Tuesday, 21 November 2006

Do Small Companies Pay Attention to Security?

"Small and Midsized Enterprises (SMEs) are not aware of being a potential victim, spending 40 pounds per year on antivirus is not a high priority," former White House security adviser Howard Schmidt said at the event, organised by managed services specialist Claranet. "SMEs have to realise that just because they are small, it doesn't mean they won't be targeted. Bad guys target wherever they can to get money."

Ninety per cent of small businesses and consumers install antivirus, but ten per cent never update the software's signatures, which are matched against suspected threats, Schmidt said.

He said, "Large enterprises have been doing a good job in preventing security breaches. They are providing free security services, rewiring and reengineering their services themselves, and blocking phishing, spam and trojans.

"But small businesses normally don't have full time IT staff. They don't normally have someone who thinks about security. Office managers usually do it themselves and are stretched. We now have a situation where home networks are like small enterprises to manage. Clearly the challenge associated with that becomes difficult."

Schmidt claimed that with the increasingly widespread use of wireless internet and high speed broadband, along with the growing number of people who own a computer and personal digital assistant, there will be more endpoints to protect against security threats.

"In the future the big issue we are going to be dealing with, particularly with the home networks and SMEs, is there are more endpoints to defend. Now everything is done at the endpoint," he said. "The motivation of hackers is changing too. They are no longer viewed as ‘clever hobbyists' but real criminals doing this for financial gain," he added.

Schmidt said, "Hackers are now shifting and focusing on applications. Not only network applications, but also word processing and spreadsheet applications and shopping cart - things that users spend a lot of time on. They are changing tactics because we don't pay a lot of attention to the successful security development of these things."