In order to continue using the Xero Practice Manager integration a number of security policies need to be implemented. These are mandated by Xero in order to keep your sensitive customer data as secure as possible, but are also good practice for all Virtual Cabinet data.
Security requirements:
- Enforce Two-Factor Authentication (2FA) for Virtual Cabinet users.
- Implement data encryption at rest.
2FA
Two-factor authentication (2FA) enhances security by requiring two forms of identification to access an account. This added layer of security helps protect your most sensitive information from cybercriminals.
To implement 2FA for your users, you must be on Virtual Cabinet version 5.6 or later. Please contact support to arrange an update.
Steps to enable 2FA for a user in Virtual Cabinet:
Important - Admins please ensure all users have checked in their documents that are Work in Progress and have closed Virtual Cabinet before proceeding.
- Log in to Virtual Cabinet
- Go to the Admin tab
- Go in to your list of Users
- Edit a user
- Turn on 2FA
- Upon their next login, users will be required to set up their 2FA device before accessing Virtual Cabinet.
To enable for multiple users -
- Log in to Virtual Cabinet
- Go to the Admin tab
- Go to User Security
- Here you can enable 2FA for all/multiple users
- Upon their next login, users will be required to set up their 2FA device before accessing Virtual Cabinet.
Virtual Cabinet utilizes authenticator apps (Time-based One Time Passwords - TOTP) for 2FA. Users can use any authenticator app, such as Microsoft Authenticator, Google Authenticator, or Duo. When logging in, users simply enter the 6-digit code from the app into Virtual Cabinet. The 2FA code is required once every 30 days per device.
For more information, please refer to Xero's blog post on 2FA.
Data Encryption
Data encryption at rest ensures your data is secure and accessible only to those with the decryption key. This practice mitigates risks of data leakage, unauthorized access, and physical theft.
Two main encryption methods meet Xero's requirements:
- Full Disk Encryption
- SQL Server Database Encryption
Full Disk Encryption
Encrypting data on the disk ensures that if the disk is removed from the server, it cannot be read. We recommend discussing Microsoft BitLocker with your IT department, as it is included with your Windows license. More information is available on Microsoft's BitLocker page.
SQL Server Database Encryption
Encrypting the Virtual Cabinet database ensures that copied database files are useless without the encryption key. For licensed SQL Server versions, consider Microsoft Transparent Data Encryption (TDE). Details can be found on Microsoft's SQL Server Encryption page. For those using SQL Server Express, disk encryption is recommended instead.
Both encryption methods are transparent to applications like Virtual Cabinet, requiring no changes to the application in order to support encryption.
Important: Ensure that your encryption keys are kept safe and secure. Losing these keys could result in permanent loss of access to your data.
By adhering to these security requirements, you ensure your data remains protected while continuing to leverage the benefits of Xero Practice Manager integration.