SMB/E's underestimate the cost of cyber security breaches

I found this article at www.smallbusinesscomputing.com and I am repeating it here verbatim because I believe that it captures the essence of the challenges that lie ahead and the need for education and the provision of simple but effective authentication solutions. 



What SMBs Don't Know About Security Can Hurt You
April 23, 2010

Small and midsized businesses might be the lifeblood of the U.S. economy, but according to the latest Internet security survey from Panda Security, their generally lackadaisical efforts to protect consumer data is also making them a prime target for cyber thieves.

More disturbing, particularly for customers swiping their credit cards or purchasing products and services online, the survey reveals that the vast majority of SMBs claim they don't know how to effectively prevent identity theft, lack the resources to install the technology that could thwart the majority of cyber attacks and, worse, seem to believe that it's really not their problem.

Panda Security's survey of 300 executives and financial professionals at SMBs (defined as companies with between 1 and 500 employees) spread across 38 different industries, found that 63 percent of companies acknowledge being worried about cybercrime but say they lack the knowledge to protect their businesses.

This apparent institutional ignorance is especially acute when it comes to banker Trojans, a particularly virulent form of malware that tricks people into divulging usernames and passwords for their online banking accounts.
Fifty-two percent of the survey respondents said they had "little or no familiarity" with banking Trojans, even though the mainstream media has provided extensive coverage of high-profile identity theft scams such as the infamous T.J. Maxx hacker attack that resulted in the theft of more than 40 million credit and debit card numbers, the largest identity theft case ever prosecuted by the U.S. Justice Department.
SMBs are even more clueless when it comes to how they think these thefts will be resolved once they've occurred.

The survey found that a staggering 63 percent of companies either "strongly or somewhat" believed that their banks would return all of the funds stolen in these attacks, a sign that most SMBs aren't particularly motivated, or capable, of implementing at least a modicum of security technology and processes to prevent themselves from being swindled.

But in the Panda's survey, only about 37 percent of victims said they recovered their stolen funds, while 28 percent reported "most" of their stolen funds were reimbursed.
"While online banking security is a general concern among most SMBs, most of them have little knowledge about the specific threats targeting organizations of their size," Panda Security's Sean-Paul Correll, said in the report.

It's precisely this false sense of deserved recovery that has prompted three states to recently pass legislation allowing banks to recover costs and damages from retailers that endure data breaches after failing to comply with Payment Card Industry standards.

"U.S. law puts the burden on business owners for keeping funds secure, rather than the banks," Correll said. "The majority of SMBs surveyed weren’t aware of this fact, which means they are operating with a false sense of security."

Lacking IT resources
They're also operating with less resources and general technology acumen than large companies.
"SMBs typically have fewer in-house resources and budgets for IT security, placing them at greater risk of attack," the report concluded.

While 64 percent of those surveyed said they have protective and procedural methods in place to detect or prevent online banking fraud, 15 percent admitted they had not updated security software on all of their online transaction systems and were "unsure" of their security software altogether.

Finally, 58 percent said they don't even have insurance to protect their business from banking fraud or identity theft.

Larry Barrett is a senior editor at InternetNews.com, the news service of Internet.com, the network for technology professionals.

Comments

Post a Comment

Popular posts from this blog

The End of Passwords

Finally it seems … the penny has dropped.   Passwords are a poor substitute for real online security.   There is more and more ‘chatter’ about it.    Robin Henry writing in the Sunday Times on New Years Day talks of the end of ‘password hell’ invoking solutions in the pipeline from the Web Gods – Apple and Google.  The talk is of new biometric solutions such as facial and hand movement recognition.  Even IBM is talking this way.  ( http://www.forbes.com/sites/thestreet/2011/12/20/ibms-tech-predictions-for-the-next-5-years/ )  I agree with the notion that passwords are a dying breed but not that biometrics will become vogue.   They are fraught with problems of their own such as reliability, accuracy and the need for referencing of data-bases ( fail !) .    Why are passwords defunct?   Basically they are difficult to remember and they are easy to steal.    The solutions needed are those that require no cognitive load for the user ( the most unreliable participant in this enterprise
Read more

WIKILEAKS - the fuss?

Why all the fuss ? Why the ‘outrage’ at this ‘threat to national security’ ?   Are we really worried that nuclear war is going to break out because of these ‘dirty’ secrets getting out.  As if the North Koreans are going to up the ante any more than their mock charge of last week because of the abuse and scorn heaped upon them by US Diplomats.  ? !    Come on. To me the irony of this bluster is that it is (largely) from the right wing establishment in the US - calling it treason!     Any party that parades a half wit like Palin as a presidential hopeful hardly holds any moral high ground when it comes to protecting the USA.   Her appointment as the ‘leader of the free World’ will be enough to send any level headed American ( let alone any one of their Allies ) into a panicky tailspin at the thought of what she may stumble into ( by accident or design) . So how did these documents get out there?   Poor security.  Plain and simple.   If the US is so worried about this incident su
Read more

SPOOKS - CYBER ATTACK

Well I’ll be damned – if the subject of my last blog wasn’t the central theme to last nights episode of Spooks – CYBERWAR.    (To those who live outside the UK – Spooks is a very popular TV series about the goings on of a key team inside MI5 who spend their time thwarting terrorist attacks on the UK – while engaging in risqué amorous trysts on the side ).   And so last night we had the Russians and the Chinese –(working together !!) – ganging up on MI5 by infiltrating ( hacking ) their ‘secure’ internal network.     Whether the events portrayed were within the bounds of possibility or credibility who knows?     But if teenagers can break into the Pentagon – then I am sure that Russian/Chinese expert hackers can probably do something along the lines of infiltrating a UK Govt ‘Spooks’ departments network.      Either way it constituted an attack on British soil by foreign ‘combatants’ – which ( if it were true ) would have been a first since the Normans in 1066.   So we saw how vulner
Read more