Data Security For SMB - Fly first class on a budget
1 like311 views
The document discusses essential data security concerns for small and medium-sized businesses (SMBs), highlighting threats like insider theft, targeted attacks, and the inadequacies of anti-virus software and firewalls. It emphasizes the importance of protecting intellectual property and using professional services for hosting to mitigate risks. Additionally, it suggests implementing policies and training for employees to ensure the safety of digital assets.
Data Security For SMB - Fly first class on a budget
- 1. Data security for an SMB Fly first class on a budget Licensed under the Creative Commons Attribution License Danny Lieberman http://www.dannylieberman.info dannyl@controlpolicy.com http://www.controlpolicy.com/
- 2. “Any large company is made up of a large number of small businesses.” Bill Gates, circa 1998. Explaining why Microsoft workgroup products were a good fit for big enterprises.
- 3. Agenda • What threats should concern an SMB? • SMB awareness of data security • Cultural factors • What data should an SMB protect? • Is anti-virus enough? • Is a firewall enough? • Servers in the office or in the cloud? • Planning for disasters • Fly first class for cheap
- 4. •What threats should concern an SMB? • Data security is Ugly – Loss of IP • Trusted insider theft – Mail, Web, IM – Smart phones • Front-door attacks – Lost passwords makes it easy • Back-door attacks – Spyware, Trojans – Piggy back on legit sessions
- 5. •SMB awareness of data security • Market research performed by Infowatch in September 09 – 99% of 190 SMBs were aware of data breach issues. Infowatch CEO Natalya Kaspersky – Over half focused on IP protection
- 6. Cultural factors • Americans – Rule-based – Technology – Lots of regulation that doesn't work • Europeans – Principles-based – Discipline – Regulation that appears to work
- 7. •What data should an SMB protect? • Credit cards – Usually not an issue for SMB merchants • Most have less than 1 million transactions/year • Most outsource payment processing • Can comply to PCI DSS with a self-assessment • Intellectual property – A small firm can have extremely valuable IP • Manufacturer, design house, hi-tech startup • Designs, algorithms,commercial agreements • IP theft can put a SMB out of business
- 8. Is anti-virus enough? • The good news – Good AV software can detect and prevent certain kinds of attacks that steal data • The bad news – Anti-virus software is worthless against trusted insiders, phishing, man-in-the- middle attacks.
- 9. Is my firewall enough? • There is no good news – Firewall creates false sense of security – Cannot stop trusted insiders – Anyone can violate privacy of other employees – Cannot stop targeted Trojans from stealing data on open FTP or high- numbered ports • If you shut them down, employees will take their data home....
- 10. In the office or in the cloud? Wake up and smell the hummus – Hosting your own mail/Web servers in the office is a bad idea • Attracts attackers like flies to honey – Use service like Google Apps • They may read, but they won't steal
- 11. Planning for disasters • Take regular backups • Use a professional hosting service – Calculate cost of loss of business – Spend the right amount • Build employee ERT – Emergency response team – Train once every 3 months – Know where the keys are
- 12. Fly first class for cheap • Policy • Enforcement
- 13. Fly first class for cheap • Policy: the 10 commandments are free. • An AUP reduces the number of employee options by default – No “opt-in” check box
- 14. AUP read and understand agreement An Approved Usage Policy states that: “Digital channels are to be used to further the company’s business and improve customer service and not for personal entertainment or gain” “Employees will protect the company's digital and physical assets”
- 15. Digital Assets • Any computerized information that the firm uses to compete or accomplish it’s missions – Customer pricing – Intellectual property – Biz dev plans
- 16. Enforcement • Corporate culture – A little fear in the workplace is not a bad idea (Andy Grove) • Everyone signs, owner first • DLP “Light” – Mail and Web – Alert and/or block violations – SMB solutions available for $10k
- 17. DLP “Light” for SMB Database File Server Server Interception SMTP HTTP Policies Alert or Block Reporting Forensics
- 18. Coming attractions Register online for: • Oct 8: SMB data security • Oct 15: Data security as a business objective • Oct 22: A holistic approach to security and compliance http://www.controlpolicy.com/workshops/
- 19. Learn more • Read the Data Security Blog http://www.software.co.il/wordpress/ • Presentation materials and resources http://www.controlpolicy.com/workshops/data-security-workshops/