Small business security

Print this story

IT security threats are coming from all angles in the current business environment. New threats are discovered every day. What is the best way to fight them?

Next >>

Too many businesses take a “fire-fighting” approach to IT security. They’ll spend a minimum on securing their systems, then react after an incident has taken place.

With a long-term investment you must cover all existing threats and also anticipate some potential risks that may arise in the future. Is your business changing? Are you reaching new customers? Deploying new services? Adding more IT infrastructure? All of these elements may introduce new threats or make your business the target of an attack.

Data theft
The most obvious e-security threat to business is theft of sensitive data. Customer contact databases, confidential email, internal financial figures and unique plans or intellectual property could be very attractive to unscrupulous competitors or perpetrators of fraud. Hence, data thieves will pursue nefarious tasks such as dumpster diving (searching through rubbish for printouts and paper-based information), accessing deleted data from decommissioned computers (which is difficult to permanently erase), hacking into secure systems and courting disgruntled employees with bribes or coercion. Data theft is a wide-ranging problem affecting many aspects of IT security. Of particular concern in this area are unsecured or poorly secured wireless networks.

Identity theft
With today’s online banking, information services and product sales occurring so frequently via the Internet, there are of course numerous places where criminals can capture portions of your personal information. Your date of birth, middle name, income, home address, phone numbers and financial account numbers can all be captured by a determined thief. With that information aggregated, the criminal can attempt to access your accounts or take action on behalf of you personally, using your personal data to support their activity. For example, when you phone a call centre to perform changes on your personal accounts, you may be asked to verify a piece of personal information to verify your identity. The expert identity thieves will have this information.

Denial of service and nuisance attacks
Denial of service attacks are typically an attempt to interrupt a business system such as a corporate website or e-commerce server. The attacker takes advantage of the way IP communications work, where each connection request for information from a website or system uses up a small amount of that system’s resources. To perform the attack, a number of computers are coordinated to send the target computer a massive stream of spurious requests which fill the system’s resources trying to answer them all. The result is that the genuine users or customers of the system are denied access due to the flood of traffic that is tying it up. Service downtime from denial of service attacks can be financially expensive and damaging to your businesses’ reputation. A router or firewall feature called Stateful Packet Inspection (SPI) can be helpful in combating denial of service attacks.

Next >>

Print this story