Small and Medium Size Businesses (SMB’s) should focus on ‘a risk-based’ approach to threat
A large majority of big businesses have heeded the decades-long warnings from information security experts and have invested enough in security to make it difficult, expensive and risky for cyber criminals to attack them.
So criminals are seeking easier and safer ways to make money. According to Verizon’s 2012 Data Breach Investigations Report, they do it by attacking smaller businesses.
Cyber criminals are mass producing their attack techniques and targeting SMBs. Wade Baker of Verizon’s Security Division says SMBs are "easy targets" for organized cybercrime compared with larger enterprises.
"Cyber criminals have figured out that if their goal is to make money, attacking a large organization that’s well defended and probably has ties to law enforcement that is going to pursue them, is a high-risk solution."
A mass-produced attack against smaller organizations with fewer defenses is, "a very low risk," Baker said.
What can smaller organizations do?
Obviously SMBS don’t have the same level of resources, but the potential cost of a breach means you can’t afford to ignore the risk either. It has been estimated that the average organizational cost of a data breach was $5.5 million last year, and the cost per lost or stolen record was $194."
The short protection answer is to determine which threats present the greatest risk to the business. In a recent risk assessment done for an SMB, risks were ranked in the following order:
Vulnerability management:
Find and fix software vulnerabilities on servers and desktops. Focus on critical systems first and don’t forget about third party applications.
Endpoint protection:
Use anti-virus software, host intrusion detection/prevention tools, host firewalls, e-mail scanning and web security technology. A Note For Our CounterPoint Customers: CCS can set up these protection devices for you and makes sure they will work well with your CounterPoint software.
Strong password policies:
Rigorously enforce changing of default passwords, no sharing of passwords, use of complex passwords and frequently changing them. CounterPoint has built in features that administrators can set to enforce these policies.
Security awareness:
Train workers on company security policies and common threats. Make sure they know how to respond to suspicious activity, how to recognize social engineering attacks, and how to use their computers safely. CCS can help you here also.
Access controls:
Minimize the number of staff with administrator privileges.
Denial-of-service mitigation plan:
This is imperative for any business that relies on the Internet. Talk to a CCS tech for information and help.
No system is every completely impenetrable but good practices will greatly lessen the risk. As a former Navy Admiral and National Security Agency director stated, “85% of the security risk to businesses could be eliminated with good cyber hygiene."
Talk to you soon. ~Norma