Here’s an article my colleague, Michael Coward recently penned. I think most small businesses should find this useful and interesting.
SMBs Finally Take Data Security Seriously
Over the last decade, our world has become interconnected in ways not previously thought possible. Small companies can now easily be spread across the globe in an affordable way, and big companies can now have inter-office collaboration on a daily basis. But all the benefit that goes with this enhanced freedom relies, in a large part, on our ability to protect our networks and data.
Data loss can cost business valuable reputation and costly financial penalties. The most recent high profile data losses saw Zurich Insurance pay an enormous £2.3m fine for losing thousands of British people’s personal data including some bank details. After a year of high-visibility data breaches such as this and influence by security experts within small and medium businesses, it seems that the message is finally sinking in with small business leaders. In a recent survey from Symantec *1, SMB leaders agree that protecting information is their highest IT concern and priority. This is a massive increase from last year when 33% of SMBs surveyed did not even have the basic antivirus software deployed in their organisation. In the same survey, 74 percent of the decision makers polled said they were either "somewhat" or "extremely" concerned about losing electronic information. This fear appears to be well justified considering that 42 percent of these same companies admitted they had lost confidential or proprietary data in the past year which resulted in direct losses such as lost revenue or financial costs such as money or goods and not forgetting reputational damage.
A recent report by Javelin Strategy & Research*2 found that a staggering 11.1 million U.S. adults were the victims of identity theft last year. In total, U.S Consumers and businesses combined lost a massive $54 billion due to identity theft last year, up 12 percent on the 2008 report. UK businesses should take these figures seriously as since Tuesday 6 April 2010, the Information Commissioner’s Office (ICO) have gained enhanced powers to fine organisations up to £500,000 for serious breaches of the Data Protection Act. The maximum fine prior to this date was a mere £5,000.
SSLPost, the email and document encryption specialists recommend that all SMBs should review their company security policy on a regular basis and protect their IT systems, data and communication channels against threats and ensure suitable measures are in place to protect their business against serious security threats.
Data and Email Encryption
Data encryption protects your sensitive business information whilst at rest - whether it's stored on a laptop, email server, corporate network or other device such as PDA or a removable storage device. Encryption allows you to securely access important data from the office, or any other location. If your device is lost or stolen, the information will be protected by the data encryption mechanism.
Email encryption is often overlooked by SMBs and is usually the main communication channel that a company uses on a daily basis. SSLPost believe that this is a vulnerability that is prone to allow data leakage and can have both financial and reputational consequences. All organisations should invest in a good email encryption service such as the one offered by encryption specialists SSLPost. Data contained in emails can be intercepted and then read, deleted or altered before it reaches the intended destination. The advantage of using the SSLPost service is that the sender and recipient do not need to invest in complicated and expensive software or hardware. SSLPost also offer a policy based product which allows businesses to prevent data loss and leakage by enforcing encryption on their organisation. The encryption is transparent to end users, allowing businesses to comply with industry data regulations such as FSA regulated businesses.
The encryption service allows selective encryption of emails to be implemented from a companywide policy or right down to individual user level; the service makes it simple to create and enforce effective encryption policies.
Some key benefits of the service are
ü Enforces email encryption without disrupting day-to-day operations.
ü Helps protect organisations from liabilities associated with privacy regulations.
ü Encryption complexities are hidden from the end user ensuring ease of use.
ü Monitors all messages to ensure compliance.
ü Compatible with any SMTP compliant email messaging platform.
Viruses
A virus can inflict serious damage to your business by making documents stored on computers unusable. As more and more business is conducted via email, a virus can also make getting in contact with your suppliers and customers more difficult. This could mean delays in making purchases and taking customer orders more difficult which can cost your business some serious financial and operational issues.
· Invest in good anti-virus Software. Ensure all computer systems are protected with up-to-date anti-virus software and other defences against malicious software attacks
Internet and Network Security
Encryption specialists SSLPost say there are number of potential threats on the internet such as hackers that will take advantage and exploit poorly protected company IT systems using harmful and often brutal practices. Hacking is an act of exploiting the vulnerabilities of the operating system without your business knowing that this has occurred.
· Ensure all dedicated connections to the Internet and other external networks are properly documented, authorised, and protected by firewalls, intrusion detection systems, virtual private networks (or some other form of encrypted communication) and your organisation has incident response capabilities in place.
· Ensure all modem and wireless access point connections are authorised and properly secured.
· Ensure all security-sensitive software patches are quickly applied to systems that are accessible to users outside of the organization.
· Ensure the removal of unnecessary sample application software.
· Ensure all sensitive and valuable information is properly protected from unauthorised access including Windows network file shares, desktop, Web and FTP servers.
· Ensure all computers and network devices such as routers and switches within your business are tested for vulnerabilities.
· Ensure your business computers are monitored for unauthorised (or illegally copied) software on a regular basis.