admin, Author at aACEsoft Business Management Software

Cybersecurity and Key Compliance Requirements

By admin December 6, 2017Articles, Articles and White Papers

Editor's note: Anthony La Polla is Vice President of Operations at Critical Defence, LLC. We're delighted to share his expertise in cybersecurity with our audience.

As the use of technology continues to increase in today’s business, so do the concerns pertaining to cybersecurity. According to the Verizon 2017 Data Breach Investigation Report:

75% of breaches were perpetrated by outsiders
62% of breaches featured hacking
81% of hacking involved weak or stolen passwords
66% of malware was installed via malicious emails
73% of breaches were financially motivated
1 in 14 users were tricked into following a link or opening an attachment

The statistics are alarming, and the consequences of a breach could be catastrophic. From theft of client personal data, loss of propriety data or intellectual property, or payment card data leakage, a single breach could cause the total collapse of the business. As a result, companies are taking action with some key measures, including:

Training staff to identify warning signs
Following the principle of least privilege
Instituting patch management policies
Encrypting sensitive date to make it useless if stolen
Requiring two factor authentication to limit damage if lost or stolen
Regularly reviewing log files for warning signs of a breach

And companies aren’t the only ones taking notice of the risks associated with cyber-attacks and vulnerabilities. Government agencies are making concentrated efforts to protect companies, employees and consumers from these digital crimes. Two of the most recent mandates addressing these issues are the General Data Protection Regulation (more commonly known as the GDPR) and New York State’s DFS Regulation 500 Part 23.

GDPR

The European Parliament adopted the GDPR in April 2016, replacing an outdated data protection directive from 1995. It carries provisions that require businesses to protect the personal data and privacy of EU citizens for transactions that occur within EU member states. The GDPR also regulates the exportation of personal data outside the EU. The GDPR applies to any company which has a presence in an EU country, processes personal data of European residents, has more than 250 employees, or fewer than 250 employees but its data-processing impacts the rights and freedoms of data subjects, is not occasional, or includes certain types of sensitive personal data. That effectively means almost all companies.

The GDPR protects basic identity information such as name, address and ID numbers, web data such as location, IP address, cookie data and RFID tags, health and genetic data, biometric data, racial or ethnic data, political opinions, and sexual orientation. The GDPR requires that companies appoint a Data Protection Officer, identify all protected data within the network, create a data protection plan, create a data retention policy which allows individuals the right to have their data completely removed upon request, conduct a risk assessment, report any breach within 72 hours and revise risk mitigation programs.

The GDR also outlines the consequences of failing to comply, and they are steep. It allows for financial penalties of up to €20 million or four percent of global annual turnover, whichever is higher, for non-compliance. Management consulting firm Oliver Wyman predicts that the EU could collect as much as $6 billion in fines and penalties in the first year. The good news is that there is still time to comply; GDPR enforcement will begin May 28, 2018.

DFS Reg 500 Part 23

The New York Department of Financial Services (DFS) has issued 23 NYCRR Part 500, a regulation designed to promote the protection of customer information as well as the information technology systems of regulated entities (financial institutions such as banks and insurance companies). This regulation requires each company to assess its specific risk profile and design a program that addresses its risks in a robust fashion. Senior management must take this issue seriously and be responsible for the organization’s cybersecurity program and file an annual certification confirming compliance with these regulations. A regulated entity’s cybersecurity program must ensure the safety and soundness of the institution and protect its customers.

The regulation requires that covered entities create and implement a cybersecurity program and policy the identifies and mitigates risk and aims to prevent breaches. The regulation is rather specific and requires, at a minimum, that covered organization do the following:

Assign a Chief Information Security Officer
Perform annual penetration testing
Perform Bi-annual vulnerability assessments
Maintain an audit trail
Limit access privileges
Ensure the use of secure deployment practices
Conduct a periodic risk assessment
Utilize qualified cybersecurity personnel
Implement a third party service provider security policy
Utilize multi-factor authentication
Limit data retention and create a secure disposal policy
Provide regular cyber security awareness training and monitoring
Encrypt of nonpublic information
Establish a written incident response plan
Notification within 72 hours of cyber event identification

There are few exemptions to this regulation. Only organizations (including independent contractors) with fewer than

10 employees, organization with less than $5,000,000 in gross annual revenue in each of the last three fiscal years, and organizations with less than $10,000,000 in year-end total assets, calculated in accordance with GAAP including assets of all affiliates are excluded from the compliance requirement. This regulation was put into effect on May 1, 2017, and covered organizations were required to be compliant by August 27, 2017. By February 15, 2018, covered entities are required to submit the first certification for 23 NYCRR 500.17(b). On March 1, 2018, covered entities are required to be in compliance with sections 500.06, 500.08, 500.13, 500.14(a) and 500.15 of 23 NYCRR Part 500, and by March 1, 2019, organizations are required to be compliant section 500.11.

As technology and internet usage continue to grow, so does cyber crimeCybersecurity and Key Compliance Requirements . In order to defend against it companies will need to implement appropriate policies and procedures that align with new mandated regulations. These requirements will need to be monitored closely and will need experts to ensure proper implementation and maintenance. Otherwise, the costs and consequences could be catastrophic.

About Critical Defence

Critical Defence, LLC is a global provider of cyber security services including, but not limited to Assurance, Response, Compliance and Training. Additional information can be found at www.criticaldefence.com.

Keep Track of Your Correspondence with aACE Email Integration

By admin December 4, 2017aACE Feature Highlights, aACE Videos, CRM, Integrations

Most businesses today rely on email to exchange information, but it can be all too easy for messages to get lost in your inbox – and when that happens, you risk missing out on vital details that could impact your communication with your customers. Wouldn’t it be great if you could file those messages with their associated records in your ERP solution, without having to manually copy and paste the text?

With aACE, you can.

aACE’s email integration feature spares you from time-consuming data entry by linking emails and their attachments directly to the relevant records anywhere in aACE. This feature works across all aACE modules, so whether your message is about a contact, a project, an order, or more, you can organize your emails directly in your aACE solution. Here’s how:

Now that we’ve seen this feature in action, let’s look at one example of how fictional company aACME Education Solutions uses it in their day-to-day operations:

aACME has just fulfilled an order for the Shea Township School District and the invoice has been generated in aACE. John in the Accounts Receivable department is ready to send it to Julia, the school district’s administrative assistant. When John opens the invoice in aACE and selects Email Invoice from the Print menu, his desktop mail app opens with an auto-generated email that has the invoice attached as a PDF. aACE automatically fills in the client’s email address, a pre-set signature, and the invoice’s record ID. Additionally, a special email address for aACME’s aACE solution is included on the BCC line. When John sends the email, a copy appears in aACE’s inbox. Based on keywords in the email, aACE files the message and attachment in three places:

the Invoice record for Invoice #50001
the Contact record for Julia Delaney, the client who received the invoice
the Team Member record of John Smith, the user who sent the invoice

This means that any user with access to these records can view the email right from within aACE. So when Julia contacts her account manager at aACME, Mara Harvey, with a question about the invoice, Mara is able to immediately see what was sent to Julia and when – there's no need to ask John to forward the email or to dig through a long email chain to find the relevant information.

With aACE’s email integration feature, Mara and her colleagues have everything they need right at their fingertips.

To see how other aACE features could work for your business, check out our aACE Videos series. And if you’d like to know more about this feature or discuss what else aACE can do for you, contact us today to learn more.

Gable Finds Time with aACE+ DayBack Calendar

By admin November 29, 2017Success Stories, Top Posts

“The results of implementing the calendar have been overwhelmingly positive. Everybody benefits from “real time” scheduling allowing us to see down to the nth degree what resources are available for any project at any time. The calendar solved the lack of visibility issues we were having.”

– Jimmie Wolfe, Director of Field Operations, Gable

Gable provides visual solutions that attract, engage and direct people to properties, buildings, places, and spaces through the integration of architectural and graphic elements that include signs, digital displays, audiovisual, media and lighting. Its custom signage that is manufactured in-house requires a complex production and installation schedule. However, when it came to scheduling projects, there wasn’t much visibility across the company and rapid decision-making was challenging. When spreadsheets weren’t cutting it, the aACE+ DayBack calendar integration saved the day by allowing users to see exactly what their day, their week, or their month looks like.

CHALLENGES & aACE SOLUTIONS

Behind-the-Times Spreadsheets

As the last link in the chain from order to delivery, the Installation team is responsible for delivering an order to the customer exactly how they want it – and when they want it. Director of Field Operations Jimmie Wolfe and his crews kept track of which orders were assigned to which resources using spreadsheets saved on a shared drive. These were cumbersome to access and time-consuming to keep updated. The aACE+ DayBack calendar now gives them up-to-the-minute visibility into what resources are scheduled where, allowing them to plan installations quickly and accurately.

Surprise Orders

Under the previous system, Jimmie sometimes wouldn’t know an order was coming until a physical copy arrived in his office. At that point, he would manually enter it into a spreadsheet, prioritize and filter the spreadsheet, and then go back and manually remove the order once it was done. With up to a dozen work orders coming in each day, this was a burdensome task. And if the spreadsheets weren't up to date, Jimmie or a member of his team would have to physically track down colleagues to find out what resources were and weren’t available. With aACE+ DayBack he can see an order coming as soon as it’s entered into the system and know precisely what resources are available to fulfill it, giving him more time to plan ahead.

Confused Customers

When a customer places an order, they typically like to know when it’s going to arrive. That sounds like a simple question, but under Gable’s previous scheduling system they often had no simple answer. Sales representatives in the field would have to call the office to find out whether an installation crew was available on the customer’s preferred date. And as orders moved from team to team, project managers had no way to easily track which step of the process they were in. aACE+ DayBack allows sales reps to give customers an immediate answer about when their order will be installed. And if a customer has questions about their order while it’s underway, project managers can see where in the fulfillment process it is and connect them with the relevant team.

RESULTS

Real-Time Visibility

The aACE+ DayBack calendar updates when a change is made to an order, giving users an immediate and accurate view into their own schedule and those of other teams. “It's pretty important for our account managers and our project managers to be able to see in real time what we're doing today, what we're doing tomorrow, or what just got completed,” Jimmie tells us. “The calendar is a window for the company to see exactly what was going on at any given time.”

Drag 'n' Drop Scheduling

With aACE+ DayBack, users no longer have to schedule sections of time just to manage their schedule. Now users can rearrange their calendars in seconds simply by dragging and dropping events from one date or resource to another. The calendar automatically updates the associated order record, making rescheduling as easy as clicking a button. This user-friendly system has been a big crowd-pleaser, especially among employees who were familiar with the previous system. Says Jimmie, “Everybody who's used this tool is ecstatic over it.”

Custom Resources by Department

Gable has currently rolled the calendar out to three teams, each with their own unique needs. Typically, a calendar has one static list of resources for the company, with users able to drag and drop events onto that shared list. Because Gable has different resources in each team, they worked with the aACE team on a custom solution allowing them to set a different resource list for each team that's using the calendar. “It's a nice feature to open up specific calendars on-the-fly for a specific team, see the resources, and set the schedule. That was a great addition,” Jimmie says.

IN THEIR OWN WORDS

Here's what Gable's Director of Field Operations, Jimmie Wolfe, has to say about the calendar:

“It's much easier for people to get the information they need when they need it. There is less time spent on admin tasks, and less walking around the building trying to get updates. Now you can just log into the module and see exactly what's happening. It’s a huge time-saver, really.

“Any business that uses a scheduling system should look into the aACE+ DayBack calendar. This aACE module can be tweaked to conform to different situations. For anybody that currently uses a calendar in their day-to-day operations, this module would obviously be helpful.

“So far there's been an overwhelmingly positive response from everybody at Gable that has seen and used the calendar. They want to see more of it right now, so we're in the process of spreading this through the rest of the company. Eventually we want to roll out our customized calendar to each of the half-dozen teams that can use it. In the teams that keep workflow schedules, it's a must-have. And it improves each time we roll it out, so the next team is getting a better, more user-friendly product each time we set it up!”

Do you or someone you know need a change from one-size-fits-all ERP tools? Check out our videos to learn more about whether aACE business management software for Mac and PC can help accelerate your company. And if you'd like to learn more about the aACE+ DayBack calendar integration, start with our calendar demo to see it in action.

aACE Ranks Higher in Value, Capability After FrontRunners Fall Refresh

By admin November 22, 2017News

This spring we were pleased to announce that aACE had been recognized as a significant ERP Contender in SoftwareAdvice.com’s 2017 FrontRunners Report, a round-up of top-performing business management solutions. Powered by Gartner’s data-driven methodology, this quadrant relies on user reviews and other data to highlight products that offer the best capability and value for their class. Last month the folks at SoftwareAdvice.com took another look at their ERP quadrant – and this time around, aACE earned even higher scores on both axes.

Capability: We've gone up from a 3.45 to a 3.69 in Capability over the past six months. The Capability score is based on factors such as user ratings of the product's functionality, ease of use, and customer support, as well as other data assessed by SoftwareAdvice.com.
Value: Our Value score has risen from a 3.00 to a 3.58 over same short time frame. The Value score is based on factors such as user satisfaction, the likelihood that users will recommend the product to others, and how valuable users consider the product to be, among other data points.

We were chosen as a top product for small businesses from among over 350 enterprise resource planning solutions, largely thanks to reviews from our existing clients. The people who know aACE best are the people who use it every day. We’re delighted that our users have enthusiastically recommended aACE to other businesses looking to streamline their operations and improve their bottom line. Here’s a sampling of what some of our clients have to say:

"I would recommend this software to anyone wanting to simplify his or her workflow, anyone who wants their software to work for them and not the other way around, and anyone tired of the ERP money pit!" – Todd Breedlove, Vice President, Knight Hardwood Flooring, Inc.

"With [aACE], our team members can now see a complete account of the history of a transaction as it moves through our system. Not only does this provide us with visibility that we had never had before, but I'm pleased to say we have also greatly benefited from the increased accountability that comes with logging all that our users have access to." – Andrew Porter, ERP Manager, Gable

"We would recommend aACE to any small to medium-size business that cannot afford full-time IT personnel. Specifically, since we’re a multi-channel business, we would highly recommend aACE to businesses in the following industries: distribution, direct marketing, and mail-order." – Bumkee Kim, President, Janibell

"Over the years and through many other software initiatives, the aACE business suite has proven its robust and flexible characteristics, remaining the core of our management system." – Matthew Pelfrey, Director of Process and Compliance, Duggal Visual Solutions

"I have worked with multiple systems over the years, big and small, and to date I think that aACE is the most user friendly and customizable product available." – Daniel Peleg, Exec. VP of Operations and Business Development, Consumers' Choice Awards

"aACE is perfect for many different types of businesses. It handles inventory very well, projects, general accounting. Due to the nature of the system, and the ability to customize it for a specific business need, it is really a good fit for almost all business types: warehousing, design, etc." – Doug Jacobs, President, Restylers' Choice

To see where aACE placed on the FrontRunners quadrant and download a breakdown of our scores, visit SoftwareAdvice.com. And to learn more about what aACE Enterprise Resource Software for Mac and PC can do for your business, contact us today.

FrontRunners scores and graphics are derived from individual end-user reviews based on their own experiences, vendor-supplied information and publicly available product information; they do not represent the views of Gartner or its affiliates.

aACE Software Featured in Idaho Business Review

By admin November 15, 2017News

Two months ago we announced our expansion to Boise, and we're pleased to say we're already attracting attention in our new hometown. Recently the Idaho Business Review spoke to aACE Software President Michael Bethuy about his decision to establish our new headquarters in the Treasure Valley.

Michael shared that because our Boise office is the center of our general operations — including ongoing aACE development, technical support, documentation, and administrative functions — we're looking for the kind of seasoned professionals that tend to be attracted to an area like Boise, which boasts both a low cost and high quality of living.

“We’re not looking to hire kids right out of school,” Michael told Zach Kyle of the IBR. “Because of the complexity of our product, we want to hire professionals who are seasoned, stable and with kids, that sort of thing. People like that are extraordinarily expensive in places like New York.”

The IBR article focused largely on the Accounting portion of our software; a shortage of accounting talent has many businesses turning to technology to fill the gap. As a complete quote-to-cash solution, aACE is poised to take advantage of this trend. “[I would recommend aACE to] any company that needs a seemingly impossible-to-achieve customized accounting system that will take them from inputting a transaction to the general ledger,” says Wendy Donenfield, CPA and Controller at aACE client M&R International.

For more details on our expansion to Boise, read the full story on aACE in print or online at the Idaho Business Review. And to learn more about how aACE can help your business achieve full visibility into your accounting system and more, contact us today.

Cybersecurity for the Small to Mid-Sized Business

By admin November 8, 2017Articles, Articles and White Papers

Editor's note: Melissa Derr is Director of Digital Forensics and Response at Critical Defence, LLC. We're delighted to share her expertise in cyber security with our audience.

Even though small to mid-size businesses (SMBs) are a primary target for cyber attackers, they remain underprepared to prevent, detect, respond to, and recover from an event. A 2017 report from the Ponemon Institute reported that 54% of SMBs had reported they suffered a data breach in the past 12 months, costing on average just over $1MM in direct expenses, plus additional indirect costs of over $1.2MM.

The numbers are staggering, but the realities remain: most SMBs lack proper budgets to implement the effective security controls that larger companies can afford, nor do they have the staff capable of protecting their technology. So, what can you do about it? Here are a few relatively simple solutions to get you started in the right direction.

1. Identify key risks

Before you can even begin to protect your SMB from cyberattacks, you need to first identify potential vulnerabilities, threats, and risks to your company. Vulnerabilities that most SMBs will find applicable to them are unpatched software, poor employee digital hygiene and unmanaged/unidentified devices on the company network. Cyber threats to most SMBs include the loss of proprietary data/intellectual property, loss of customer data, and loss of control over corporate technology assets.

Once vulnerabilities and threats have been identified, you can more fully understand the organization’s cyber risk. You should plan to patch software as soon as updates are available, encrypt sensitive data at rest, train your employees to detect potential social engineering tactics and phishing emails, and establish a policy prohibiting unmanaged devices on your company infrastructure. Once the policies are in place, make sure you are doing your best to regularly enforce them.

2. Educate Employees

Educating your employees about your key risks and cybersecurity policies is essential. According to independent researcher Ponemon Institute, the number one cause of a breach at SMBs was a negligent employee. Whether it be by clicking a link in an email, web-browsing at insecure websites, downloading software from unofficial sources, or accidentally sending an internal email to an unintended external party, your employees have more impact on the security of your organization than you might realize.

Employees should be aware of the policies you have regarding good digital hygiene, including prohibiting password reuse, safe web-browsing practices, and password length requirements.

While formal cyber security awareness training is ideal, it could be cost prohibitive for smaller businesses. The US Department of Homeland Security’s “Stop. Think. Connect.” campaign, however, is a free resource with sample fliers and internal communications to help you get started.

3. Deploy an endpoint monitoring solution

Detection and remediation is essential to your SMB’s security posture. Monitoring and updating all your endpoints is not at difficult as it used to be; a number of reasonably-priced, cloud-based solutions are available. Earlier this year, PCMag reviewed 10 of the industry leading endpoint protection platforms for small businesses, starting as low as $1 per endpoint per month. These tools can provide anti-virus coverage, quarantine or remove malicious files, email filtering, URL protection, and patch management all in a web-based management console. If you only have room in your budget for one security tool, an endpoint protection solution is your best bargain.

4. Have a back-up plan

No one ever wants to plan for the worst, but as half of all SMBs reported they had suffered a breach, chances are you’ll need a recovery plan. A recovery plan is needed to outline how you will continue business operations in the event of a cyberattack. How will you process payments if your payment system is compromised? What happens to your intellectual property if all your systems are infected with ransomware?

One easy solution is to take regular backups of business-critical systems and data, and store them OFFLINE, so you can recover with relative ease in the event of an incident. You may want to consider building in redundancy in the event of failures. And most importantly, regularly test the solution to confirm it will work in the event you need it.

Cyber attackers have set their sights on small and medium sized businesses. But small businesses often lack the proper budgets, staff and expertise to secure themselves properly. By implementing a few basic solutions small businesses can greatly enhance their security posture. While this is not a comprehensive list of everything you can do to secure your SMB, we hope this provides you with a good place to start. Attackers will continue to target SMBs, and it’s in the best interest of both the consumer and the SMB to be protected. Additional resources are available through the Nations Cyber Security Alliance.