60% of these businesses were forced to close within six months of being hacked.”1

Cybersecurity risks are constantly evolving as organizations adopt new technology (such as cloud services) and cyber criminals adopt new tactics, techniques, and procedures (TTPs). The construction industry doesn’t have the same regulatory and compliance requirements pertaining to cybersecurity that other industries—such as the financial and healthcare sectors—have, yet they face the same threats. For this reason, it is imperative for the construction industry to focus on cybersecurity risks to avoid becoming the next victim of cybercrime.

How a Cybersecurity Attack Can Impact Construction Companies

Today, construction companies transmit and store the kinds of sensitive data that cyber criminals target most. Employee and project information, contracts, financial data, and planning tools are all at risk — yet the industry remains behind the curve in bolstering cyber security measures compared to other industries. 

What’s more, the move to an increasingly remote workforce with more devices in play has exposed gaps in networks that cyber criminals are all too happy to exploit. And as the industry continues to embrace the Internet of Things (IoT) and leverage artificial intelligence technologies, their potential attack surface also continues to expand.

Cyber criminals most often seek financial gain from an attack via ransomware. But there are additional, deeper impacts of a cyber attack as well:

  • Down time: Deadlines aren’t made to be broken. An interruption in business due to a technology disruption can cost a company days or even weeks it can’t afford in reduced or even lost productivity.
  • Breach of project IP: Loss of privileged contracts, proprietary designs, schematics, and confidential blueprints can not only lead to huge financial losses. It could also result in irreparable damage to reputation.
  • Loss of bid information: Forfeiting leverage in the upfront process can result in losing competitive advantage, as well as the job itself.
  • Equipment damage: It’s a concern for equipment off and on site. Servers, devices, and key computing hardware are costly to repair or replace. And compromised on-site equipment can lead to significant physical damage to nearby structures and the equipment itself.
  • Workforce injuries: Protecting the most valuable asset is paramount. A security breach or system failure that allows autonomous equipment to be compromised puts the safety of workers — and civilians — at significant risk.  

There are many ways that cybercriminals (also known as threat actors) can compromise confidential information in an organization. Below, we’ll address three of the most common vectors for a successful cyber attack.

Common Cybersecurity Threats for Construction Companies:

Spear Phishing

One of the most common techniques, “spear phishing is an email targeted at a specific individual or department within an organization that appears to be from a trusted source. It’s actually cybercriminals attempting to steal confidential information. A whopping 91% of cyberattacks and the resulting data breach begin with a spear phishing email, according to research from security software firm Trend Micro. This conclusively shows that users really are the weak link in IT security.”2

Often, threat actors will employ the use of malicious file attachments when conducting these types of attacks. “There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary’s payload exploits a vulnerability or directly executes on the user’s system. The text of the spear phishing email usually tries to give a plausible reason to open the file, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.”3

Password Spraying

This technique “uses one password (e.g. Password01), or a small list of passwords, that matches the complexity policy of the domain and may be a commonly used password. Logins are attempted with that password and many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.” For instance, from September 2018 through February 2019, Proofpoint conducted a six-month study that analyzed over 100,000 unauthorized logins across millions of monitored cloud user-accounts.”4

“The company found that 60% of Microsoft Office 365 and G Suite tenants were targeted with IMAP-based password-spraying attacks, while 25 percent were successfully breached in this manner. Proofpoint noted that the number of IMAP-based password-spraying attacks jumped up following the December 2018 publishing of the Collection #1 data dump that exposed nearly 773 million unique emails and 21 million unique passwords.”5

Exploiting Vulnerabilities in Unpatched Software

“Earlier this year, the National Security Agency urged organizations to ensure that they are using patched and updated systems in the face of growing threats. The vulnerability is present in Windows 7, Windows XP, Server 2003 and 2008, and although Microsoft has issued a patch, potentially millions of machines are still vulnerable.”6

How Construction Companies Can Mitigate Cybersecurity Risks

Dean Dorton recommends that organizations consider the following to identify their risks and enhance their cybersecurity preparedness:

  • Identify where your valuable information is stored (on your internal network and the cloud)
  • Develop policies, procedures, and standards pertaining to cybersecurity
  • Adopt a cybersecurity control framework
  • Develop a cybersecurity incident response plan
  • Secure your backups; also, test your backups to ensure they work correctly upon use
  • Disable legacy authentication protocols (such as IMAP)
  • Enforce two-factor authentication (2FA), also referred to as multi-factor authentication (MFA)
  • Update and patch your computers. Vulnerable operating systems and third-party applications are often targeted by threat actors. You should ensure that your operating systems and third-party applications are updated with the latest updates.
  • Train your organization. “Organizations should ensure that they provide cybersecurity awareness training to their personnel. Ideally, organizations will have regular, mandatory cybersecurity awareness training sessions to ensure their personnel are informed about current cybersecurity threats and threat actor techniques. To improve workforce awareness, organizations can test their personnel with phishing assessments that simulate real-world phishing emails.”7
  • Perform regular cybersecurity assessment and penetration tests against the network—no less than once a year. Ideally, run these as often as possible and practical. Dean Dorton can perform these tests for you.

Dean Dorton’s Information Security Office (ISO) provides a team of experienced information security professionals who can augment your organization’s information security team or take the lead in designing, implementing, and maintaining a strong information security program on your behalf.

1https://www.csoonline.com/article/3437777/how-a-small-business-should-respond-to-a-hack.html
2https://www.knowbe4.com/spear-phishing/
3https://attack.mitre.org/techniques/T1193/
4https://attack.mitre.org/techniques/T1110/
5https://www.scmagazine.com/home/security-news/password-spraying-attacks-abuse-imap-to-break-into-targets-cloud-accounts/
6 https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
7 https://www.us-cert.gov/ncas/tips/ST19-001