Paradigm Consulting Co. » Accounting & Bookkeeping

ABA Recommends Dedicated PC for Online Banking

Peter Nikolaidis — Fri, 22 Jan 2010 11:36:42 +0000

Earlier this month the American Bankers Association (ABA) has issued practical, simple advice which could dramatically enhance everyone’s online banking security. And, I predict, it won’t make any difference because people are unlikely to do it.

The advice is to have a PC dedicated to online banking. If you weigh the convenience and cost savings of having access to online banking, versus time spent on the phone or traveling to and from a bank to conduct your business, the expense of a PC dedicated to this task, to continue to enable online banking, will likely be recouped within a matter of weeks, if not days.

The three arguments I’ve heard against this are:

We don’t have enough money in the bank for anyone to want to hack it. (Or, “no one is interested in us because we’re too small.“)
Then it sounds like you have everything to lose! Isn’t it more important to protect what assets you have, regardless of size?
We’re protected by our bank’s security.
No, you’re not. Bank websites get hacked frequently. Don’t believe me? Just do a Google search on the subject. Furthermore, the banks are not required to refund your money! You do not have the same protections as you do with credit cards on bank accounts. Finally, it’s not usually the bank that gets hacked – it’s your computer.
We can’t afford the expense.
The cost of a lightweight PC dedicated to this task is most likely lower than most of my clients’ electric bill, heating bill, or liability insurance for one month. You can afford the cost. But can you afford getting hacked and having your assets drained?

This is the same advice we gave on this blog last year. It’s sound. It’s simple. It’s cheap. Get a new netbook for a couple hundred dollars and use that for online banking. Is this not worth the risk of your business losing tens of thousands of dollars from its bank account? Please, if you do online banking at home or at work, at the very least, practice it from a non-Windows computer not running Internet Explorer. Better yet, prove me wrong and get a cheap PC and dedicate it to your online banking needs. Never go to any website other than your bank’s with it. Another alternative would be to boot from a live CD of your favorite Linux distribution, such as my favorite, Ubuntu.

References:

Bank Sued for Losses Due to Alleged Weak Security

Peter Nikolaidis — Tue, 29 Sep 2009 22:41:13 +0000

In a previous post, I wrote how small businesses are being scammed by European cyber-hackers. In a related story, Computerworld reports how Pacto Construction Co. in Portland, ME is suing Ocean Bank of Delaware because the company lost hundreds of thousands of dollars due to allegedly weak security on the part of Ocean’s online banking system.

The main alleged weakness is the lack of two-factor authentication by Ocean Bank. While I am not sure that this places all of the blame in Ocean’s hands, and I think that Patco should be at least partially responsible for their losses if it is found that their own systems were compromised, a victory by the plaintiff in this case could set an interesting precedent to financial institutions who have not implemented strong authentication mechanisms in their online services. Banks and credit unions – take note! However, a victory by the defendant will likely send a very different signal, more to the tune of “If you bank online, you take your chances.” Small businesses and individuals – take note!

This week’s Data Security Podcast also has an excellent interview with the attorney who filed the suit on behalf of Patco.

Small Businesses Losing Millions to European Cyber-Gangs

Peter Nikolaidis — Fri, 28 Aug 2009 14:15:39 +0000

This week, the Washingon Post reported a fascinating story on how “organized cyber-gangs in Eastern Europe are increasingly preying on small and mid-size companies in the United States.” They appear to be targeting small businesses for the simple reason that they are easier nuts to crack than large financial institutions.

Think about it for a minute and this makes perfect sense. Many of my clients frequently ask “why would anyone come after me? I don’t have anything anyone would want.” If you’ve ever watched a good heist movie (Ocean’s 11, the Italian Job, Heat, Heist, etc.) you can get an idea of what a massive “bank job” entails (at least, in Hollywood). That having been said, it’s a lot easier to simply forge an email to someone within a company using a tactic known as “spear phishing,” where the sender fools the recipient into divulging information in some way. The Post continues:

… the scammers … send a targeted e-mail to the company’s controller or treasurer, a message that contains either a virus-laden attachment or a link that — when opened — surreptitiously installs malicious software designed to steal passwords. … the crooks then initiate a series of wire transfers, usually in increments of less than $10,000 to avoid banks’ anti-money-laundering reporting requirements.

While laws protect consumers from fraudulent charges on their credit cards, similar legislation does not protect bank accounts, and generally, once the money’s gone, it’s gone, as is illustrated in this paragraph from the article:

In February, fraudsters struck JM Test Systems, an electronics calibration company in Baton Rouge. According to … the company’s controller… an unauthorized wire transfer of $45,640 was sent from JM Test’s account to a bank in Russia. … [JM Test] was able to recover just $7,200 of the stolen money…

All small businesses should ensure that everyone with access to any sort of financial information on their computers or online has gone through basic “safe browsing” and social engineering awareness training to ensure that they do not accidentally give away the keys to the kingdom.

AT&T: We Don’t Want Your Business

Peter Nikolaidis — Fri, 21 Aug 2009 15:59:54 +0000

This week, at a client’s request, I am reviewing their entire telecommunications spending. I decided to look at four different vendors to compare their offerings. The first one I looked at was AT&T, to see if they had a comparable long distance package.

I started at Google, searching for “AT&T long distance.” The first result can be seen here.

I clicked the first link, which took me to an AT&T site, which can be seen here.

Note the phone number in the bottom left. 800.000.0000. Well, I suppose if anyone could get such a cool number, it would be AT&T. I called it. Guess what? That number doesn’t really work. Big surprise.

So I clicked the link next to it. After a few seconds, I got this:

Okay, then I decided to try the phone number in the upper right. I dialed 888.944.0447. I selected the option to talk to someone about long distance service. After a few seconds, a voice came on the line and said “We’re sorry, but no one is available to take your call now. Goodbye,” and I was disconnected.

Update: I called Sprint to get a competitive quote. Using the phone number I got from their website, I receive the standard “we’re sorry, you have reached a number that has been disconnected or is no longer in service. If you feel you have reached this recording in error, please check the number and try your call again.” I did that. Three times. Sprint, apparently, also does not want our business.

Update: A friend pointed out that the page I hit was most likely “dead” and I’d get better results by starting at ATT.com and working my way down from there. I did this, and did indeed find some non-dead web pages and additional telephone numbers to call, which did appear to work. However, when I called, I was redirected to someone whose mailbox was full!

Software Review: Moneydance (Including a Rant Against Quicken)

Peter Nikolaidis — Fri, 14 Aug 2009 13:24:40 +0000

I recently started the process of converting my personal finances from Quicken to Moneydance. I have been using Quicken for at least ten years, not because I like the program, it’s just that it’s “what I’ve always used.” I decided it was time to apply some of my own consulting practices and take a look at my personal finance management situation as if I was a client, and ask myself “is this the best solution for my problem?” The answer was a resounding “no.”

I don’t know about the current Quicken for Macintosh, but last I checked, it did not use the same file format as the Windows version. This means if I create a file in Quicken, and want to use it on a Mac, I need to manually export every account (checkbook, investment, savings, loan, etc.) one at a time, and import it into the Mac version. Then, if I decide to go back to Windows, I need to do the same thing in the other direction. This is obviously not a fun or quick and easy process, so moving back and forth is not an option. If, for instance, you have a Mac and a Windows machine at home, and want to share the finances, you can’t easily do this with Quicken.

Another consistent annoyance is Quicken is bloated and slow. It frequently will hang and the window will strobe constantly, as if the focus is changing back and forth between two panels in the program. During this time, it is completely useless, and will often hang for several minutes, forcing me to terminate the program and restart it.

Intuit updates the software every year, and takes steps to make you have to upgrade, like disabling support for their older file format downloads from online banking institutions. However, they rarely add any new features that make it worth upgrading.

Finally, Quicken’s data file is prone to corruption. In the last year, mine got corrupted twice, forcing me to revert to a prior backup, losing a week or so worth of data on one occasion. That was the last straw.

Enter Moneydance. I first heard about Moneydance from Chess Griffin‘s Linux Reality podcast. Moneydance immediately appealed to me because it is available for Mac, PC, and Linux. Furthermore, all three editions share the same file format, so I could use Moneydance on my Mac, my Linux workstation, or my Windows desktop to do my finances, and not be tied to any one.

I was able to download a trial version from the Moneydance website, and install it in a few minutes. Immediately, I noticed that Moneydance loads more quickly than Quicken. Its interface is less flashy, and different from the one I’m used to with Quicken, but I was able to quickly learn my way around so that I could transfer my finances to it.

Moneydance supports the current QFX (Quicken 2005 or newer) file download type, as well as the older QIF import, which Quicken no longer supports. I exported all of my accounts from my credit union as of July 1, and reconciled them in Moneydance. A (very minor) glitch I saw here was that there was no way to “accept all” transactions – I had to click “accept” to each and every transaction as I imported them. Given that I was importing a month’s worth of transactions from three accounts, this took a while.

Another small quirk is that Moneydance assigns a default category to every transaction. For some reason, it chose “ATM Withdrawl” as mine (probably because it was alphabetically first in line), so everything I imported was an “ATM Withdrawl.” I had to go through and change categories on them to things like healthcare, groceries, aikido, etc.

Moneydance, with several accounts’ information loaded, uses around 10MB of memory. Quicken, on the other hand, took up nearly 80MB of memory just to load.

Moneydance also allows me to sort my registers by date ascending or descending – something Quicken never let me do. Amazing. Now I can look at my register side-by-side with my online banking statement in the same order!

One useful feature which Moneydance appears to lack is integration with larger financial institutions for automated downloads. Ameritrade, Bank of America, American Express, etc., all offer services to integrate Quicken with these and other institutions, making updating your accounts online very simple. Unfortunately, with Moneydance, this requires visiting the financial institution’s website and downloading files, or manually updating investment account balances. Given that I have to visit my local credit union’s site to download my statements anyway, this is not a huge inconvenience. However, updating my stock portfolios is proving to be a little more work than I had hoped.

In short, Moneydance is well worth the $39.99. It costs about the same as Quicken, runs on multiple platforms, chews up fewer resources, and lacks all of the bloat.

Quickbooks 2009, Now With Chat

Peter Nikolaidis — Fri, 24 Apr 2009 13:00:31 +0000

A few weeks ago we upgraded our internal bookkeeping system from Quickbooks 2006 to QuickBooks Pro 2009Quickbooks 2009.

Summary: While Quickbooks 2009 offers a noticable speed increase, don’t upgrade unless you have to, and are prepared to dedicate a server to host your company file.

I was not looking forward to this upgrade, as every Quickbooks upgrade I’ve ever done (starting with version 96, then 99, then 2001, then 2003, then 2006) has gotten slower and slower with each passing release. However, since we run our payroll through Quickbooks, and Intuit (Quickbooks’ publisher) discontinued support for payroll services as of March 31, 2009, we either had to upgrade or find a new payroll processor, or do it by hand. I decided that upgrading was the path of least resistance.

In addition to bookkeeping, we use Quickbooks as our company’s timer application. Since most of the work we do is billed by the hour, it is important that our staff have be able to track their time down to the minute. Quickbooks has included a timer application for as long as I’ve used the software, and, for as long as I’ve used the software, the timer application has been terrible. It was cumbersome, difficult to set up for remote users, difficult to sync their time with the main company file, and very unstable and prone to crashing all the time. Because of this, we opted for the additional expense of several Quickbooks licenses to allow users access to the program just to track software. Already, this was not a great solution, but it was the best we could come up with and, as these things go, we stuck with it.

Different from 2006, Quickbooks 2009 now requires that you have a dedicated server to host your company files. Right away, I was not happy with this. I do not like having to dedicate a machine to this purpose because it means you will

install the server on one of your users’ desktops, which will invariably crash or be shut down at some inopportune time, causing other users to lose data, or
incur additional costs associated with the server to run it on
install it on an existing server, which is possibly already overloaded and shouldn’t have any more services running on it.

Regardless of where you install it, you have another piece of software running on your network which must be monitored for updates and security fixes. If it isn’t obvious by now that I wasn’t happy with this requirement, it should be.

As it happens, I did have a spare server on my network that was not doing much, so I chose that machine to host the Quickbooks database. Installation was easy, including the installation of Adobe Flash Player 9, which is required to to the install, (and which is known to have serious security vulnerabilities).

I copied the database file to the new server, and followed the steps to add the file to its configuration so that it would host the company file for the rest of my network. As I expected, the first time I ran it, Quickbooks told me it was time to upgrade the file to 2009 format. I tried this step 4 times, each time it would fail, either to back up the file before conversion, or afterward, saying “the company file is in use.” Eventually, I decided to move the company file to my local machine and try the upgrade there, which worked. So what Quickbooks meant to say was “you can’t upgrade a company file over the network,” but instead it said “the company file is in use.” Not very helpful, and wasteful of my time.

On two occasions my system has been brought to a complete standstill as the database manager (which I don’t think I’m even using on my computer, as it’s not hosting the database) has run amok, spawning dozens of copies of itself and chewing up all available memory and CPU time, forcing me to reboot the computer to get control of the machine back. This is completely unacceptable, and I will log a support case with Intuit on this. Hopefully they will tell me something more than “reboot your computer.”

What’s New and Good?

I also observed that Quickbooks added a chat feature, so now I can chat with anyone who’s in Quickbooks. Of all the things I wanted from my accounting and bookkeeping package, “chat” was never one of them that came to mind. Yes, I can see myself using it to ask users to log out when I need to do maintenance or something, but is chat really where Intuit should be focusing its efforts? I’d prefer they focused on improving the product’s speed and stability. Apparently they have made some progress in the speed department. Stability however, still needs some work.

New since 2006 is the “Company Snapshot” report. This one-page report shows a graph of the year-to-date income and expense trend, account balances, accounts receivable, vendor payables, reminders, and forms to print. This is a handy feature which I can see myself using, instead of opening many reports in succession when I want to see these bits of information.

I saved the best for last. Quickbooks 2009 is noticeably faster than previous versions. Also, there were several spots where the older version would pause when entering a new transaction, eating several characters I’d type. For example, when receiving a payment, I would start to type the check number (e.g. “12345″) but Quickbooks would hang after the 1, losing a few characters, and I’d end up entering “145″ instead. This annoyance seems to have been cured. At least we get something out of this upgrade. I’m still not sure it was worth the cost, however.