Information security continues to challenge the small and medium business (SMB), writes François Amigorena of IS Decisions.
According to the 2017 Ponemon Institute Study, more than 61 per cent of SMBs have been breached in the last 12 months versus 55pc in 2016. SMBs have become a lucrative target because most do not have sufficient defenses in place to protect, detect or react to attacks. In fact, the Ponemon Institute study found only 14pc of SMBs rate their own security as ‘highly effective’.
But it’s no easy feat securing the SMB. Even though many SMBs are well aware that compromises are more of an issue of ‘when’ than ‘if’, they are finding it difficult to get effective security measures in place.
Common challenges faced by SMBs
The Verizon Data Breach Investigation Report highlights the common challenges for SMBs.
•Lack of resources: SMBs don’t want to invest in something that might necessitate updating the whole infrastructure, updating storage or updating the operating system.
•Lack of expertise: IT is becoming more and more complex. Organizations today need to use security solutions that extend to remote locations and cover roaming and mobile users.
•Lack of information and training: Most SMBs don’t have a large IT team.
•Lack of time: Smaller businesses are understandably focusing on being operational from day to day, so they can serve customers to keep the business going and pay the staff working.
Getting proactive
So how does an SMB build an approach that safeguards their organization? Here are eight SMB-friendly criteria that achieve maximum impact for minimum effort:
1.Automated controls that take action before damage is done
All SMBs battle against lack of time and resources. They are therefore far better off running and monitoring solutions that offer automated controls in addition to threat identification and real time response. In short, should something fall outside a set of established restrictions, your solution should automatically take action before the damage is done – not only when IT intervenes.
2.Easy adoption
If security overwhelms and stifles productivity, users can’t do their job and the solution is already dead on arrival. Security should be behind the scenes, protecting the users and the environment until the moment the user is truly conflicting with security protocol.
3.Limited administration
Most small and medium sized businesses do not have a sizable IT team. Security solutions with ‘stickiness’ tend to be simple to implement and intuitive to manage.
4.Effective
Look to add layers to your security strategy. Putting a layered defense in place maximizes your chances of stopping a threat before it starts.
5.Intelligence
Solutions that just offer information result in the need to hire a watch dog. Choose intelligence and insights that can help spot and stop a breach.
6.Accurate
SMBs cannot take a lot of false positives. There is no time to chase down 50 alerts a day.
7.Non disruptive for IT
Solutions that work alongside existing infrastructure don’t frustrate IT teams.
8.Cost effective
If you agree with the ‘when’ not ‘if‘ premise, then you already know your security strategy is incomplete and requires more investment. Security doesn’t have to come at a high cost – but it does have to be effective in relation to its cost.
With this in mind, where should an SMB place their efforts? Despite these challenges, one area SMBs have seen success with is managing and securing logons.
One foundational truth exists – an attacker is powerless to do anything in your organisation unless they are able to compromise a set of internal credentials. Simply put: no logon, no access.
In fact, 81pc of hacking-related breaches leveraged either stolen or weak passwords (Verizon Data Breach Report 2017), making logons the one common activity across nearly all attack patterns. By assuming the logon to be a key indicator of compromise, you can identify a breach before key actions, such as lateral movement and data access, take place. An indicator of compromise includes the following logon abnormalities:
•Endpoint Used – The CEO never logs on from a machine in Accounts Payable, right?
•When Used – A user with a 9-to-5 job function logging in on a Saturday at 3am? Yeah, that’s suspicious.
•Frequency – A user normally logs on once in the morning and logs out in the evening that suddenly is logging on and off in short bursts could indicate a problem.
•Concurrency – Most users log on to a single endpoint. Seeing a user like that suddenly logged onto multiple endpoints simultaneously is an obvious red flag.
What’s more, when the monitoring of logons are tied to automated responses (using third-party solutions) to take actions such as logging off users and implementing account usage restrictions, this makes logons one of the true preceding indicators that will out-rightly stop an attack and protect company data.
There is no doubt that SMBs need a proactive security strategy. They need to be able to identify when any kind of threat actor tries to hit with obstructing the abilities of employees. Only logon management allows employees to continue as normal, but with the scrutiny and control necessary to automatically shut down suspicious activity at the point of entry.
Learn more about how logon security help protect the SMB from attack at www.isdecisions.com/challenge-secure-small-and-medium-sized-business-smb/.
About the author
François Amigorena is the founder and CEO of IS Decisions, and a commentator on cybersecurity issues. IS Decisions is a provider of infrastructure and security management software for Microsoft Windows and Active Directory. The company offers solutions for user-access control, file auditing, server and desktop reporting, and remote installations. Its customers include the FBI, the US Air Force, the United Nations and Barclays — each of which rely on IS Decisions to prevent security breaches; ensure compliance with major regulations; such as SOX and FISMA; respond to IT emergencies; and save time and money for the IT department.
