1

My friend uses Microsoft Phone 8.1 mobile for a tax accountancy firm. As it hasn't received security updates for five years I believe that is a significant information security risk. However, the principal of the firm does not believe it to be a significant risk.

Only MMS, SMS and phone calls are made on the phone. MMS is sometimes used to send tax documents to the firm via pictures. No browsing of websites is done and it isn't even connected to the corporate network.

Can you help me explain to a CPA accountant principal in Australia why it's a business risk? Do you have links to Australian government websites or professional association websites?

Improve this question
10
  • Related: security.stackexchange.com/questions/57203/…
    – schroeder ♦
    Oct 29, 2020 at 12:58
  • Tasmania is important so as to put in relevant local knowledge.
    – Darryn Brisdaz
    Oct 29, 2020 at 13:06
  • 1
    Cyber Essentials is not regional. It's applied globally. Why do you need local knowledge? Have you googled it?
    – schroeder ♦
    Oct 29, 2020 at 13:07
  • 2
    It took me 2 minutes to google "australia cybersecurity guidance" : cyber.gov.au/acsc/view-all-content/guidance/…
    – schroeder ♦
    Oct 29, 2020 at 13:09
  • 1
    If you want guidance on the general risks of running an unsupported OS, I've provided that. If you want to perform and full-fledged, targeted risk assessment for this specific scenario, an anonymous Q&A site is not going to work. You need to talk with someone who can help you delve into the assessment and ask the right questions. But, if you have a non-expert pushing back against experts, then you have to address the underlying human issue, not the technical security issue.
    – schroeder ♦
    Oct 29, 2020 at 15:32

1 Answer 1

Reset to default
2

Unsupported operating systems can have vulnerabilities that have no patch. Over time, that threat grows. That means that it becomes trivial for an attacker to be able to breach the device. A breach of the device means that all data on it is exposed as well as all the accounts (business, email, personal, banking, etc.).

Yes, there is a chance that the OS does not have a serious flaw, but there is a small set of people in the world who can make that assessment, conclusively. And a CPA is likely not in that set.

Updating from unsupported software is listed as an "essential" item in the NCSC's Cyber Essentials certification. If you don't, you are rolling the dice.

Links:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .