Compliance, Security, and Productivity
Over 40,000 businesses are currently
using Server 2012, which will reach end of life (EOL) October 10, 2023. This outdated
technology will have a number of critical effects on businesses, including:
- Increased security risks
- Non-compliance with mandated
regulations
- Reduced productivity
- Increased costs
In this article, we will address how
outdated technology can impact your business' productivity in three specific
areas: Cybersecurity, PCI compliance, and FTC compliance, as well as addressing the time-sensitive Server 2012 EOL.
Vector Choice recently hosted a comprehensive webinar on the topic of 'How
Outdated Technology Can Slow Down Your Business". You can watch that webinar to gain in-depth insights into the impacts of outdated technology by clicking the link below.
PCI Compliance
If your business accepts credit card payments, you are required to comply with the Payment Card Industry Data Security Standard (PCI DSS). This standard requires businesses to take steps to protect customer data, such as using strong passwords and encrypting sensitive data.
Outdated technology makes it difficult to comply with PCI DSS. This is because outdated systems do not have the latest security features or may not be able to be patched to fix security vulnerabilities.
If your business is not PCI compliant, you could face fines of up to $100,000 per month. You could also lose your ability to accept credit card payments.
PCI SSC Fined Businesses for Non-Compliance:
- In 2020, the PCI SSC fined Target $19.2 million for a data breach that exposed the credit card data of over 100 million customers. The breach was caused by a number of security vulnerabilities, including a misconfiguration of the company's firewall.
- In 2021, the PCI SSC fined Neiman Marcus $10 million for a data breach that exposed the credit card data of over 3.5 million customers. The breach was caused by a number of security vulnerabilities, including a failure to patch a known vulnerability.
By keeping your technology up to date, you can help to ensure that your business is PCI compliant and avoid the risks and penalties associated with non-compliance.
How Does My Business Become Compliant?
To become PCI compliant, you will need to implement a number of security controls. These controls will vary depending on your organization's size and complexity. However, some common controls include:
- Keeping your hardware and software up to date
- Using strong passwords and multi-factor authentication
- Encrypting cardholder data
- Implementing a firewall
- Conducting regular security assessments
Additionally, we are the PCI compliance experts and would help build a system to get your business compliant. If you're interested, or want more information, please fill out the form at the bottom of the page.
FTC Compliance
The Federal Trade Commission (FTC)
enforces a number of regulations that businesses must comply with, including
the Children's Online Privacy Protection Act (COPPA) and the Gramm-Leach-Bliley
Act (GLBA).
Outdated technology makes it difficult
to comply with FTC regulations, because outdated systems may not have the
latest features that are required to comply with the regulations.
The FTC Safeguards Rule includes
seven specific rules that businesses must follow:
- Develop and implement written policies
and procedures to control risks to customer information.
- Designate and implement appropriate
security measures to control access to customer information.
- Take steps to reasonably safeguard
customer information in electronic form.
- Train employees on the information
security program.
- Develop and implement procedures to
respond to unauthorized access to or use of customer information.
- Regularly monitor and test the
effectiveness of the information security program.
The
penalties for non-compliance with the FTC Safeguards Rule can be quite
significant. The FTC can impose penalties up to as much as$ 100k per violation,
an additional $10k against officers and directors and damages for consent
violations that can total $43k a day for each violation and litigation. All the
above can cause reputational damage to your business.
By keeping your technology up to date, you can help to ensure that your business is FTC compliant and avoid the risks and penalties associated with non-compliance.
Additional Tips on How to Comply with the FTC
- Review
the FTC's website and resources. The FTC's website contains a wealth of
information about FTC laws and regulations, as well as guidance on how to
comply.
- Develop and implement a compliance program. A compliance program is a set of policies and procedures that help businesses to identify and mitigate risks associated with FTC violations.
- Train employees on FTC compliance. All employees who are involved in marketing, sales, or customer service should be trained on FTC compliance requirements.
- Monitor compliance. Businesses should regularly monitor their practices to ensure that they are complying with FTC laws and regulations.
If you are an accountant or CPA, you may have specific needs when it comes to FTC compliance. For example, you may need to comply with the Gramm-Leach-Bliley Act (GLBA), which protects the privacy of financial information. When choosing a tech services company to help you comply with FTC regulations, it is important to make sure that they have experience working with accountants and CPAs. They should also be familiar with the GLBA and other relevant laws and regulations.
By working with a qualified tech services company, such as Vector Choice, you can ensure that your business is compliant with FTC regulations and that your clients' financial information is protected.
There are a number of other benefits to hiring a tech services company to help you comply with FTC regulations, including:
- Expertise: Tech services companies have the expertise to help you identify and mitigate risks associated with FTC violations. They can also help you to develop and implement a compliance program.
- Resources: Tech services companies have the resources to help you comply with FTC regulations. They have access to the latest technologies and security tools, and they can provide you with the support you need to maintain compliance.
- Peace of mind: By hiring a tech services company to help you comply with FTC regulations, you can be confident that you are taking steps to protect your customers and your business.
Server 2012 EOL
Microsoft has announced that it will
end support for Server 2012 on October 10, 2023. This means that the 40,000+ businesses
that are still using Server 2012 will no longer receive critical security
updates or patches.
As a result, businesses that continue
to use Server 2012 after October 10, 2023 will be at increased risk of
cyberattacks.
If you are still using Server 2012,
you should start planning to upgrade to a newer version of Windows Server. This
will help to protect your business from cyberattacks and ensure that you are
compliant with the latest security regulations.
For more details on Server 2012 EOL,
read our recent article here.
Or you can fill out the form at the bottom of the page to speak to one of our expert representatives
about options to replace your outdated system.
Cybersecurity
Outdated technology is more vulnerable
to cyberattacks. This is because it is often not up to date with the latest
security patches and updates. As a result, hackers will exploit known
vulnerabilities to gain access to your systems and data.
A recent study by IBM found that the
average cost of a data breach in the U.S. is $9.44 million. This includes the
costs of investigating the breach, notifying affected customers, and repairing
the damage. In another study by the Ponemon Institute, it was found that
businesses that use outdated software are 4 times more likely to experience a
data breach.
By keeping your technology up to date, you can help to protect your business from cyberattacks and reduce the risk of a costly data breach.
Here are some additional tips for
managing the security of outdated technology in your business:
- Conduct regular risk assessments
to identify outdated technology that is putting your business at risk.
- Create a plan to upgrade outdated
technology in a timely manner.
- Implement security measures to
protect outdated technology that cannot be upgraded immediately.
- Educate employees on the risks of
using outdated technology and how to protect themselves.
How Is Vector Choice Different from Other Providers?
Vector Choice approaches cybersecurity differently than other IT Companies. By approaching cybersecurity, not from an "if", but from a "when it does happen" standpoint. They always take the assumption that you will be hacked, because 95% of all breaches will be due to user error. Which means, it's just a matter of time. Do you want a company that is just blocking the perimeter, or do you want a company that takes a wholistic approach and protects the perimeter, the internal network, and trains staff to account for the human element?
