Hack-Proofing Your Company How Small Businesses can Better Protect Customer Data

Hack-Proofing Your Company How Small Businesses can Better Protect Customer DataHack-Proofing Your Company: How Small Businesses can Better Protect Customer Data by Susan Caminiti.

Big corporations have long understood the need to protect against cyber criminals out to wreak havoc on their computer systems in order to steal money or customer data—or both.

Yet technology experts say small businesses are just as vulnerable, and don’t even know it. “The same small business owner who will spend money putting in an alarm system, a fence around the building, and locks on every door, is the same person who doesn’t see the need to take security precautions with his IT system,” says Brian Reich, founder and president of The Reich Group, a security consulting firm based in northern New Jersey. “The three prongs of security are physical, personnel, and IT security. Unfortunately, a lot of small businesses forget about that last piece because they operate under the assumption that since they’re small, they can’t get hacked.” Hack-Proofing Your Company: How Small Businesses can Better Protect Customer Data

No business is too small to be a target Hack-Proofing Your Company: How Small Businesses can Better Protect Customer Data

Nothing could be further from the truth. That’s because small firms typically have weaker security profiles that enable hackers—or even disgruntled ex-employees—to easily penetrate their systems to steal proprietary information, explains Ed Skoudis, an instructor with the SANS Institute, a leading information security training and certification school based in Bethesda, Maryland. And with few (if any) IT professionals on staff at small firms to monitor these breaches, the issue often gets pushed aside until an attack actually happens.

And it’s occurring more frequently at these smaller firms. According to Verizon Communications Inc. and the U.S. Secret Service, of the 761 cyber attacks that were reported in 2010, 482 of them—or 63 percent—were at companies with 100 or fewer employees. With thinner financial resources, the cost of a digital break-in can even put a small company out of business. Speaking at the recent International Conference on Cyber Security in New York City, Shawn Henry, the FBI’s top cyber investigator, cited a case where a small business had to close up shop after hackers were able to steal $5 million from its accounts.

Passively scan for security holes Hack-Proofing Your Company: How Small Businesses can Better Protect Customer Data

So how does a small business figure out just how vulnerable its online data is? Skoudis and others recommend that they start with a vulnerability scan. Akin to a routine physical, this test looks at your entire computer network every quarter or so to determine weaknesses—or vulnerabilities—that could allow an attacker to get in and steal sensitive information, such as customer lists and credit card information.

Qualys, a provider of on-demand IT security risk and compliance management solutions, based in Redwood Shores, California, offers a free security assessment that small businesses can try, says Skoudis. It includes a scan that detects security vulnerabilities in your systems that face the Internet, including your web server. For a fee, the company can conduct scans that look across your entire network and detect internal vulnerabilities, such as malware infections and threats. The cost is based on the number of IP addresses being scanned and the frequency of those scans.

Actively test your defenses Hack-Proofing Your Company How Small Businesses can Better Protect Customer Data

Going one step further, Skoudis recommends a penetration test—or pen test, as it’s often called. It begins with a vulnerability scan, but then attempts to exploit a company’s IT weaknesses to determine how easily, and to what extent, a hacker can bring a company to its knees. A penetration test can cost anywhere from a few thousand dollars to tens of thousands of dollars depending on the size of the company and how many computers need to be scanned. Hack-Proofing Your Company: How Small Businesses can Better Protect Customer Data

“We’ve done pen tests where we were able to get a company’s customer records and all their credit card information,” Skoudis recalls. “When a company gets breached like this, it can destroy its reputation and drain its bank accounts overnight.” And any company that needs to be compliant with Sarbanes-Oxley or HIPAA rules, adds Reich, is even more vulnerable should a security breach occur.

Of course, the difference between a penetration tester and a hacker is that the former has permission to break into a computer network and steal information and the latter does not, according to SANS.

Kevin Mitnick is skilled at both roles. He was once one of the world’s most notorious hackers and today is a best-selling author on information security and president of his own firm, Mitnick Security Consulting. He often consults with small businesses and sees first-hand what happens when cyber security issues are ignored. Hack-Proofing Your Company How Small Businesses can Better Protect Customer Data

For example, he’s currently working with a small e-commerce company based in New Jersey that routinely takes and stores credit card information from its customers. The problem, explains, Mitnick, is that the company stored this financial information on its servers unencrypted, or in other words, as plain text. A hacker who was able to get access to the data had to do little more than copy the numbers to begin fraudulently using them. “The credit card company was the one who figured out the stolen numbers were coming from this business,” Mitnick says. “The owner of the company had no idea this was happening and now they’ve hired me to do a security assessment of their site.”

The cost of doing nothing Hack-Proofing Your Company: How Small Businesses can Better Protect Customer Data

Mitnick, as well as others, point out that companies—big and small—who accept credit cards are required to be compliant with PCI Security Standards, the governing body that establishes the security measures merchants must have in place in order to securely accept and store credit card data. Routine vulnerability testing is one of requirements in order to be PCI compliant, points out Skoudis, and yet companies will regularly overlook or ignore this step because they think they’re too small to be hacked or just don’t make the time. According to PCI, should customer credit card data be stolen, a small business can be liable for fines and penalties. According to FocusOnPCI.com, a site dedicated to explaining the details of PCI compliance, each cardholder data breach can cost a small business between $50 and $90. Multiply that by hundreds or even thousands of customers and the cost escalates quickly. Further, non-compliance can also result in a small business being prohibited from accepting credit cards in the future.

No amount of IT security and vigilance can completely eliminate the risk of an IT breach, say the experts. “There isn’t an agency, organization, or company I know of that hasn’t be hacked to some degree,” says Edward J. Appel, a former FBI agent for 28 years and now a computer security consultant. The goal, they say, is to mitigate that risk by making it harder for networks to be compromised in the first place. Says Appel: “If you say you can’t afford it or don’t need to periodically see where your company might be vulnerable, you’ve already ceded control to the bad guys.”

This is Hack-Proofing Your Company: How Small Businesses can Better Protect Customer Data.

Comments (25)

  1. Bianca

    wow, very interesting, keep sharing these things with us, please.

  2. Derci

    very interesting article for read, i like it.

  3. Bernarda

    great website my friends, this is an awesome post, keep them ideas coming up…good luck.

  4. Akiko

    what about sending a notification for the readers when you update the website?

  5. Deusa

    doing good, i hope everyone likes it.

  6. Eldirene

    this is very interesting site and also very informative.

  7. Claudirene

    keep the good work by posting better posts, as you always do.

  8. Edinalva

    every time i want to learn something good, i access your website, because of the great structure and coherent ideas please keep providing such good information

  9. Alda

    thanks for the review

  10. Adelina

    would have been better if i had found your website before, because i need to know about this subject, but it’s always good to learn something new.

  11. Creusa

    doing good, i hope everyone likes it.

  12. Evita

    thanks for sharing.

  13. Anunciata

    really nice article, thanks for them good post.

  14. Adrize

    the way you express yourself is very clear, i understand it very well. thanks.

  15. Deborah

    thank you for your tips! useful for mehttp://www.nascimentoturismo.net

  16. Brigite

    i’ve never heard of something like that before, thank you for sharing this information with us.

  17. Evandra

    this article certainly will help me to start up my own blog.

  18. Adelina

    found a lot of great points in this post, nice work.

  19. Laura

    Thanks for taking this possibility to talk about this, I’m strongly about this and I reap the benefits of garden greenhouse structures this subject. If at all possible, while you gain data, please update this website with new information. I’ve discovered it extremely useful.

  20. Elisa

    i am happy to find this post very useful for me, as it contains lot of information. i always prefer to read the quality content and this thing i found in your post. thanks for sharinghttp://www.comodesbloquearcelular.net

  21. Eimear Paine (sorry)

    Begin to be now what you will be hereafter. William James

  22. Maki

    m very happy to see your article. Thanks so much and i am taking a look forward to contact you. Will you kindly drop me a mail?

  23. Eimear Serious

    Take care of your body. It’s the only place you have to live. Jim Rohn

  24. perl web hosting

    Some truly nice stuff on this web site , I it.

  25. Dioclene

    thanks sir for this i like it..


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.