Preparing for AI

by John Hensberger | Apr 8, 2025 | AI

Black Bottle IT is exhibiting at the PASBA Event in Clearwater FL May 2025

Black Bottle IT is Joining the PASBA Spring Summit in Clearwater, Helping Firms Prepare for AI.

Prepare for AI Integration and Security

As accounting firms increasingly adopt AI-powered tools for tasks like automated bookkeeping, anomaly detection, and tax preparation, securing these systems becomes critical. The Black Bottle IT team is poised to share with PASBA attendees why the time is now to prepare and implement the following:

Implement strong data governance practices before feeding financial data into AI systems
Verify that AI vendors have robust security measures and compliance certifications
Create clear policies regarding what client data can be processed by AI tools
Regularly audit AI outputs for accuracy and potential security issues
Establish boundaries for AI usage to maintain human oversight of sensitive financial decisions

Strong cybersecurity fundamentals directly impact your AI readiness.

Secure data practices ensure AI systems have clean, protected information to work with, while proper access controls prevent unauthorized AI usage. As accounting AI tools become more sophisticated, your cybersecurity infrastructure will determine how safely and effectively you can leverage these powerful technologies.

Where is your Organization in its Cybersecurity Journey

“The majority of our team is hybrid. We provide cyber awareness training and believe we protect PII well. However, it’s time to renew our cyber insurance, and I’m not sure we can get a new policy because we don’t have written and executable policies and procedures.”

By implementing these cybersecurity practices, you’ll significantly reduce your risk exposure while demonstrating to clients that protecting their financial information is a top priority—whether that information is handled by humans or emerging AI systems.

Contact Black Bottle IT today!

Here’s a link to more information for Accounting Firms about the Spring PASBA Show in Clearwater, FL

Digital Spring Cleaning: A Must for PCI Compliance

by John Hensberger | Feb 4, 2025 | Compliance

If you process even a single credit card transaction, this message is for you. From the corner coffee shop to the bustling e-commerce store, PCI compliance isn’t optional – it’s essential. And with spring around the corner, there’s no better time to clean up your digital security.

Who Needs PCI Compliance?

The short answer? Everyone who accepts credit cards. This includes:

Small retail shops processing in-person transactions
Restaurants with payment terminals
Online stores of any size
Service providers accepting card payments
Mobile businesses using card readers
Subscription-based businesses with recurring payments

The Myth of Being “Too Small to Target” Many small business owners think their size protects them. Unfortunately, cybercriminals often target smaller businesses precisely because they tend to have weaker security measures. In 2023, 43% of cyberattacks targeted small businesses, and the average cost of a data breach for small businesses exceeded $200,000. (Verizon)

Spring Cleaning Your Security for PCI Compliance

Start with Password Hygiene

Your payment processing systems are only as secure as their passwords. Implement a password manager for all employees and require complex passwords with minimum 12-character lengths. For PCI compliance, ensure all default passwords on payment terminals and systems are changed immediately.

Clean Up User Access

PCI compliance requires strict access control. Review and revoke access for former employees, particularly those who handled payment data. Implement role-based access control (RBAC) to ensure employees only access what they need for their specific jobs.

Update and Patch Everything

Payment systems must have the latest security patches. Schedule automatic updates for all software, especially:

Point-of-sale systems
Payment terminals
E-commerce platforms
Card readers
Backend payment processing software

Backup and Recovery Check

PCI compliance requires secure backup of cardholder data and a tested disaster recovery plan. Store backups in multiple locations, but ensure they’re encrypted and protected according to PCI standards.

Train Your Team

Your employees are your first line of defense. Schedule regular training covering:

Proper handling of credit card information
Recognition of card skimming devices
Identification of phishing attempts
Secure remote work practices
Incident reporting procedures

The Benefits of Compliance

Beyond avoiding penalties, PCI compliance offers substantial benefits:

Protected payment card data reducing breach risk
Enhanced customer trust in your business
Reduced likelihood of fraudulent transactions
Improved overall security posture
Potential insurance premium reductions

Getting Started

Begin with a self-assessment to determine your current compliance level. The PCI Security Standards Council offers questionnaires based on your transaction volume and processing methods. Use this spring cleaning period to:

Complete the appropriate self-assessment questionnaire
Conduct a network scan if required
Address any gaps in your security
Document all your security procedures
Train your staff on new procedures

Remember, cybersecurity isn’t a one-time spring cleaning task – it’s an ongoing process. However, using this season to establish strong security habits can set your business up for long-term success and compliance.

Maintaining a clean and secure digital environment isn’t just about checking boxes for PCI compliance – it’s about protecting your business, customers, and reputation. No company is too small to start taking security seriously. Begin your digital spring cleaning today, and make security a year-round priority.

Black Bottle IT wants to connect with your business today. Our cybersecurity consultants will get started with the appropriate assessment questionnaire. Email us at info@BlackBottleIT.com.

Beyond Break-Fix: Transform Your IT with Proactive Management

by John Hensberger | Nov 4, 2024 | Cybersecurity

Implementing a comprehensive, proactive maintenance strategy through Managed IT Services is essential for modern businesses seeking to maintain operational excellence and minimize costly downtime.

Organizations can identify and address potential issues before they escalate into major problems that disrupt business operations by continuously monitoring system health, automating critical updates, and conducting regular infrastructure assessments. This preventive approach safeguards against unexpected system failures and optimizes performance across the entire IT infrastructure. A well-managed IT environment reduces security risks, ensures compliance with industry standards, and provides predictable IT costs through strategic planning.

Moreover, with automated monitoring and expert oversight, businesses can focus on their core objectives while maintaining confidence that their technology infrastructure is operating at peak efficiency, backed by robust disaster recovery protocols that protect against both natural disasters and cyber threats. This proactive stance ultimately translates into improved system reliability, enhanced user productivity, and a more substantial return on technology investments.

5 Proactive IT maintenance and managed services Black Bottle IT focuses on with their clients:

Regular system monitoring and diagnostics detect potential hardware failures, performance bottlenecks, and security vulnerabilities before they cause disruptions – this includes monitoring server health, network traffic patterns, and system resource usage to identify warning signs early.
Automated patch management and software updates ensure all systems have the latest security fixes and performance improvements, reducing exposure to cyber threats and preventing compatibility issues between applications.
Scheduled hardware assessments and lifecycle management help plan for equipment replacement before components reach end-of-life, preventing unexpected failures and allowing for strategic budget planning for upgrades.
Continuous network optimization through bandwidth monitoring, traffic analysis, and infrastructure tuning keeps data flowing efficiently and prevents slowdowns that can impact productivity.
Systematic data backup verification and disaster recovery testing ensures business continuity plans remain viable and can be executed successfully if needed, protecting against both system failures and cybersecurity incidents.

Black Bottle IT would love to learn more about your work environment and provide an assessment for a modern-day Managed IT and Cybersecurity Solution. Contact us today!

The Breach: Part 4

by John Hensberger | Oct 25, 2021 | Breach Hotline, Cybersecurity, Risk Management

The Breach – Part 4

And the Story picks up where we left off here.

Date of Discovery

All along the way, third-party companies were lining up with bags opened, hoping to get them filled with “incident response” money. Most of them were trying to create some real sense of urgency to engage and take action. I never fell for the high-pressure tactics; I wanted to get some options, evaluate the risks, and make an informed decision. However, in the days that followed, the attorneys started educating us in the generalities of cyber statutes. Most of them had a requirement to respond with their timelines after the “date of discovery.” This was the only timeline that mattered. So, we had time, but much, to rationally engage third-party forensics to a specific scope of the data breach so that we could formulate a responsible response plan.

250 Records Lost – What A Relief

After sending the forensic team copies of the hard drives from machines in scope, we had many calls with the team. After their investigation, they thought we could have lost about 250 records of personal information. At first, it was a relief, as it could have been much worse. But shortly after, I started to realize that their analysis was speaking in hypotheticals. The words beings used were “we think,” “they might have,” “it possible,” rather than more explicit language. So, I started to understand that they didn’t know, but the forensics team advised me on the potential risk of what was accessible to the cyber attackers. After this call, we had a pretty good idea about the size and scope of the attack. At this point, I was finally able to provide some tangible details to the stakeholders of the company. Until now, the information I had was all hypothetical; now, we had some excellent news to act on.

The First Invoice — Yikes

A few weeks into this saga, the Company received its first invoice from the Data Breach Coach (attorneys) and the forensics company. Let’s back up. We engaged this firm because we had access to them through our insurance coverage. And, we received about 60% more financial relief from all the expenses if we used the insurance companies’ providers rather than just find our resources. So, naturally, we engaged the providers recommended by our insurance company. But, there was a limit to what the coverage would allow for. At first, I thought the coverage was way more than enough until the first invoice arrived. The hourly billable rates were so high, and I felt they misplaced a decimal point. Our first invoice ate up around 35% of our allowed coverage. I needed to make sure the Company was using its coverage limit wisely. The Data Breach Coach and forensics team afforded plenty of opportunities to do work and eat up our remaining coverage.

The Response

After the scope of the event had been determined, it was time to work on the response. The legal team briefed us on the types of actions that we needed to take. First, we needed to determine what states the impacted parties were residing in. Each state has its reporting requirements when a data breach involves personally identifiable information. Some states even require credit monitoring and other services to protect individuals from identity theft.* I quickly realized that the attorneys understood these requirements and would be an extremely valuable resource. They took on crafting notification letters to 15+ states on our behalf and having guidance that his juncture of the story was very comforting. I understood our risk and felt comfortable we were doing the right things.

*note — These requirements are now commonplace in most states, but during this time, these requirements were not the norm

Our MSP Should Know How To Help Us Remediate… Not So Fast

At the same time our talks with the attorney and forensics, the Company was actively trying to remediate the root cause of the cyber attack. We were confident we had stopped the attack. But, verifying we had no lingering effects of our attack proved harder than we thought. We reach out to our MSP for advice and assistance. We planned a weekend to come in, install advanced cleaning tools, and clean every machine in the building (over 100). We only completed the task to find the infected device (that was cleaned) with some unrelated malware. We scheduled another weekend to re-clean all the machines again. After the 2nd round of cleansing, the malware was found again. It was then I realized our MSP was not equipped to handle our situation. To date, they have served us well, but the problem overmatches us. In summary, they were not security experts, so we needed additional support.

The moral of this story, Managed Service Providers, are good at traditional things, procurement of new hardware, architecting new infrastructure, end-user support.. etc. But, cyber security experts were not. Through lots of activity and a few 3rd parties, we could get our environment clean and remove any remnants of the attackers.

Final Part 5 is coming soon.

About the Author:

This blog was written by John Hensberger, Managing Partner of Black Bottle IT. Earlier in his career, John was also part of a company that experienced a cybersecurity breach. That experience fueled his passion for assisting other companies with their cybersecurity needs to mitigate their risk. As Technology Executive and Cybersecurity Advisor, John was recognized as the Pittsburgh CIO of the Year, 2014. Connect with John here.

The Breach: Final Chapter

by John Hensberger | Oct 25, 2021 | Breach Response, Cybersecurity

The Breach: Final Chapter

Why Does The Attorney General of North Carolina Care About Our Data Breach?

Our Data Breach Coaches had filed the necessary communications with several state Attorney Generals. We were advised that most states would acknowledge, and it would end there. However, the Attorney General’s Office in North Carolina reached out and requested more information. This was surprising to me, as I didn’t know how to respond or why they would be asking for more details. Fortunately, our Data Breach Coach fielded the request, and we had a call to discuss the strategy of how to respond. Our response was most reassuring that we had taken the necessary measures to prevent an issue like this from happening again. This was just another point, where had we not engaged the right people, we would have had no idea the reporting requirement existed and/or how to respond to requests for more information. As I learned, each state has different reporting requirements, and North Carolina was not the last state to request more information.

Credit Monitoring, Makes Sense

After two months, we were rounding the home stretch of our incident response. The final piece was to figure out how to protect the impacted individuals from any potential damages. Our Data Breach Coach asked us how we wanted to proceed. (Let’s pause for a second, this is a common theme throughout the process. At various points, third parties who had expertise in a subject matter would ask us our thoughts on how we’d like to proceed. We wanted guidance from the experts in areas we needed; I thought it strange we were asked this, rather than just presented options, back to the story) Obviously, we didn’t know how to respond, so we asked for options.

As a sign of “goodwill,” they suggested offering everyone credit monitoring for two years. That seemed reasonable to us. So they referred us to a national brand that provides these services. During our first call, they offered credit monitoring, explained the process. All of which was acceptable, but then they started talking about setting up a call center, handling questions by the impacted individuals, printing notification letters, and lots of other services. All of which sounded like a great idea had the scope of our incident warranted. However, our situation was so small that it seemed like overkill and yet another way to spend the Company’s money needlessly. So, we set up the necessary processes with internal staff, contracted to offer the credit monitored, and sent out the notification letters. Materially, the incident response was effectively over.

You Want A Detailed Recap Of The Breach Response. Are You Sure?

Finally, after all notification requirements were handled, credit monitoring handed out, and all inquiries were answered, we had a chance to exhale a bit. The incident could have been much, much worse. But we’d made it through. After thinking about it, I realized I didn’t have a formal recap of our response from our Data Breach Coach. I thought, should any inquiries be going forward about how we responded, I should have something to prove that we satisfied all the legal requirements and acted ethically. So, I launched a call to our Data Breach Coach. Out of everything we experienced, this final chapter is something that surprised me the most. After a few days, the Data Breach called me back and acknowledged my request.

Here is our dialog:

Data Breach Coach: What do you want a formal recap of all the activity that occurred on your behalf in responding to this incident?

Me: “Yes, I do; I want to be able to produce some formal documentation of how we responded to our incident in the event it is needed in the future.”

Data Breach Coach: “Are you sure you want this?”

Me: “Yes, I’m sure.”

Data Breach Coach: “Are you really sure?”

Me: “Rather than ask me if I really want it, can you just tell me why you are asking if I want it?”

Data Breach Coach: “If we produced it, it becomes a legally discoverable document, which might not be in your best interest, should future legal action be taken against you and your Company.”

Me: “So, let me get this straight, we spent three months and 250K responding to this incident. We dotted every ‘i’ and crossed every ‘t.’, But it’s not in our best interest to have a formal recap of the actions taken, to prove that we handled the incident in accordance with all the requirements?”

Data Breach Coach: “We can add a high-level summary to your file, should you need it, you can call our office, and we’ll produce it, but having a detailed document isn’t in your best interest.”

Me: “Ok, if that’s what you think is best, then I guess I don’t want it.”

This last interaction left me a little dumbfounded. But in hindsight, I should have expected it. The whole experience was foreign to the Company and me. In the end, we spent our entire amount afforded to use by our insurance coverage to respond to this incident for the potential loss of 250 records. During the initial days, there was lots of confusion, unknowns, and decisions that needed to be made. We didn’t always make the right ones, but we did have enough presence of mind to slow the situation down, get as data as we could, and make informed decisions.

I’m hopeful that our story can help, inform or at least mildly entertain anyone reading.

About the Author:

« Older Entries

Next Entries »