Magazine menu Close Magazine menu

finance

Latest stories

digital taxation

As COVID-19 changes the tax landscape, business looks to tax automation

  • min read
    • The staid world of taxation had an earth-shattering moment on June 21, 2018. Siding with US state South Dakota, the Supreme Court said the defendant, online marketplace Wayfair, must collect sales taxes from its platform's global sellers. The Court saw compliance costs as a temporary problem new tax technology would soon solve. Today, governments worldwide increasingly use sophisticated technology to tax more widely. Tax automation's big players like Thomson Reuters (TR,) Vertex and my employer Avalara aim to help reduce compliance risk. I think autonomous, cloud-based, always-up-to-date tax automation platforms are tax's future. The Wayfair forward into tax digitalization The Wayfair decision snowballed into remote tax collection and remittance liability everywhere. The concept has been increasingly applied to other taxes too. International tax digitalization predated Wayfair. Most European OECD countries had already implemented Digital Services Tax (DST.) OECD itself came up with the framework to address digitalization's challenges. India's recent adoption of Goods and Services Tax (GST) came with digital invoices and shipping documents required. With COVID-19, digitalization went stratospheric. The normally risk-averse US federal bureaucracy saw remote work jump from 3 to 59 percent. E-commerce saw 10 years' worth of growth in the pandemic's first 3 months alone. Government pandemic response and tax The US government injected relief dollars into the economy but also saw tax take fall 3 percent in 2020. Governments worldwide have passed pandemic tax relief packages. This generosity must eventually end. Governments may increase indirect tax like sales tax, VAT or GST. It's an attractive policy because raising indirect taxes doesn't make people mad or change their spending. Unlike income taxes, governments can change indirect tax rates fast to increase cash flow. In many countries, they're the biggest source of government revenue. With just some of consumer purchases taxed (23 percent in the US,) there's scope for broadening the tax base. This could include removing exemptions and lowering thresholds, legalizing controlled substances like cannabis or increasing sin taxes. As the post-pandemic economy improves, experts think tax compliance enforcement will increase. Technology for the rise of many Big Brothers What about the challenges in this direct tax future? As remote workers spread to distant lands, companies face increasing risk of unintended Permanent Establishment, increasing their tax exposure in other countries. They'll also see increased compliance burden, from new registrations to returns. Software that supports businesses with global talent management is evolving to handle complex tax situations. Topia has modular solutions from remote workforce planning to compliance management with insights to track emerging tax risks. Equus has similar features in its AssignmentPro platform. Indirect taxes: The volatile elephant in the room Tax research company TTR may know best how often governments change indirect taxes. They track every change in tax rates, law and court rulings worldwide and, in 2020 alone, logged 35,000 changes in tax law. Brexit, India's e-invoicing and Saudi Arabia's tripling VAT typify this global tax volatility. Sanjay Parthasarathy, Chief Product Officer at Avalara, says, "Businesses now live in a world of infinite choices, infinite channels and instant gratification. People want answers. They don't care if it's complicated. If autonomous cars drive themselves, why not autonomous tax compliance?" Tax automation technology Tax automation firms have made it their business to tame the volatile tax elephant. First comes understanding taxation's complexity. "As professionals, we can make peace with not knowing something if we know how to find the answers," says Shon Holyfield of TTR. They offer comprehensive tax research in plain English. Indirect taxation puts speedbumps along the compliance journey. Some are more like spikes, like assigning the right Harmonized System (HS) number to each product. It's complex because different jurisdictions assign different numbers to the same item. Some tax automation solutions like Avalara offer AI-based automated classification informed by a database of billions of products. Understanding millions of exemptions, preparing tax returns and handling audits seamlessly across the world needs sophisticated automation. It also needs deep integrations with other enterprise software like Point of Sale (POS) and e-commerce marketplaces. Handling big numbers of simultaneous transactions may need a cloud-native platform to be reliable. Leading tax vendors meet these challenges with varying success and coverage. Some tax automation providers offer special tax solutions for communication services, lodging providers and the alcohol industry. There are also tax automation service, like Davo, for smaller retailers who don't need big integrations. The future of indirect tax "In Europe, governments think of the future," says Scott Peterson, Avalara's VP of Government Relations. Europe has made great strides in e-invoicing, live reporting and split payments. It means computing, filing and paying tax in real-time. Countries like India, Saudi Arabia and United Arab Emirates are following suit, but in the US, only Massachusetts is going that way. European governments are also simplifying taxation, like the UK's Making Tax Digital (MTD) initiative and the EU's Import One Stop Shop (IOSS). While it is simpler, IOSS shifts the tax collection and remittance burden from importers to remote sellers. Some are using sophisticated cross-border taxation software for this new responsibility. Companies like Inposia have stepped up to offer seamless e-invoicing in 60 countries, and there's a race to prepare taxation platforms to offer e-invoicing, live reporting and split payments. Parthasarathy says platforms must move from today's task-based or document-level autonomy to spanning whole workflows. Peterson explains the core issue with US taxation. "Politicians hate taxes. They want the tax agencies to be friendlier, not efficient or effective." "Government digitalization is for their benefit, not for businesses' filing efficiency," says Peterson. Senior Vice President of Compliance at Avalara, Liz Armbruester, sees global governments using more AI and analytics to detect fraud, and more audit. Are businesses ready for that? "Only about half of them," she says. "The rest are playing audit lottery." These businesses use manual processes, spreadsheets and native capabilities of their systems that often fail to keep up with tax law and regulation volatility. It means risk if audits do get more frequent. Armbruester continues. "Governments still think and design systems around a government-to-individual business relationship. A third-party processor can bring efficiency to both sides with batch processing." Until then, given the pace of change in global tax code, businesses must deal with risks at every step. Governments are lining up sophisticated technologies to plug tax loopholes rapidly. Adopting tax automation technologies can help businesses stay compliant.
cybersecurity predictions 2021

What does 2021 have in store for cybersecurity?

  • min read
    • Predicting the future is notoriously precarious. Who would have foreseen a year like 2020? Kaspersky's Global Research and Analysis Team reflect on this year in cybercrime and deduce what we should expect in 2021. Leaked patient records and COVID pressures in healthcare 2020 was the year everyone had a vested interest in new medical technologies' success. Cybercriminals attacked medical devices, hospitals and research institutions, intent on stealing COVID-19 vaccine insights. We also saw the first known directly fatal cyberattack: A patient died because ransomware infection of medical equipment caused care delays. Other cybercrime groups surprised us by ruling out attacking medical institutions. The cybersecurity community set up CTI League: Experts helping medical organizations respond to cyberthreats. Kaspersky gave healthcare organizations free access to tailored cybersecurity. In 2021, expect more attacks on COVID-19 vaccine developers attempting to steal critical data that could help other nations get ahead. Private healthcare organizations will further come under attack, as many don't have the resources to protect valuable patient data. With the transition to cloud computing, we may see patient data leaks from cloud services. Criminals can use personal data in hacked medical records to dupe people into revealing more. More healthcare industry cybersecurity predictions for 2021 Cybercriminals have learned about industrial networks Attacks on industrial networks will become more targeted. By watching randomly infected machines, cybercrime groups have learned organizations' IT setup and know how to exploit it. They can then on-sell network access to more sophisticated cybercrime groups who will take control of finance systems to steal cash. As many industrial control systems (ICS) use old operating systems, the end of support for systems like Windows 7 creates an exploitable loophole. We could see another significant, multi-industry crime campaign like WannaCry. As utilities and government services go through digital transformation they're more vulnerable to attack. Cybercriminals can use a government service as an entry point into industrial systems to disrupt services like public transport. In 2020, COVID-19 restrictions on working on-site delayed IT-system upgrades. During an attack, it may be harder for IT admins to regain system control quickly. Basic malware could spread and become more serious. Upgrading endpoint security and training workers are vital. More industrial cybersecurity predictions for 2021 Online education revolution brought new threats Education changed abruptly in 2020. 1.5 billion students took classes from home. Educators had to learn new skills, like running a class on Zoom or using TikTok lessons. For those who can access the technology, these new services enhance education. But they come with new threats. Learning management systems (LMS) like Google Classroom are exploding. And with growth comes cybercrime. We saw a staggering 20,000 percent growth in threats to online learning platforms between 2019 and 2020. Privacy usually involves getting the user's consent, but a child can't easily manage their privacy settings. Video will keep growing as a learning tool. About 60 percent of teachers use YouTube in the classroom. There's increased risk of exposure to age-inappropriate content, and new threats like Zoombombing could expose learners to harmful content. Games like Minecraft are a great way to make learning more interactive but exposes students to risks like cyberbullying, trolls and malicious files. Teachers must moderate content in their learning management systems, but with the popularity of social platforms and games for pupil engagement, the challenge has leveled-up. More education cybersecurity predictions for 2021 Poverty driving more financial cybercrime in 2021 In 2021, financial companies became less secure thanks to due hastily deployed remote working solutions. Some bought retail laptops that didn't match the security standards of the organization. Limited employee training, default configurations and remote access all contributed to increased attacks. There's rising extortion using distributed denial of service (DDoS) and ransomware. Targeted ransomware is the new normal for financial organizations. Criminals increased ransoms, emboldened by successful attacks and media coverage. To cover their tracks, they'll now expect you to pay in cryptocurrencies. People are often the weakest link, like in the failed attempt to infiltrate Tesla. Stay at home orders didn't affect cybercriminals: Brazilian cybercrime groups went global in 2020, expanding to Europe and beyond, including attempts to hack ATMs. Bigger crime groups are evolving their business models to boost profits by hiring more people within their virtual walls rather than outsourcing. To crack down on cybercrime, the US Department of the Treasury's Office of Foreign Assets Control warned of sanctions for organizations facilitating ransom payment. Next, we predict sanctions against institutions and nations that don't combat cybercrime coming from their territory. More financial cybersecurity predictions for 2021 Crime gangs collaborating on advanced threats Advanced persistent threats (APTs) are the most dangerous kind of attacks, often seen in geopolitical clashes, intent on harming national interests. With the trend towards improved organization security and more people working from home, crime groups will exploit network technologies such as virtual private networks (VPNs,) using social engineering to get access. 5G is big news, with bogus stories of health risks and some nations limiting or banning Huawei products in their 5G infrastructure. Security researchers are examining Huawei and other 5G providers for implementation flaws. If found, they'll make the front pages. As more devices depend on 5G for connectivity, attackers will have more incentive to seek vulnerabilities to exploit. As ransomware becomes the weapon of choice for many criminals, we may see ransomware players' concentrate. In 2020 the Maze and Sodinokibi gangs pioneered an affiliate collaboration model. These bigger groups may combine to deliver APT-style attacks that overwhelm a target organization's system, to access specific data. We'll likely see attacks like these disrupt everyday lives. It could be an intentional attack on critical infrastructure like utilities or collateral damage from ransomware targeting big organizations we all rely on, like supermarkets, mail or public transport. More advanced threat predictions for 2021 Threats may be increasing, but fortunately, there's better education, technology and intelligence available today to help your organization stay secure and face the future.
cybersecurity purchasing strategy

Avoid costly firefighting: How to be smarter about cybersecurity procurement

  • min read
    • Impulse buying IT solutions feels like you've achieved something today, but have you just given yourself an integration headache for tomorrow? With a more planned approach, you can get more from your budget and protect your resources more effectively. Here are two questions to ask yourself: For most organizations, their approach is to try to understand the vendor landscape and then understand the breadth and complexity of their IT security problems. To an extent, this strategy can work. If you buy the best products you can find according to the budget you have, then you're working towards having the optimal security posture for your organization. But the vendor landscape today is so concentrated that you can spend all of your time just trying to understand all of the products you could use, then choosing between them. Keeping an eye on Sounil Yu's Cyber Defense Matrix helps you deal with this. As you read this, I expect your risk register is top of mind, right alongside the most recent data breach you've just heard about. So it can feel right to get on and do something rather than stop, think and consider alternative courses of action. By taking action, for example, buying a product, you think the problem's fixed, giving you one less thing to think about. The problem?  This 'strategy' doesn't work. But why? Firstly, it doesn't support an organizational policy. It's just what you did before, and so it's what you continue to do. Easy win. This approach prevails without proper reflection, and no one can question the decision because it's never clearly expressed in a way that permits it to be challenged. Secondly, your company ends up with a mix of disconnected solutions that are installed but not configured, and sometimes their monitoring capabilities and logs, which looked so impressive during the sales presentation, and only considered after a suspected breach. However, with some small changes, the buying approach can pay off, or at least reduce the effort you spend firefighting down to a manageable level, so you have breathing space to focus on new projects. Here are three ways you can get smarter about buying the right cybersecurity solutions for your business. 1. Have a buying strategy for attending events Firstly, use the conferences and exhibitions you attend intelligently. InfoSec conferences, especially those dominated by a vendor hall rather than by tracks of presentations, can be beneficial if used in the right direction. It can be tempting to use the occasion to catch up with contacts in the industry, put in an order for a new solution to justify the time and money it took to attend and then go home. But you can be smarter than that. Don't be afraid to play off vendors against each other. Shuttle between them comparing advantages, answers and prices, examining any criticisms raised by one vendor with the responses of another. Ask someone who has left a booth you've been at, or are considering visiting, what they thought of a solution and its vendor, and if there are any aspects they found particularly useful or troubling. It's a good way to think through your current position, with a side benefit to make the most of networking opportunities without the shallow performance of pushing your business card (or scanning your pass at more technologically advanced events.) 2. Try before you buy Secondly, consider either a bake-off or a trial period or a pilot project – whichever is your organization's preferred way of working. A bake-off is similar to the televised cooking competitions; each of the products under consideration is put in direct competition with the others to see which offers you the best solution for the least code. The options you select, of course, depend on the structure of your estate and many other factors about your organization, but in a rush to resolve an issue, you can instead spend a few weeks testing your implementation, and so saving yourself time in the long run. In particular, either a bake-off or a pilot project shows that the products are under serious consideration, and your vendors should be able to devote resources to making the test period a success and resolve any technical issues before a full rollout. I recommend sequential pilot projects over bake-offs, only progressing to the next pilot project if the previous one didn't give you the results you wanted. A pilot project is far less intensive than the effort required for a bake-off and dealing with multiple vendors simultaneously. Also, it's much easier to have set aims for a pilot project, making it an easy purchasing decision at the end of the trial period, while keeping everyone focussed during the exercise. 3. Take a lesson from the world of gaming Finally, consider "table-topping" or "wargaming" the introduction of the technical solution. This is like running a pilot project, but conceptually. By "wargame," I mean a business wargame. It's called a "tabletop" because that's where you run the game, and that's specifically where everyone concentrates their attention. You can either buy an appropriate game, hire a consultant to build one, or design one yourself. The process is more straightforward than you think. To put a simple wargame together, you need some kind of board to represent the situation you're discussing (for example, a network diagram), some pieces or markers to represent different resources (like some coins to represent the available budget) and a brief set of rules to determine how the game progresses. This prevents decisions being made according to the opinion of the most senior person present. Unfortunately, the word "game" has all kinds of unhelpful connotations, making the exercise not seem serious enough for the gravity of the decision you're making, but the game and its rules are there to help you think and to encourage everyone to contribute. Meetings are a poor format for decision-making, with the quality of the decision usually determined by how long the meeting was, who shouted the loudest and how close it was to lunch. By running a tabletop exercise playing through the implementation of a project, you can get everyone around the table to consider the impact of the new technology in their field. Does a more efficient endpoint threat management solution send too many alerts to the over-worked Security Operations Center? Does the new firewall implementation work with existing configuration maintenance software?  From there, scenario plan a typical day or week and judge the impact on your staff and those departments who you work with on taking on the new solution. Don't be afraid to modify the format of the game as it progresses, to use counters or markers on a board to represent the impact of network changes or the demands on staff. A simplistic representation of your proposed solution can quickly reveal unrealistic demands or requirements that never come out in discussions or a spreadsheet-based analysis. As a side benefit, getting people together to think through a procurement decision and its ramifications in this structured way can have serendipitous benefits, as different silos within your organization form stronger links, improving decision making in the future. Overall, buying the best solutions you come across can get you through the next quarter, especially if you combine it with the occasional heroic effort by your employees when inevitable problems occur. But that kind of strategy isn't sustainable, and it isn't the optimum use of your resources. Your attackers are becoming smarter, but your budgets aren't getting bigger, so you're going to have to out-think your opponents. By planning more strategically before buying, you can make the most of your IT security budget. The opinions in this article represent those of the author.
it security spend

Plan your business cybersecurity future with these two approaches to budgeting

  • min read
    • Worldwide spending on information security products and services has been on the rise for years. According to Gartner, it's grown from $114 billion in 2018 (an increase of 12.4 percent from 2017) to potentially more than $124 billion in 2019. What better time to join the trend? But perhaps more importantly, IT security leaders in enterprises also have high expectations: 72 percent say that their budget will increase in 2020. With more money invested in information security, one question remains: how are these investments shaped? The bottom line is this: there are two ways to decide your business's cybersecurity future: #1: Rely on your intuition and previous experience in similar situations or follow others' choices. That's a conventional approach. #2: Analyze your unique situation, break it down into small details, and try to calculate the probability of these details changing soon. This is a risk-based approach. Now let's take a look at these two approaches in detail, what they mean for operations, and one might be best for your business. Cybersecurity budget approach one: conventional The most common approach to security budgeting is often based on today's immediate needs or previous experience, especially for growing companies who need the minimum and necessary cybersecurity measures and tools to focus on growth. For these types of organizations, budget planning is based on inheritance, where the current budget level maintains for several cycles with minimum changes. There's no practice of setting strategic IT security goals or assessing specific risks, and money is spent on emerging needs with ad hoc support. It's a happy-go-lucky approach. This approach will work unless you make any sudden business changes. For example, you might decide to bolster the digital side of your business or bring in a cloud-based service for CRM or accounting. These actions require you – in an ideal world – to rapidly increase your IT security budget and skilled personnel to protect from the threats the tech brings. Previously scheduled tasks and deployments get delayed and piled up for later. Unfortunately, this means more ad hoc spending, which may pile up. Why? Security spending may increase dramatically as whenever something unexpected happens; you'll need to solve it as quickly as possible, no matter the cost. At the same time, larger organizations with a more mature approach to risk management may end up with a smaller proportion of money spent on information security. So, that's number one. Cybersecurity approach two: risk-based It's not surprising that in 2019, risk management expertise is cited as among the top three skills for information security chiefs. Across the globe, mature enterprises operate with risk assessment at their core – IT and cybersecurity are no different. This isn't about trying to fix as many gaps as possible; it's about strategy. Firstly, look at critical business risks from cyberattacks – whether that's decreased service availability for customers, damaged reputation, lost business opportunities, or other direct financial losses. Then, you make risk calculations: multiplying the probability of an incident by the cost and deciding whether there's a need to implement IT security measures. For businesses with this mind-set, cybersecurity isn't a habit or a "necessary evil" investment instigated by scary headlines; it's an appropriate action based on calculations. Every business is unique, which means they'll likely face specific types of cybersecurity risks. For a digital-led eCommerce firm, there's a good chance that a distributed denial of service (DDoS) attack – malicious attempts to disrupt servers by flooding them with internet traffic – could cause massive damage, both monetary and reputational. Whereas financial and government organizations would face penalties and fines if their systems were breached in an advanced cyberattack, so their budgets should focus here. Additionally, software developers and service providers can even be a target themselves, or a step in a supply chain attack against their customers. In other words, there are almost as many threat models as there are types of business, each with a specific and ever-changing set of risks. As risks always imply a certain level of probability, IT security expertise is becoming a crucial part of the risk assessment process. Here, cybersecurity experts – including external ones – can help evaluate possibilities and use their experience to make a positive impact. Finally, when a decision about purchasing a cybersecurity solution or service is made based on this approach, there's a transparent process of approval with higher management. This means avoiding situations where one IT employee forces a decision to prevent the most cost-effective and efficient solution but chooses another simply because, for example, they used to work with that platform in the past. Of course, the risk assessment process differs from one company to another, and it's continuously improving. Nonetheless, three key components – experts, risk evaluation and a transparent decision-making chain – remain essential to help make budget planning more effective. It's ultimately ensuring that the company's investments in IT security are in line with business needs. What lessons can your business learn? Planning a security budget is similar to car maintenance. As a car owner, you could roughly estimate the average sum for regular expenses, tires, tech inspection and other things. However, as a racing enthusiast, you know you literally need to 'kick the tires' in advance: prepare for the season and make sure you'll have enough budget for all car components (tires, brakes, etc.) that get worn out much faster on the track. This second approach is more mature and ultimately saves money. But it also demands expertise, time and dedication. All in all, here are a few considerations when approaching your IT security budget: Knowledge is power When assessing risks, look at the threats most relevant to your industry and company size, then plan your budget accordingly. Access to the most up-to-date and tailored threat intelligence reports is crucial. Embrace expertise Whether you're calling on internal talent, external providers or both, they can help evaluate risk and the potential value of cybersecurity solutions and services. Most vendors offer a variety of training to help organizations improve their level of internal expertise. Bring in the experts (if you need to) Outsourcing is useful for organizations that don't yet have enough internal expertise or risk assessment processes. Have a guaranteed service level agreement (SLA) and move expenses from capital expenditure (CapEx) to operating expenditure (OpEx) to keep security spending under control. Try out different tools While an industry benchmark alone isn't enough information to make a budget decision, tools like the Kaspersky IT Security Calculator can provide threat information, measures and numbers that are worth exploring for organizations of a particular industry, size and region. When dealing with something as serious as corporate IT security (or racing at high speed), it's best to take time to prepare in advance, consult with experts and plan what to expect. Slow and steady wins the race, as they say. This article was published in December, 2019.
rocket economics report

The real cost of data breaches in 2019 (and how to avoid them)

  • min read
    • With 4,000 data breaches reported in the first half of 2019 alone, it's clear that cyberattacks are on the rise. And with the average cost reaching $US 1.41m for enterprise-level companies and $108k for small and medium-sized companies (SMBs), hackers are causing critical damage to businesses all over the globe. So how can you protect yourself, and your business, against cyberattacks? Kaspersky's IT Security Economics in 2019 report has the answers Common cybersecurity threats, how much they'll cost you, and what you can do to defend against them. Kaspersky's IT Security Economics in 2019 report gives you the state of play from the frontline, with nearly 5,000 interviews with IT professionals from 23 countries. Here's the topline findings: https://www.youtube.com/watch?v=nkQoGY1aGIs&feature=youtu.be 66 percent of all businesses surveyed are investing in specialist IT staff Of the 4,900 people surveyed, over half noted that the burgeoning amount of high-profile data breaches has kick-started big IT investments. No surprise then to know that, according to Gartner, worldwide IT spending is set to total $3.7 trillion in 2019. So, according to the professionals, where should your business be spending your security budget? (That's assuming you have one.) Among other things, one of the biggest trends is the growing popularity of Security Operations Centers (SOCs). And it's paying off. Enterprise-level businesses who've built SOCs – responsible for monitoring security events and incident response – estimate financial damage from a cyberattack at $675k, which is less than half the average impact cost for other enterprises ($1.41m). Data breaches are costing more now than ever before It's no secret: hackers don't have a maximum limit. How your business is protected, or more importantly what it's protecting, dictates how much you can lose. But one thing's crystal clear: the cost of a data breach is on the rise. So, what price could your business pay? And more importantly, if you don't get hacked, what would that extra cash buy you? Businesses need to take cybersecurity seriously Data breaches can happen to any business. But, with insight, intelligence and the right technical solutions, you could dramatically reduce the chances of it happening to you.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries