![dataloss logo](/images/dataloss-logo.png)
BreachExchange mailing list archives
Lax on security, many SMBs ripe for the picking by cyber criminals
From: Audrey McNeil <audrey () riskbasedsecurity com>
Date: Tue, 25 Oct 2016 18:32:54 -0600
http://thirdcertainty.com/guest-essays/lax-on-security- many-smbs-ripe-for-the-picking-by-cyber-criminals/ Enterprises are cyber crime targets, and, as a result, big-company IT is always “looking over their shoulder.” However, hacking is moving down market, and small- and medium-size businesses (SMBs) are now targets as well. The ramifications are serious. For example, if an accountant’s unencrypted laptop were lost or stolen, tax returns, Social Security numbers and private information could be compromised, with disastrous consequences. Because many small firms don’t understand how to tackle security, cyber criminals exploit their lack of sophistication. Cost and complexity are barriers, and risk is magnified because even one security incident can kill an organization. So how can SMBs answer this threat? A starting point is understanding encryption—a foundational element of cybersecurity. While sophisticated in use, encryption is a simple concept. As kids, we played with cryptograms: Every letter in the alphabet was exchanged for another, requiring a key to determine what was written. Computer encryption is essentially the same, but with a more complicated key structure containing binary digits that make the information useless without the correct key. To get a better understanding of areas of risk, an SMB should conduct a security assessment. Importantly, health care and finance companies need to understand requirements imposed by the Health Insurance Portability and Accountability Act (HIPAA) and the Sarbanes-Oxley (SOX) Act to meet industrywide and government requirements for data management, including storage, archiving, encryption and retrieval. SMBs also must understand where sensitive data lies and how it is protected in the process of doing business. This means taking a holistic view of technology, creating an encryption strategy for all data—whether stored on a server or on “endpoints” like office computers, laptops, mobile devices or USB drives. The Bring Your Own Device (BYOD) trend must be addressed by the assessment and eventual security plan. The strategy also must account for security of data in transit, including providing for the use of firewalls and virtual private networks (VPNs). As do enterprises, SMBs must develop plans that mandate multifactor authentication for access to critical systems and data. Additionally, human factors should be addressed. Training is critical, and personnel must be taught to check and verify before providing access to data. The risk from human error is all too real. SMBs can execute security assessments that lead to a robust and compliant security plan. Once an assessment is complete, a short list of solutions providers that meet both technological and business needs can be easily created, giving SMBs a faster path to security.
_______________________________________________ BreachExchange mailing list sponsored by Risk Based Security BreachExchange () lists riskbasedsecurity com If you wish to Edit your membership or Unsubscribe you can do so at the following link: https://lists.riskbasedsecurity.com/listinfo/breachexchange
Current thread:
- Lax on security, many SMBs ripe for the picking by cyber criminals Audrey McNeil (Oct 26)