Security issues and the boss:
This can easily be executed through ACT Premium, which sits in the cloud. However, my boss in convinced it is a decent likelihood that the company (Sage who is the ACT publisher) will mine his contacts and sell them. I find this crosses the line to counterproductive paranoia.
While I understand how frightening and confusing it all must be for someone who doesn’t understand cybersecurity, I see it as my job to help him make good business decisions that balance risk vs. reward.
Yes, freeware companies like Facebook sell your social media data to monetize their free service. Yes, Home Depot uses old version of Windows NT on their mission critical POS systems and don’t want to take down their systems to apply necessary patches. ( Must be very difficult when you are running a a 24/7 retail store.) Even companies like Evernote got hacked.
However, that is a far cry from Sage mining and stealing it’s own customer’s data. The irony is, the current security in the office is pretty weak. We are using a standard Verizon modem/router/firewall and Windows 10 computers with the basic firewall and security software and settings. Moreover, he logs into his ACT database internally, and doesn’t have a password on his account.
How do I frame a conversation to help him use standard technology with minimal risk, while locking down things for the most likely intrusions.
There is no perfect security. You make security decisions using the same risk/cost benefit calculation as you do in the physical world. Most people don’t have 10 locks on their front door, and leave their back door open. Most people don’t spend $3,000 on a security system for a $2,000 car. Most people are willing to drive a car, when it is probably the most dangerous thing we can do…statistically speaking.
So the goal for me is to figure out how to educate him and help him make good business decisions, while incorporating reasonable best practices for security. Any suggestions, links to information, etc., would be appreciated.