Cyber-Security Threats Unaddressed by Small Businesses: Symantec

Small-business owners are woefully unprepared when it comes to protecting their companies from various forms of internal and external security threats.

When it comes to security, small and midsize businesses are largely unaware of the risks they face, according to a survey of 1,015 U.S. SMBs by the National Cyber Security Alliance (NCSA) and security specialist Symantec. The report found more than three-fourths (77 percent) of respondents said their company is safe from cyber-threats, such as hackers, viruses, malware or a cyber-security breach, yet 83 percent have no formal cyber-security plan.

One encouraging finding was that companies founded in the wake of the economic crisis are almost 20 percent more likely than older small businesses to have a written plan in place for keeping their business secure from cyber-threats.

Nearly six out of 10 (59 percent) SMBs said they do not have a contingency plan outlining procedures for responding and reporting data breach losses, even though 73 percent of respondents indicated a safe and trusted Internet is critical to their success, and 77 percent said a strong cyber-security and online safety posture is good for their company's brand. Sixty-six percent of SMBs said they are not concerned about cyber-threats, either external (a hacker or cyber-criminal stealing data) or internal, such as an employee, ex-employee, or contractor or consultant stealing data.

"We want U.S. small businesses to understand they cannot completely remain safe from cyber-threats if they do not take the necessary precautions," National Cyber Security Alliance executive director Michael Kaiser said in a statement. "A data breach or hacking incident can really harm SMBs and unfortunately lead to a lack of trust from consumers, partners and suppliers. Small businesses must make plans to protect their businesses from cyber-threats and help employees stay safe online."

Despite evidence suggesting small businesses are woefully unprepared to defend themselves against attack, 86 percent of SMBs surveyed said they are satisfied with the amount of security they provide to protect customer or employee data, and 83 percent said they “strongly or somewhat agree” that they are doing enough or making enough investments to protect customer data. However, a report from credit card company Visa found small businesses represent more than 90 percent of the payment data breaches reported to the company.

"It's terrifying that the majority of U.S. small businesses believe their information is protected, yet so many do not have the required policies or protection in place to remain safe," Brian Burch, Symantec’s vice president of Americas marketing for SMBs, said in a statement. "Almost 40 percent of the more than 1 billion cyber-attacks Symantec prevented in the first three months of 2012 targeted companies with less than 500 employees. And for the small, poorly protected companies that suffer an attack, it's often fatal to their business."

Small companies are also struggling to keep up with a changing business landscape that now includes bring-your-own-device (BYOD) initiatives and the use of social media. While social media is an increasingly popular vector for phishing attacks, 70 percent of SMBs surveyed said they do not have policies for employee social media use, while 87 percent of SMBs do not have a formal written Internet security policy for employees and 69 percent do not even have an informal Internet security policy.