Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Midmarket Security: 5 Risks, 5 Practical Responses
Smaller companies deal with enterprise-grade threats and compliance challenges, and partners are imposing requirements for sophisticated controls and audits that may be overwhelming. Here's how to cope.
3 Min Read
InformationWeek Green - Apr. 18, 2011
InformationWeek Green
Download the entire April, 2011 InformationWeek SMB Digital Supplement, distributed in an all-digital format as part of our Green Initiative(Registration required.)
We will plant a tree for each of the first 5,000 downloads.
Five Big Problems And Five Ways To Cope
We analyzed 699 responses to our InformationWeek Analytics 2011 Strategic Security Survey from IT and security pros at companies with fewer than 1,000 employees, and we found that they take information security every bit as seriously as large enterprises. They're wrestling with the same challenges, including managing the complexity of security, enforcing policies, preventing data breaches, and assessing risk, but they're doing it with less funding, expertise, and technology.
"Somewhere between 30 and 150 people, you reach the really scary spot," says Lee Sharp, network and systems manager for recycling company TerraCycle. "Midsize companies have all the complexity of big companies but can't afford the big tools and can't easily enforce policy."
Problem 1: Managing Security Complexity
Managing the complexity of security is far and away the greatest challenge midsize IT organizations face--50% of our 699 survey respondents identified it as problem No. 1, 16 percentage points ahead of the next biggest issue, enforcing security policies. A smaller number of people and nodes to protect is little comfort when criminals have diversified their attacks and you're faced with increasingly mobile employees accessing business networks from insecure wireless hotspots, often using unmanaged devices.
Oh, and most midsize companies must comply with at least one, and frequently multiple, regulations, including PCI DSS, HIPAA, state privacy laws, and the Sarbanes-Oxley Act for public companies. Audits are a major time suck.
The complexity problem is exacerbated by stringent requirements from partners--often much larger companies, with more resources--whose information they handle. Small companies are being forced to sign on to stronger policies, processes, and controls and adopt expensive, sophisticated security technologies as a condition of doing business with those larger partners.
To read the rest of the article,
Download the April, 2011 InformationWeek SMB Digital Supplement
Understanding the Threats, Defending the Business 
Become an InformationWeek Analytics subscriber and get our full "SMBs In The Crosshairs" report.
This report includes 15 pages of action-oriented analysis. What you'll find:
The 3 most common SMB vulnerabilities
The 5 top attack vectors, and how to defend yourself
8 ways to make your company a difficult target
Read more about:
2011About the Author
You May Also Like
More Insights
