It is difficult to ignore the seemingly constant stream of newsworthy security breaches these days. More frightening are the numerous instances where organisations are compromised due to a lack of basic security measures or their lack of proper configuration. While the perception may be that attacks only target large corporate entities, the reality is that the threat environment is based on value of data, and not the size of the organisations that house it. This means that smaller entities such as SMBs, whose data can be as valuable to an attacker as enterprises, are also at risk.
For SMBs, however, the stakes can be much higher. While a larger company may have the resources to effectively recover from a security breach, it is quite possible a small business may not. As many can testify, it only takes a single compromise to destroy the infrastructure of a business, a business that may have taken years to build.
The good news is that SMBs are aware of these difficulties and are taking steps against these challenges. According to IDC, small and midsize businesses will spend $5,6 billion on security technology by 2015. Additionally, over the next three years, growth on security spending is projected to grow at double the rate for other IT products and services. As SMBs continue to look for ways to enhance security measures, it is important to be aware of a few, often overlooked, security threats that SMBs currently face:
Careless employees
While many security programs focus on the technical aspects, in reality, one of the most overlooked threats facing small businesses are their own employees. Whether an employee gains access to restricted data, does not follow protocol for properly disposing of data, or accidentally clicks on spam through their e-mail, mobile phone or Facebook account – an SMB’s workforce can be one of the biggest culprits of data leakage. It is therefore imperative to develop and enforce an acceptable use policy that particularly defines how employees should work with the data and tools connected to an SMB network.
This is increasingly significant, as personal technology becomes more business worthy. It can be expected that employees will adopt and integrate technology like tablets, smartphones and personal computers in order to increase their effectiveness and simplify their daily tasks. This however, causes a distinct gap in an enterprises ability to control the security of its data. Incorporating a flexible policy to create awareness and define standards for acceptable use is crucial in creating a culture that is security aware the use of personal devices here SMB’s are unable to extend their visibility.
Social networking
Social networks can provide a great (and free) resource for marketing to and communicating with current and perspective customers. However, SMBs must recognise the direct relationship that social networking sites have with their businesses. Similar to how your personnel represent the business in public environments, employees represent the business on social networks – and there is a certain level of risk associated with that representation. Beyond potentially tarnishing a brand, employees’ engagement on social networks can also make them more vulnerable to attack, either by losing information if an account is compromised or by voluntarily giving up too much information.
In order to mitigate these risks, a few things can be done. First and foremost, password protection is essential. Beyond that, maintaining a policy for proper social media use is incredibly important for each individual within the business using social networks. As part of this policy, establish which networks are acceptable to use, and maintain guidelines for appropriate social media behavior and etiquette.
Web application threats
It is not uncommon for many SMBs to leverage external hosting for web applications. However, many assume their hosting provider has provided web application security, when in reality, they do not. Before deciding to work with an external provider, it is important to discuss what security measures they have in place to protect data and how they will keep that data safe in the event that another client’s data is compromised. Beyond this, one can utilise tools like a blackbox scanner to ensure there are no glaring vulnerabilities in your provider’s web applications.
New technology adoption
SMBs must be fast, nimble and innovative in order to compete in the business world. One way to do this is to rapidly adopt new and evolving technology. In the past, those potential benefits may have been gleaned from empowering employees with things like laptop technology. However, today, mobile technology is becoming an increasingly significant part of how people conduct business.
While the benefits of mobile adoption are great, there is also a level of risk involved that business owners should be aware of and seek protection accordingly. Businesses should only allow data to reside on mobile devices if those devices can be managed and protected. Mobile device management solutions, including malware solutions, are great tools and can minimise risk as well as provide for device wipe capabilities in the event of device loss, off boarding or other events. In addition, creating policies and educating employees are key to fostering a culture of security awareness when it comes to mobility.
Drive-by download attack threats
SMBs are often unaware of the indiscriminate attacks launched by 'drive-by downloads' – or the unintentional download of software– and how these affect both their users and websites. In addition to paying closer attention to the sites employees visit and links they click on, there are a number of technology solutions that can also help guard against this. These include web content filtering, Internet Protocol Security (IPS), malware sandboxing and finally, whitelisting, which functions by blocking all applications from installing on an endpoint with the exception of what is explicitly allowed to be installed.
Conclusion
While it is impossible to safeguard from every potential avenue of attack, the key is to develop a proactive approach to security within your business, rather than waiting to implement a procedure after the fact. It starts by assessing the threat environment of your current business landscape and putting proper procedures in place to safeguard the most valuable asset your organisation has to offer: your data.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version