Sunday is Data Privacy Day - Small Businesses Observe

Smaller businesses have become targets for cybercriminals because criminals know they have fewer defense resources than large enterprises.

If cybercriminals can breach a small business and steal credentials (e.g. for banking accounts or email access), they can use that information to steal money directly, create attacks on its customers and work their way around the business ecosystem in other nefarious ways.

The 2016 State of Small & Medium-Sized Business (SMB) Cybersecurity report, independently conducted by Ponemon Institute, LLC, and sponsored by Keeper Security, surveyed 598 individuals in companies with 1,000 or fewer employees.  The survey revealed the following:

• 50% of SMBs have been breached in the past 12 months.
• The most prevalent attacks against SMBs are: web-based attacks, and phishing/social engineering.
• Negligent employees or contractors and third parties caused most data breaches; however, almost a third of companies in this research could not determine the root cause.
• Companies are most concerned about the loss or theft of their customers’ information and their intellectual property.
• Strong passwords and biometrics are believed an essential part of the security defense; however, 59% of SMBs have no visibility into employee password practices, such as the use of unique or strong passwords and sharing passwords with others.
• Password policies are not strictly enforced.  65% of SMBs that have password policies say they do not strictly enforce them; moreover, the policies do not require employees to use passwords or biometrics to securely access mobile devices.
• Current technologies cannot detect and block many cyber-attacks.  Most exploits have evaded intrusion detection systems and antivirus solutions.
• Personnel, budget and technologies are insufficient to have a strong security posture.  As a result, some companies engage managed security service providers to support an average of 34% of their IT security operations.
• Determination of IT security priorities is not centralized.  The two functions most responsible are chief executive officer and chief information officer; however, 35% of respondents say no one function in their companies determines IT security priorities.
• Web and intranet servers are considered the most vulnerable endpoints or entry points to networks and enterprise systems.  The challenge of not having adequate resources may prevent many companies from investigating in the technologies needed to mitigate these risks.  Web application firewalls, security information and event management (SIEM), endpoint management and network traffic intelligence are not considered very important in current security strategy.  At a minimum, anti-malware and client firewalls are considered the most important security technologies.
• Cloud usage and the prevalence of mobile devices that access business-critical applications and IT infrastructure will grow and threaten the security postures of companies in this study; however, only 18% of respondents say their companies use cloud-based IT security services.

This survey is courtesy of StaySafeOnline and its National Cyber Security Alliance.  Review each bullet point with your IT staff and see what safety practices you can put into place to protect your business.