Tuesday, April 29, 2014

Bookkeeping Tip #185 Segregation of Duties

Segregation of Duties: the "rule of two"


Meaning that any task involving the finances of your small  business should require  at a minimum two people to complete.  

Here’s a few examples

1. Bookkeeper records all receipts, Accountant reconciles all accounts to make sure what’s recorded in the books  matches what happened in reality (as shown on the bank statements)

2. The secretary photocopies checks from clients, gives the photocopies to the bookkeeper to record, then the secretary completes the bank   deposit with the actual check

3. The bookkeeper prints checks to pay vendors, and the owner signs and mails them



Friday, April 25, 2014

Tuesday, April 22, 2014

Ten Things to Know about IRS Notices and Letters

Issue Number:    IRS Tax Tip 2014-60


Ten Things to Know about IRS Notices and Letters
Each year, the IRS sends millions of notices and letters to taxpayers for a variety of reasons. Here are ten things to know in case one shows up in your mailbox.
1. Don’t panic. You often only need to respond to take care of a notice.
2. There are many reasons why the IRS may send a letter or notice. It typically is about a specific issue on your federal tax return or tax account. A notice may tell you about changes to your account or ask you for more information. It could also tell you that you must make a payment.
3. Each notice has specific instructions about what you need to do.
4. You may get a notice that states the IRS has made a change or correction to your tax return. If you do, review the information and compare it with your original return.
5. If you agree with the notice, you usually don’t need to reply unless it gives you other instructions or you need to make a payment.
6. If you do not agree with the notice, it’s important for you to respond. You should write a letter to explain why you disagree. Include any information and documents you want the IRS to consider. Mail your reply with the bottom tear-off portion of the notice. Send it to the address shown in the upper left-hand corner of the notice. Allow at least 30 days for a response.
7. You shouldn’t have to call or visit an IRS office for most notices. If you do have questions, call the phone number in the upper right-hand corner of the notice. Have a copy of your tax return and the notice with you when you call. This will help the IRS answer your questions.
8. Keep copies of any notices you receive with your other tax records.
9. The IRS sends letters and notices by mail. We do not contact people by email or social media to ask for personal or financial information.
10. For more on this topic visit IRS.gov. Click on the link ‘Responding to a Notice’ at the bottom left of the home page. Also, see Publication 594, The IRS Collection Process. You can get it on IRS.gov or by calling 800-TAX-FORM (800-829-3676).

Thursday, April 17, 2014

Find Out if You Qualify for a Health Insurance Coverage Exemption

Issue Number:    HCTT-2014-13


Find out if You Qualify for a Health Insurance Coverage Exemption
The Affordable Care Act calls for individuals to have qualifying health insurance coverage for each month of the year, have an exemption, or make a shared responsibility payment when filing his or her federal income tax return.
You may be exempt from the requirement to maintain qualifying health insurance coverage, called minimum essential coverage, and may not have to make a shared responsibility payment when you file your next federal income tax return. .
You may be exempt if you:
  • Have no affordable coverage options because the minimum amount you must pay for the annual premiums is more than eight percent of your household income,
  • Have a gap in coverage for less than three consecutive months, or
  • Qualify for an exemption for one of several other reasons, including having a hardship that prevents you from obtaining coverage or belonging to a group explicitly exempt from the requirement.
The IRS website, IRS.gov/aca, has a comprehensive list of the coverage exemptions.
How you get an exemption depends upon the type of exemption. You can obtain some exemptions only from the Marketplace in the area where you live, others only from the IRS, and yet others from either the Marketplace or the IRS.
Additional information about exemptions is available on the Individual Shared Responsibility Provision web page on IRS.gov. The page includes a link to a chart that shows the types of exemptions available and whether they must be granted by the Marketplace, claimed on an income tax return filed with the IRS, or by either the Marketplace or the IRS. For additional information about how to get exemptions that may be granted by the Marketplace, visit HealthCare.gov/exemptions.
More Information
Find out more about the tax-related provisions of the health care law at IRS.gov/aca.
Find out more about the health care law at HealthCare.gov.

Tuesday, April 15, 2014

5 Truths About Success

 
1. It's hard work
  
2. You'll need help

3. Mistakes are life's lessons
 
4. Be persistent and be consistent

5. Keep motivating yourself

Thursday, April 10, 2014

Heartbleed Bug

Heartbleed Bug
The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs). The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.

What leaks in practice?

We have tested some of our own services from attacker's perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.

How to stop the leak?

As long as the vulnerable version of OpenSSL is in use it can be abused. Fixed OpenSSL has been released and now it has to be deployed. Operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the operating systems, networked appliances and software they use.

Q&A

What is the CVE-2014-0160?

CVE-2014-0160 is the official reference to this bug. CVE (Common Vulnerabilities and Exposures) is the Standard for Information Security Vulnerability Names maintained by MITRE. Due to co-incident discovery a duplicate CVE, CVE-2014-0346, which was assigned to us, should not be used, since others independently went public with the CVE-2014-0160 identifier.

Why it is called the Heartbleed Bug?

Bug is in the OpenSSL's implementation of the TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520). When it is exploited it leads to the leak of memory contents from the server to the client and from the client to the server.

What makes the Heartbleed Bug unique?

Bugs in single software or library come and go and are fixed by new versions. However this bug has left large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitation and attacks leaving no trace this exposure should be taken seriously.

Is this a design flaw in SSL/TLS protocol specification?

No. This is implementation problem, i.e. programming mistake in popular OpenSSL library that provides cryptographic services such as SSL/TLS to the applications and services.

What is being leaked?

Encryption is used to protect secrets that may harm your privacy or security if they leak. In order to coordinate recovery from this bug we have classified the compromised secrets to four categories: 1) primary key material, 2) secondary key material and 3) protected content and 4) collateral.

What is leaked primary key material and how to recover?

These are the crown jewels, the encryption keys themselves. Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will. Any protection given by the encryption and the signatures in the X.509 certificates can be bypassed. Recovery from this leak requires patching the vulnerability, revocation of the compromised keys and reissuing and redistributing new keys. Even doing all this will still leave any traffic intercepted by the attacker in the past still vulnerable to decryption. All this has to be done by the owners of the services.

What is leaked secondary key material and how to recover?

These are for example the user credentials (user names and passwords) used in the vulnerable services. Recovery from this leaks requires owners of the service first to restore trust to the service according to steps described above. After this users can start changing their passwords and possible encryption keys according to the instructions from the owners of the services that have been compromised. All session keys and session cookies should be invalided and considered compromised.

What is leaked protected content and how to recover?

This is the actual content handled by the vulnerable services. It may be personal or financial details, private communication such as emails or instant messages, documents or anything seen worth protecting by encryption. Only owners of the services will be able to estimate the likelihood what has been leaked and they should notify their users accordingly. Most important thing is to restore trust to the primary and secondary key material as described above. Only this enables safe use of the compromised services in the future.

What is leaked collateral and how to recover?

Leaked collateral are other details that have been exposed to the attacker in the leaked memory content. These may contain technical details such as memory addresses and security measures such as canaries used to protect against overflow attacks. These have only contemporary value and will lose their value to the attacker when OpenSSL has been upgraded to a fixed version.

Recovery sounds laborious, is there a short cut?

After seeing what we saw by "attacking" ourselves, with ease, we decided to take this very seriously. We have gone laboriously through patching our own critical services and are in progress of dealing with possible compromise of our primary and secondary key material. All this just in case we were not first ones to discover this and this could have been exploited in the wild already.

How revocation and reissuing of certificates works in practice?

If you are a service provider you have signed your certificates with a Certificate Authority (CA). You need to check your CA how compromised keys can be revoked and new certificate reissued for the new keys. Some CAs do this for free, some may take a fee.

Am I affected by the bug?

You are likely to be affected either directly or indirectly. OpenSSL is the most popular open source cryptographic library and TLS (transport layer security) implementation used to encrypt traffic on the Internet. Your popular social site, your company's site, commerce site, hobby site, site you install software from or even sites run by your government might be using vulnerable OpenSSL. Many of online services use TLS to both to identify themselves to you and to protect your privacy and transactions. You might have networked appliances with logins secured by this buggy implementation of the TLS. Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.

How widespread is this?

Most notable software using OpenSSL are the open source web servers like Apache and nginx. The combined market share of just those two out of the active sites on the Internet was over 66% according to Netcraft's April 2014 Web Server Survey. Furthermore OpenSSL is used to protect for example email servers (SMTP, POP and IMAP protocols), chat servers (XMPP protocol), virtual private networks (SSL VPNs), network appliances and wide variety of client side software. Fortunately many large consumer sites are saved by their conservative choice of SSL/TLS termination equipment and software. Ironically smaller and more progressive services or those who have upgraded to latest and best encryption will be affected most. Furthermore OpenSSL is very popular in client software and somewhat popular in networked appliances which have most inertia in getting updates.

What versions of the OpenSSL are affected?

Status of different versions:
  • OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
  • OpenSSL 1.0.1g is NOT vulnerable
  • OpenSSL 1.0.0 branch is NOT vulnerable
  • OpenSSL 0.9.8 branch is NOT vulnerable
Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.

How common are the vulnerable OpenSSL versions?

The vulnerable versions have been out there for over two years now and they have been rapidly adopted by modern operating systems. A major contributing factor has been that TLS versions 1.1 and 1.2 came available with the first vulnerable OpenSSL version (1.0.1) and security community has been pushing the TLS 1.2 due to earlier attacks against TLS (such as the BEAST).

How about operating systems?

Some operating system distributions that have shipped with potentially vulnerable OpenSSL version:
  • Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4
  • Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
  • CentOS 6.5, OpenSSL 1.0.1e-15
  • Fedora 18, OpenSSL 1.0.1e-4
  • OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
  • FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013
  • NetBSD 5.0.2 (OpenSSL 1.0.1e)
  • OpenSUSE 12.2 (OpenSSL 1.0.1c)
Operating system distribution with versions that are not vulnerable:
  • Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14
  • SUSE Linux Enterprise Server
  • FreeBSD 8.4 - OpenSSL 0.9.8y 5 Feb 2013
  • FreeBSD 9.2 - OpenSSL 0.9.8y 5 Feb 2013
  • FreeBSD Ports - OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)

How can OpenSSL be fixed?

Even though the actual code fix may appear trivial, OpenSSL team is the expert in fixing it properly so latest fixed version 1.0.1g or newer should be used. If this is not possible software developers can recompile OpenSSL with the handshake removed from the code by compile time option -DOPENSSL_NO_HEARTBEATS.

Should heartbeat be removed to aid in detection of vulnerable services?

Recovery from this bug could benefit if the new version of the OpenSSL would both fix the bug and disable heartbeat temporarily until some future version. It appears that majority if not almost all TLS implementations that respond to the heartbeat request today are vulnerable versions of OpenSSL. If only vulnerable versions of OpenSSL would continue to respond to the heartbeat for next few months then large scale coordinated response to reach owners of vulnerable services would become more feasible.

Can I detect if someone has exploited this against me?

Exploitation of this bug leaves no traces of anything abnormal happening to the logs.

Can IDS/IPS detect or block this attack?

Although the content of the heartbeat request is encrypted it has its own record type in the protocol. This should allow intrusion detection and prevention systems (IDS/IPS) to be trained to detect use of the heartbeat request. Due to encryption differentiating between legitimate use and attack can not be based on the content of the request, but the attack may be detected by comparing the size of the request against the size of the reply. This seems to imply that IDS/IPS can be programmed to detect the attack but not to block it unless heartbeat requests are blocked altogether.

Has this been abused in the wild?

We don't know. Security community should deploy TLS/DTLS honeypots that entrap attackers and to alert about exploitation attempts.

Can attacker access only 64k of the memory?

There is no total of 64 kilobytes limitation to the attack, that limit applies only to a single heartbeat. Attacker can either keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed.

Is this a MITM bug like Apple's goto fail bug was?

No this doesn't require a man in the middle attack (MITM). Attacker can directly contact the vulnerable service or attack any user connecting to a malicious service. However in addition to direct threat the theft of the key material allows man in the middle attackers to impersonate compromised services.

Does TLS client certificate authentication mitigate this?

No, heartbeat request can be sent and is replied to during the handshake phase of the protocol. This occurs prior to client certificate authentication.

Does OpenSSL's FIPS mode mitigate this?

No, OpenSSL Federal Information Processing Standard (FIPS) mode has no effect on the vulnerable heartbeat functionality.

Does Perfect Forward Secrecy (PFS) mitigate this?

Use of Perfect Forward Secrecy (PFS), which is unfortunately rare but powerful, should protect past communications from retrospective decryption. Please seehttps://twitter.com/ivanristic/status/453280081897467905 how leaked tickets may affect this.

Can heartbeat extension be disabled during the TLS handshake?

No, vulnerable heartbeat extension code is activated regardless of the results of the handshake phase negotiations. Only way to protect yourself is to upgrade to fixed version of OpenSSL or to recompile OpenSSL with the handshake removed from the code.

Who found the Heartbleed Bug?

This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) atCodenomicon and Neel Mehta of Google Security, who first reported it to the OpenSSL team. Codenomicon team found heartbleed bug while improving the SafeGuard feature in Codenomicon's Defensics security testing tools and reported this bug to the NCSC-FI for vulnerability coordination and reporting to OpenSSL team.

What is the Defensics SafeGuard?

The SafeGuard feature of the Codenomicon's Defensics security testtools automatically tests the target system for weaknesses that compromise the integrity, privacy or safety. The SafeGuard is systematic solution to expose failed cryptographic certificate checks, privacy leaks or authentication bypass weaknesses that have exposed the Internet users to man in the middle attacks and eavesdropping. In addition to the Heartbleed bug the new Defensics TLS Safeguard feature can detect for instance the exploitable security flaw in widely used GnuTLS open source software implementing SSL/TLS functionality and the "goto fail;" bug in Apple's TLS/SSL implementation that was patched in February 2014.

Who coordinates response to this vulnerability?

NCSC-FI took up the task of reaching out to the authors of OpenSSL, software, operating system and appliance vendors, which were potentially affected. However, this vulnerability was found and details released independently by others before this work was completed. Vendors should be notifying their users and service providers. Internet service providers should be notifying their end users where and when potential action is required.

Is there a bright side to all this?

For those service providers who are affected this is a good opportunity to upgrade security strength of the secret keys used. A lot of software gets updates which otherwise would have not been urgent. Although this is painful for the security community, we can rest assured that infrastructure of the cyber criminals and their secrets have been exposed as well.

Where to find more information?

This Q&A was published as a follow-up to the OpenSSL advisory, since this vulnerability became public on 7th of April 2014. The OpenSSL project has made a statement athttps://www.openssl.org/news/secadv_20140407.txt. NCSC-FI published an advisory athttps://www.cert.fi/en/reports/2014/vulnerability788210.html. Individual vendors of operating system distributions, affected owners of Internet services, software packages and appliance vendors may issue their own advisories.

References

Parenting and Accounting

Parenting without a sense of humor
528763_557470147619153_6262338_n

is like being an accountant who sucks at math.

Tuesday, April 8, 2014

Top Tips on Making IRA Contributions

IRS Tax Tip 2014-50

f4da9-piggybudgetIf you made IRA contributions or you’re thinking of making them, you may have questions about IRAs and your taxes. Here are some important tips from the IRS about saving for retirement using an IRA.
1. You must be under age 70 1/2 at the end of the tax year in order to contribute to a traditional IRA. There is no age limit to contribute to a Roth IRA.
2. You must have taxable compensation to contribute to an IRA. This includes income from wages and salaries and net self-employment income. It also includes tips, commissions, bonuses and alimony. If you’re married and file a joint return, generally only one spouse needs to have compensation.
3. You can contribute to an IRA at any time during the year. To count for 2013, you must make all contributions by the due date of your tax return. This does not include extensions. That means you usually must contribute by April 15, 2014. If you contribute between Jan. 1 and April 15, make sure your plan sponsor applies it to the right year.
4. In general, the most you can contribute to your IRA for 2013 is the smaller of either your taxable compensation for the year or $5,500. If you were age 50 or older at the end of 2013, the maximum you can contribute increases to $6,500.
5. You normally won’t pay income tax on funds in your traditional IRA until you start taking distributions from it. Qualified distributions from a Roth IRA are tax-free.
6. You may be able to deduct some or all of your contributions to your traditional IRA. Use the worksheets in the Form 1040A or Form 1040instructions to figure the amount that you can deduct. You may claim the deduction on either form. Unlike a traditional IRA, you can’t deduct contributions to a Roth IRA.
7. If you contribute to an IRA you may also qualify for the Saver’s Credit. The credit can reduce your taxes up to $2,000 if you file a joint return. Use Form 8880, Credit for Qualified Retirement Savings Contributions, to claim the credit. You can file Form 1040A or 1040 to claim the Saver’s Credit.
8. See Publication 590, Individual Retirement Arrangements, for more about IRAs.
Always consult your tax professional for your individual situation.

Friday, April 4, 2014

Energy-Efficient Home Improvements Can Lower Your Taxes

Issue Number:    IRS Tax Tip 2014-47




Energy-Efficient Home Improvements Can Lower Your Taxes
You may be able to reduce your taxes if you made certain energy-efficient home improvements last year. Here are some key facts that you should know about home energy tax credits.
Non-Business Energy Property Credit 
  • This credit is worth 10 percent of the cost of certain qualified energy-saving items you added to your main home last year. This includes items such as insulation, windows, doors and roofs.
  • You may also be able to claim the credit for the actual cost of certain property. This may include items such as water heaters and heating and air conditioning systems. Each type of property has a different dollar limit.
  • This credit has a maximum lifetime limit of $500. You may only use $200 of this limit for windows.
  • Your main home must be located in the U.S. to qualify for the credit.
  • Be sure you have the written certification from the manufacturer that their product qualifies for this tax credit. They usually post it on their website or include it with the product’s packaging. You can rely on it to claim the credit, but do not attach it to your return. Keep it with your tax records.
  • This credit expired at the end of 2013. You may still claim the credit on your 2013 tax return if you didn’t reach the lifetime limit in prior years.
Residential Energy Efficient Property Credit
  • This tax credit is 30 percent of the cost of alternative energy equipment installed on or in your home.
  • Qualified equipment includes solar hot water heaters, solar electric equipment and wind turbines.
  • There is no dollar limit on the credit for most types of property. If your credit is more than the tax you owe, you can carry forward the unused portion of this credit to next year’s tax return.
  • The home must be in the U.S. It does not have to be your main home.
  • This credit is available through 2016.
Use Form 5695, Residential Energy Credits, to claim these credits. For more on this topic refer to the form’s instructions. You can get it on IRS.gov or order it by mail by calling 800-TAX-FORM (800-829-3676).

Always consult your tax professional regarding your individual situation.

Wednesday, April 2, 2014

IRS Warns of New Email Phishing Scheme Falsely Claiming to be from the Taxpayer Advocate Service

Issue Number:    IR-2014-39



IRS Warns of New Email Phishing Scheme Falsely Claiming to be from the Taxpayer Advocate Service

WASHINGTON —The Internal Revenue Service today warned consumers to be on the lookout for a new email phishing scam. The emails appear to be from the IRS Taxpayer Advocate Service and include a bogus case number.‬
The fake emails may include the following message: “Your reported 2013 income is flagged for review due to a document processing error. Your case has been forwarded to the Taxpayer Advocate Service for resolution assistance. To avoid delays processing your 2013 filing contact the Taxpayer Advocate Service for resolution assistance.”‬
Recipients are directed to click on links that supposedly provide information about the "advocate" assigned to their case or that let them "review reported income." The links lead to web pages that solicit personal information.‬
Taxpayers who get these messages should not respond to the email or click on the links. Instead, they should forward the scam emails to the IRS at phishing@irs.gov. For more information, visit the IRS's Report Phishing web page.
The Taxpayer Advocate Service is a legitimate IRS organization that helps taxpayers resolve federal tax issues that have not been resolved through the normal IRS channels. The IRS, including TAS, does not initiate contact with taxpayers by email, texting or any social media.‬
For more on scams to guard against see the "Dirty Dozen" list on IRS.gov.‬

9 Tips for Organizing Your Workspace

It’s almost like your paperwork is multiplying right before your eyes. You take papers off of your desk, but by noon, there are more. Imagine how much more work you could get done if you could find a way to stay organized?

1. Get into a Routine

It’s easy to say, “I’ll just clean my desk on Fridays before I leave work,” but how often does that really happen? Make it a daily objective to work through your papers by the day’s end.

2. Decide What to Do With It

You can break it down into items:
  • What can be handled in a couple of minutes
  • What needs more time to work on
  • What needs to be filed
Separate your paperwork based on how quickly you can complete them. Organize your email into folders that you give higher priority to and then sort emails in this fashion.

3. Invest in Storage

Buy file folders, shelves, book cases…whatever it takes to help you get papers and books off your desk and out of sight. Use pencil holders and file trays for things you need daily, and keep them within reach. Everything else you can put out of sight.

4. Get into Your Computer

It’s really easy to save files wherever your computer sets as the default, but how much time do you waste trying to find things. Set up files for each project or client you have, then add more folders as necessary. The format might look like this:
  • Client ABC
    • Contracts
    • Project plans
    • Images
    • Completed projects
If you save to the relevant folder, you will find things more easily.

5. Do A Spring Cleaning…Monthly

You collect pens at trade shows and conferences, as well as those silly desk toys that are hanging around gathering dust. Designate one day a month as Desk Cleaning Day and spend a half hour getting rid of anything that doesn’t make you more productive. Haven’t used it in a month? Throw it away, give it away or put it into a drawer.

6. Keep Cords Out of Sight

I love my wireless keyboard and mouse! It stresses me out to see cords and wires strewn across my desk. Untangle your cords and make sure they all have a place to plug into your power strip.

7. Go Paperless

Paper is the chief cause of most clutter, so why not eliminate it? Scan important documents and save them using your new computer filing system. You can shred and toss the documents once they’re scanned. Make sure to keep any legal documents that require the originals as proof.

8. Plan Your Day

Before you leave the office, check your calendar to see what tomorrow may bring. I like to prepare what I will need for the start of the day and get out any paperwork or files.

9. Look at Your Desk With New Eyes

Sometimes we honestly can’t see all the clutter because we’re so used to it. When you approach your desk, really look at it and see what’s there. What’s contributing to your productivity and what’s taking away from it? It’s essential to notice the things that are out of place and put them away before they affect your proficiency.

About these ads