Master QuickBooks Online 2024 Security: IT-Approved Tips

Last Updated on April 14, 2024

QuickBooks Online has revolutionized small business accounting. Due to its convenience and flexibility, it has become a popular choice, which also makes it a prime target for cybercriminals. Data breaches can have devastating consequences, from financial losses to damaged reputations. That's why, in 2024, a robust QuickBooks Online security strategy is more important than ever for small business owners and IT professionals alike.

Strengthening the Foundation: Password Management

Passwords are your first line of defense in the world of online security. Unfortunately, many of us still rely on passwords that are predictable and easy to crack. In 2024, safeguarding your QuickBooks Online account means going beyond the basics regarding password best practices.

• Length is Might: Longer passwords are significantly harder to crack. Require your employees to create passwords with a minimum of 12-14 characters. A good rule of thumb is that the more sensitive the information, the longer the password should be.
• Mix it Up: Passwords should combine uppercase letters, lowercase letters, numbers, and symbols. This complexity makes it harder for automated cracking tools to decipher. Avoid using personal information (birthdays, addresses) that could be easily guessed.
• Forget Familiar Phrases: Avoid commonly used phrases, song lyrics, or quotes in your passwords. Hackers often use sophisticated software that can analyze common words and patterns to crack passwords. Instead, consider using passphrases – a series of four or more random words – as they are easier to remember and offer high security.
• One Password, One Account: This is crucial! Reusing passwords across different online accounts is a major security risk. If a hacker gains access to one account, they could access others with the same password.
• The Power of Password Managers: Remembering complex, unique passwords for each account can be overwhelming. Password management software, in 2024, offers advanced features like secure storage, random password generation, and even alerts for compromised passwords. Reputable options include LastPass, 1Password, and Dashlane.
• Password Change Intervals: All QuickBooks Online users must be prompted to change their passwords regularly. Security experts recommend changing them every 60-90 days to minimize the risk of compromised accounts.

Important Note: Research in 2024 has emphasized the importance of moving towards zero-knowledge password managers. These services don't store your master password on their servers, adding an extra layer of security.

Sources:

• NIST Password Guidelines 2024: https://pages.nist.gov/800-63-3/sp800-63b.html
• Cybersecurity and Infrastructure Security Agency (CISA): https://www.cisa.gov/

Access Control: Limiting Exposure

Think of QuickBooks Online as a bank vault with different compartments. You wouldn't give everyone in your company the keys to the entire vault, right? The same concept applies to your QuickBooks data. The principle of least privilege means giving employees access only to the specific information and tools they need to do their jobs.

• Reduced Attack Surface: When fewer people access sensitive data, the potential for damage during a cyberattack or data breach is significantly reduced.
• Minimize Accidental Errors: Limiting user permissions can help prevent unintended data changes, protecting the integrity of your financial records.
• Compliance and Accountability: Adhering to the least privilege approach often aligns with industry regulations, making auditing easier.

How to Manage User Permissions in QuickBooks Online

QuickBooks Online allows for fine-grained control over user permissions. Here's how to create custom user roles:

1. Understand Built-in Roles: QuickBooks Online offers several pre-defined roles (Standard User, Reports Only, etc.). Start by reviewing these as a baseline.
2. Custom Roles: If the built-in roles don't exactly fit your needs, create custom roles with specific permissions tailored to each employee's responsibilities.
3. Regular Permission Audits: As your business evolves and employees' roles change, ensure their QuickBooks Online permissions remain appropriate. Schedule regular reviews to identify and adjust access levels as needed.

Important Note: In 2024, consider utilizing the activity monitoring and auditing tools offered by QuickBooks Online. The Audit Log tracks logins and critical actions, making it easier to spot suspicious activity or unauthorized changes.

Sources:

• QuickBooks Online Help: User roles and permissions [invalid URL removed]
• National Institute of Standards and Technology (NIST) guide on Access Control: https://csrc.nist.gov/publications/detail/sp/800-162/final

Multi-Factor Authentication: The Essential Extra Layer

Passwords alone are no longer sufficient to protect your sensitive QuickBooks Online data. Multi-factor authentication (MFA) is a powerful second line of defense by requiring you to present more than just your password to log in.

How MFA Works

• Something You Know: This is your password or PIN.
• Something You Have: This could be a smartphone with an authenticator app, a physical security key, or a code sent via SMS text message.
• Something You Are: This involves biometric authentication methods like fingerprint scans or facial recognition.

Implementing MFA in QuickBooks Online

Enabling MFA within your QuickBooks Online account is straightforward:

1. Account Settings: Access your QuickBooks Online account's “Security” settings.
2. Two-Step Verification: Look for the option labeled “Two-Step Verification” (this might be the term used instead of MFA).
3. Choose Your Method: Select your preferred method for receiving the additional verification code. Options typically include an authenticator app or SMS verification.
4. Follow the Setup: Detailed instructions will link your device or phone number to your QuickBooks account.

Step	Action	Details
1	Sign in to Intuit Account
2	Navigate to settings	Select “Sign in & security.”
3	Enable 2-step verification	Go to the “2-step verification” section, select “Turn on,” then “Set up.”
4	Verify phone number	Make sure your phone number is correct
5	Choose verification method	Text message: Receive a six-digit code – Voice message: Receive a code via voice
6	Enter verification code	Input the code received by text or voice message
7	Confirm with the account password	Enter your account password and continue
8	Set up an authenticator app (optional)	– Download an authenticator app<br>- Sign in to your Intuit Account<br>- Follow on-screen steps
9	Disable authenticator (if needed)	Turn off two-step verification to disable the authenticator

 

MFA Best Practices in 2024

• Prioritize App-Based MFA: Opt for authenticator apps like Google Authenticator or Authy whenever possible. These offer greater security than SMS-based verification, which sophisticated hackers can potentially intercept.
• Embrace Hardware Keys: Physical security keys (like Yubikey) provide the highest level of protection in 2024. They directly communicate with the system and are very difficult to compromise remotely.
• Backup Methods: Setting up a backup MFA method (like SMS) is crucial if you lose access to your primary device.

Important Note: In 2024, a zero-trust approach to security has gained momentum. This strongly emphasizes MFA, treating every login attempt as potentially suspicious until verified.

Sources:

• Intuit QuickBooks Help: Set up and use two-step verification.
• Yubico Website: Security Keys by Yubico https://www.yubico.com/
• National Institute of Standards and Technology (NIST) on Zero Trust Architecture:

Staying Ahead of Threats: Risk Identification and Mitigation

Phishing attacks have become incredibly sophisticated, designed to deceive even cautious users. In 2024, safeguarding yourself and your employees from these attacks is more important than ever.

Evolving Phishing Tactics

• Urgent and Authoritative: Phishing emails often mimic official communications (from banks, software companies, or government agencies), creating a sense of urgency and demanding immediate action.
• Spear Phishing: Highly targeted attacks use personal information (found on social media or via data breaches) to appear even more legitimate.
• Brand Impersonation: Emails or websites may look nearly identical to those of familiar companies like QuickBooks or your bank, aiming to trick you into providing sensitive information.

How to Spot a Phishing Attempt

1. Scrutinize the Sender: Is the email address slightly misspelled or from an unusual domain? Legitimate companies will use their official email addresses.
2. Beware of Urgent Language and Threats: Cybercriminals use fear tactics to rush your decision. Be wary of urgent requests or claims of account suspension.
3. Hover Over Links: Hover your mouse before clicking to reveal the destination. Does it match the legitimate website?
4. Watch for Errors: Phishing emails often have typos or grammatical mistakes.
5. When in Doubt, Don't Click: If something feels off, don't engage. Contact the company or sender directly through their official website or phone number.

Zero-Trust Mindset

Even if an email or request looks legitimate, adopting a zero-trust approach in 2024 is wise. Always independently verify any requests for sensitive information or financial data changes, even from seemingly familiar contacts.

The Importance of Vulnerability Scans and Patching

Keep your entire IT infrastructure secure, not just your QuickBooks Online account. Here's why:

• Vulnerability Scanning: Utilize automated tools to regularly scan for software or network vulnerabilities that cybercriminals could exploit.
• Patch Management: Always install security updates promptly for operating systems, browsers, and other software. These updates often contain critical fixes for known security issues.

Sources:

• Federal Trade Commission (FTC): Phishing Scams https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
• Cybersecurity and Infrastructure Security Agency (CISA): Phishing Resources

Going the Extra Mile: Additional Security Considerations

Securing the Network Perimeter

Your QuickBooks Online security is only as strong as the network it runs on. For businesses in 2024, consider:

• Enterprise-Grade Firewalls: These provide more advanced protection and network traffic control than basic consumer firewalls.
• Endpoint Protection: Install reliable antivirus and antimalware software on all devices (computers, laptops, tablets) that access QuickBooks Online. Look for solutions with real-time monitoring and behavior analysis features.

The Power of Cloud Backups

Data loss can be devastating due to hardware failure, ransomware attacks, or human error. Automated cloud backups for your QuickBooks Online data offer peace of mind and resilience:

• Redundancy: Cloud backups store your data in multiple locations, minimizing the risk of complete loss even if one location is affected.
• Versioning: Restore previous versions of your files, which is critical in case of accidental changes or ransomware infection.
• Compliance: Cloud backup solutions can aid in adhering to data retention regulations within your industry.

Investing in Cybersecurity Training

Your employees are your front line of defense. Ongoing security awareness training is vital:

• Regular Modules: Provide short and engaging training sessions on phishing identification, password security, and responsible data handling.
• Phishing Simulations: Conduct realistic simulations to test employee responses and identify areas for improvement.
• Resources: Share up-to-date information from trusted sources like government cybersecurity agencies and security vendors.

Sources:

• NIST Small Business Cybersecurity Corner: https://www.nist.gov/itl/smallbusinesscyber
• Leading backup providers (examples): Rewind, Acronis, Veeam, Synology

Conclusion: Proactive Security for Your Financial Future

In 2024, securing your QuickBooks Online account is important for safeguarding your small business's financial health. While cyber threats constantly evolve, proactive measures and vigilance will minimize risks.

Key Takeaways

• Robust Passwords are Essential: The length, complexity, and uniqueness of each account's passwords are crucial. Consider password managers and move towards zero-knowledge solutions.
• Limit Exposure with User Permissions: Apply the principle of least privilege – grant access only to the data and functions employees need.
• MFA is Non-Negotiable: This powerful extra layer significantly reduces the risk of unauthorized access. Prioritize app-based authentication or hardware keys.
• Stay Alert for Phishing: Scrutinize emails and website URLs, beware of urgent requests, and embrace a zero-trust mindset.
• Protect Your Network: Invest in enterprise-grade firewalls, endpoint protection, and regular vulnerability scans.
• Data Backups are a Lifeline: Automated cloud backups with versioning provide essential disaster recovery.
• Training Empowers Employees: Regular cybersecurity training and simulations make your employees a strong line of defense.

Remember: Cybersecurity is an investment, not an option. By staying informed, employing these strategies, and partnering with IT professionals, you proactively protect your QuickBooks Online data and your business's future.