SMEs show lack of concern over security breeches: McAfee

A new survey from security firm McAfee Inc. has revealed some startling findings regarding the security practices of North American small- and medium-sized enterprises (SMEs): the vast majority invest little on security and take very little precaution to protect their networks against hackers despite believing an online presence is critical to success.Darrell Rodenbaugh, senior VP of mid-markets at McAfee, says that while 20% of SMEs surveyed believed they had implemented very strong protection measures against security breeches, two-thirds indicated having some network protection and about 20% said they had no protection at all."That's a surprising high number," he tells Network Letter, noting that he would have thought the totally unprotected would be a few percent. "We liken that to walking the tight rope over an alligator pit without a net."The survey, which questioned 500 companies in Canada and the United States ranging in size from two to 1,000 employees, highlights what SMEs think about security and their potential to be targeted by cyber criminals. For example, 52% don't think they are well-known enough to be a target, 45% of SMEs don't think they are a valuable enough target and 35% aren't concerned about being a target of cyber crime.There's this sense of "it won't happen to me" mindset among the SME customer category, according to Rodenbaugh, and this has a direct correlation to the security investment decisions of these companies (below are figures for Canadian SMEs)."About half of the respondents in this survey said they spend an hour or less a week proactively managing security," he says. "The typical SME has 1.4 IT professionals within their organization and what this study tells us is they don't really see security as an area in which they need to invest a lot of resources."Despite the belief they aren't targets and their subsequent decisions to invest little in security infrastructure, the financial impacts are real and the statistics are telling. According to the report, 21% of SME have suffered an IT security attack, and 32% of those companies have had more than four attacks in the last three years. The survey also says that a quarter of businesses took one week to get back up and running after an attack.Canadian SMEs faired worse than their American counterparts, too. More than one-third (36%) of Canadian SMEs took a week to recover compared to 26% of US-based SMEs. "The harsh reality is we believe that SMEs are really exposed to the same threats as their enterprise counterparts and that cyber criminals do not discern ," Rodenbaugh says. "In fact some experts say cyber criminals will more likely target a SME than a large enterprise simply because they do believe they don't have the same sorts of protections in place."Rodenbaugh says releasing the survey has two goals. It's not meant to scare small- and medium-sized businesses into investing more on security services or infrastructure, it's supposed to raise awareness among the SMEs community that they are targets of cyber criminals.Secondly, it's a call to action to all players in the security industry that they have to do a better job of protecting the information assets of North America's SMEs. Rodenbaugh explains the key is to deliver solutions and systems that are smart, simple and secure. The applications have to be smart in the sense that the SME doesn't need to have an IT security expertise on staff and simple because SMEs can only devote a couple of hours a week on security. "But then they have to be as every bit secure as the technology solutions delivered to our largest customers," he says.The McAfee executive acknowledges the difficulties in educating SMEs on the importance of security. "Almost no amount of awareness is going to change fundamentally the level of investment that they are going to be able to put into security," Rodenbaugh says, noting that the company is trying to make it easier for customers to use security products."We believe that our customers really ought to be focused on their core business," he says, "rather than trying to make a security expert. What we really ought to do is put the expertise into the security so don't have to become that expert. And frankly, that's a more workable solution over time."Time Spent on Security by Canadian SMEsOne hour per day - 9%One hour per week - 44%One day per week - 7%Half a day per week - 9%One day per month - 26%

SMEs show lack of concern over security breeches: McAfee

News | 07/30/2008 3:26 pm EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us