How To Keep Your e-Invoices Safe
Making the switch from manual paper invoicing to an automated electronic process can cut costs, increase efficiencies and improve customer relationships. But with cases of Internet fraud making headline news, the benefits of moving to an electronic transaction system are often overshadowed by the potentially devastating consequences caused by a security attack.
As a company you have probably already received an invoice electronically. If you received it by e-mail, how did you verify who it came from? How do you know that the contents were not changed during transmission? How did you ensure that the invoice was delivered to the correct person in your organisation?
Phishing is just one potential threat. In this case, fraudulent e-mails are sent out that appear to be from a legitimate source. The aim of the e-mail is to lure unsuspecting users into surrendering private information such as passwords and credit card details. How would you feel if an organisation claiming to be you sent out thousands of company-branded e-invoices to random e-mail addresses worldwide? The disruption to businesses and the effect it would have on your company reputation could be catastrophic.
Tampering is another example. This is where electronic documents are intercepted and their contents changed. There have been reports of company e-invoices being intercepted and the amounts changed to dupe unwitting customers into paying out huge sums of money for services or products they never received.
Sending documents electronically without taking the proper security precautions is the electronic equivalent of sending your invoice on a postcard. For example, if you currently attach your financial documents and send them by e-mail then you are leaving yourself open to a potential security breach. Due to the way an e-mail is sent there is no guarantee that it will be delivered successfully or even to the correct person. Also e-mail attachments have questionable legal status and can be easily accessed with no indication that they have been opened or tampered with.
As more and more companies now use the Internet to transmit, present and store company financials (including invoices, purchase orders, credit notes and statements), the demand for higher levels of security is growing. With the introduction of legislation such as the EU Invoicing Directive and Sarbanes-Oxley, certain levels of security and integrity are now expected and companies who wish to trade electronically need to upgrade their systems to ensure that their company data is protected and legally binding.
Fortunately, rigorous security processes are fast becoming an industry standard. Whether sending credit card information or company financials, Internet security is now so effective that important data can make the journey through cyberspace in a way that is as safe as (if not safer) than traditional trusted networks, such as mail. These technologies are available now, for small and large businesses, and can be deployed quickly and cheaply to ensure maximum levels of security throughout the transaction process.
The latest developments in Internet technology have yielded effective encryption and authentication techniques that allow the secure transmission and storage of electronic data. There are many “layers” of security that can be automatically applied to e-invoices. Building up these layers will help to provide the secure infrastructure your company needs to safely exchange information between you, your customers and other members of your trading network.
Ultimately, your goal is to:
Currently the most secure and reliable way of protecting and authenticating e-invoices sent electronically over the Internet is by using the digital equivalent of a hand-written signature.
To digitally sign an e-invoice you must first receive a digital certificate from a trusted authority, such as an authorised IT vendor, government organisation or bank. Digital certificates reside on a PC, or on hardware devices such as smart cards and HSMs (hardware security modules). They contain a private key, which is unique to you and your company. When you create an invoice the private key encrypts the result of a mathematical calculation on the invoice data to generate a unique numerical value for the invoice. This value is attached to the document and stays with it throughout its existence – this is the document’s digital signature. No matter where the document is sent or where it is stored, this digital signature will always protect it.
Along with the private key, you are also issued with a public key. This public key is used by your customers to decrypt the unique numerical value and to verify that the invoice came from you. At the same time, the public key validates the document’s digital signature to confirm that the contents of that document are the same as when it was sent. This process both verifies the origin of the e-invoice and validates that the data has not been tampered with since creation.
As the use of digital signatures increases in popularity among businesses, governments worldwide are gradually introducing new legislation to affirm their legal status. All e-documents that are digitally signed have legal status in Europe and the US.
In addition to digital certificates, companies can use SSL (secure socket layer) to encrypt and authenticate documents. SSL has now become the standard for any website that collects sensitive information such as credit card details, online orders or company financials. SSL further protects invoice data as it is being transmitted across the Internet. The SSL certificate contains a public key to encrypt data and a private key is used to decipher it. The certificate itself is issued by a trusted authority, which authenticates the identity of the sender. SSL technology is therefore essential to prevent tampering, interception and fraud.
EbXML (electronic business using eXtensible markup language) is an ISO set of common terms that allow companies to communicate and exchange business information electronically. EbXML is widely used as a standard way of applying digital signatures to documents, such as e-invoices. EbXML is used to “wrap” the invoice data with the digital signature and as ebXML is a common standard, any application that receives the e-invoice will be able to recognise and validate its contents. Using a common ISO approved standard for electronic document exchange such as this will further reinforce trust within your trading network.
The systems you use and the applications you run on them to power your e-invoicing solution play an essential role in maintaining security.
The key to the success of your electronic invoicing system is trust. It is essential to build up a high level of trust between all members of your trading network so that transactions can be carried out safely and with confidence. You can do this by demonstrating your commitment to security and offering a secure and legally sound transaction platform.
As this article has shown the means of securing e-invoice information is widely available and is neither costly nor cumbersome to implement. In most cases, a third party e-invoicing vendor will take care of all this for you, and will in turn work alongside trust authorities such as banks to further strengthen your network.