Robert Lemos

Two Ways For SMBs To Secure Their Home Workers

In the slowly recovering economy, telecommuting has become an essential way for businesses to retain valuable workers, increase productivity, and support "green" initiatives. But from a security perspective, telecommuting can also be dangerous -- if you don't have the right technologies in place.

For small and midsize businesses (SMBs), telecommuting is taking off. Nearly 60 percent of SMBs plan to increase their use of telecommuting to cut costs in the next 12 months, according to survey conducted by Staples Advantage, the IT service of the well-known office-supply chain. Yet many SMBs don't have the expertise in-house to deal with security -- about 40 percent rely on external IT support to run their operations, the study found.

DarkReading

For Small Businesses, Social Networking Poses New Security Risks

For about six hours on Tuesday, a small snippet of JavaScript code ran rampant among Twitter users. The code used a particular class of flaw to execute simple commands, including changing the color of the interface and posting itself to the users' followers. Victims only had to hover the mouse pointer over the text.

As social networks become more popular, such threats are becoming more common, taking advantage of the trust between users. No wonder, then, that more than a third of small and midsize businesses (SMBs) already have identified a social network as the entry point for a virus or Trojan horse infecting their corporate networks, according to survey released last week by Panda Security.

"Everyone has to worry about it, but small and medium businesses are most vulnerable," says Sean-Paul Correll, a senior threat researcher with Panda. "Either they don't have the needed expertise or they don't have the budget to hire the expertise."

DarkReading

Should SMBs Invest In Cyber Risk Insurance?

Ferma recovered about 60 percent of the money, but its bank refused to repay the remainder. Many companies have sued their banks to recover their losses, but others are taking a different approach: cyber risk insurance.

"Small companies can lose their whole business if they are not careful, so they should consider offloading some of their risk with insurance," says Larry Clinton, president of the Internet Security Alliance.

DarkReading

Could USB Flash Drives Be Your Enterprise's Weakest Link?

On any particular day, a horde of devices with flash memory are carried behind corporate firewalls and connected to business networks. It's a threat that many companies are not equipped to handle.

Last week, the U.S. military highlighted this fact when it confirmed that an attack on its systems in 2008 originated with a flash drive plugged into a military computer located in the Middle East. The infection "spread undetected on both classified and unclassified systems, establishing what amounted to a digital beachhead, from which data could be transferred to servers under foreign control," U.S. Deputy Secretary of Defense William J. Lynn III wrote in an Aug. 25 essay.

DarkReading

Careful With That Third-Party Web Widget

Small- and midsized businesses use a lot of third-party Web applications: It saves them money and allows them to embed expertise that they might not otherwise have. But it can also open up their business and their customers to attack.

The recent Network Solutions incident shows how this practice can go very wrong: Ten days ago, the Internet domain provider learned that a Web-services widget that it had placed on at least 120,000 parked Web pages was infecting visitors with malware. The firm reportedly downloaded the widget, known as the Small Business Success Index, on third-party online directory WidgetBox.

As more businesses continue to use third-party code in their websites and import content from other sites, the security of their visitors increasingly relies on others.

DarkReading

Ferreting Out Rogue Access Points And Wireless Vulnerabilities

For almost 18 months starting in 2005, attackers used wireless networks at TJX and other retail chains to steal credit card data. The vulnerabilities were not an isolated instance: Subsequent research found that about half of all retail outlets in one shopping center had insecure wireless networks.

Today, WiFi security has improved somewhat, but insecurities in installations still remain far too common. Vulnerability assessments of more than two dozen companies found a quarter have rogue wireless access points that were installed by employees, and a third of their wireless networks had misconfigurations that undermined their security, according to wireless security firm AirTight Networks, which conducted the tests.

DarkReading

Small And Midsize Businesses Look For Ways To Cut Compliance Costs

Compliance is expensive.

In fact, according to IT security analyst firm The 451 Group, nine different security technologies are required for PCI compliance alone: antivirus, firewalls, intrusion detection systems, encryption for data at rest, file integrity, log management, multifactor authentication, a Web application firewall (or a security development life cycle), and a vulnerability management solution.

Then there are the services: a qualified security assessor, an approved scanning vendor, and, in the case of a breach, a qualified incident response assessor.

For small and midsize businesses (SMBs), the costs can be overwhelming, says Joshua Corman, research director for The 451 Group's security practice.

DarkReading

Cloud-Based Denial Of Service Attacks Looming, Researchers Say

With the help of the cloud, taking down small- and midsize companies' networks is easy, two consultants told attendees here last week.

With a credit card and an e-mail address, security consultants David Bryan of Trustwave and Michael Anderson of NetSPI created a handful of virtual server instances on Amazon's EC2 and used a homemade program to attack the network of a client -- a small business that wanted its connectivity tested.

With only three servers -- although they eventually scaled up to ten -- the consultants took the company off the Internet. The price? Six dollars.

DarkReading

Avoiding Accidental Data Leaks In Small Businesses

In small and midsize businesses, the greatest data security risk might not be the educated hacker, but the uneducated end user.

About 42 percent of small and midsize companies have lost proprietary or confidential information, according to Symantec's SMB Information Protection Survey, which was published last month. Of the companies that lost data, 23 percent blamed insiders inadvertently losing data; another 14 percent of breaches were blamed on a broken business process.

In another survey released last year, Symantec researchers found that, of SMBs that suffered at least one breach, 44 percent blamed a lost device, nearly 40 percent blamed human error, and nearly 20 percent attributed the loss to outdated security procedures or inadequate employee training.

The problem, some experts say, is that small business employees are increasingly mixing personal and business technology.

DarkReading

Security On A Shoestring SMB Budget

The e-mail appeared to be an invitation from an old, junior high school friend. Yet when the hospital employee clicked on the link, it instead led her to a malicious site that installed a Trojan horse on her computer. In a little over a week, international cybercriminals used that beachhead to steal more than $600,000 from the woman's employer, according to a terse description of the incident on the Information Systems Security Association’s Web site.

A number of similar incidents to this one highlight the threats of online crime facing small and midsize businesses (SMBs), says Stan Stahl, president of Citadel Information Group and president of the Los Angeles chapter of the ISSA.

"Typically, they say, 'We have firewalls in place and have AV on all the desktops, so I guess we are secure,'" Stahl says. "But today cybercrime is so sophisticated that is not enough anymore."

DarkReading