Security for SMBs

Increasingly complex operations are forcing SMBs to adopt security solutions. Partha Sarathi Sengupta, Research Associate, AMI Research Partners, discusses how these organisations can go about putting a basic security infrastructure in place

While most small and medium businesses (SMBs) started using PCs several years ago, major changes have occurred in the last few years in the nature and complexity of their IT usage. LANs have taken a big leap, and almost all these companies also utilise a broadband Internet link.

Having adopted these basic technologies, SMBs are now steadily adopting new applications which are imperative for enhanced productivity. While SMBs initially focussed on using basic applications like word processing, Internet access and e-mail, the emphasis has now shifted to leveraging IT for automating various business processes. Thus, in recent years, we have seen significant increases in the use by SMBs of applications such as payroll, accounting, retail POS, inventory management, human resources-related applications, CRM and ERP. These growing complexities in business operations have induced SMBs to invest in security solutions.

Given their comparatively smaller scale of operations and limited IT staff and budgets, SMBs often use standard off-the-shelf software packages on individual PCs which are used by a few employees, with limited sharing of data. In the short term, these PC-based packages are often economical, providing sufficient functionality for small businesses. However, as these businesses expand, their requirements also grow, leading to an increase in the number of users, proliferation of applications, and fragmentation of databases.

Towards Better Business Protection

Small and medium businesses are increasingly dependent on networks to operate efficiently, serve customers effectively, and work with partners and suppliers more collaboratively. As the dependency on the network grows, their networks have to be increasingly accessible to customers, employees, suppliers, partners, contractors and telecommuters. However, as accessibility grows, so does exposure of critical data stored on the network. This exposes business systems to new forms of malicious attacks, thereby leading to the need to look at solutions that can protect the network.

To meet the stiff challenges of competing in a fast-paced environment, SMBs turn to networks to support business evolution. Building an effective network foundation and an operational insurance policy is integral to achieving e-business transformation.

This can be thought of as a foundation equivalent to a human skeleton. It is the support system. The stronger, healthier, and more flexible it is, the greater the range of movement, carrying capacity, and longevity or stamina. A network foundation serves the same role for a business.

It is vital that SMBs focus their attention on the critical success factors that drive growth in their particular market. Network security is of immense importance to them as they cannot afford to spend precious time in re-architecting, re-learning, and managing networks. Network problems can result in poor responsiveness and the dissemination of faulty data. Such occurrences can seriously undermine a company’s competitiveness and credibility, and lead to revenue loss. SMBs are realising that as they increase their use of Internet-based applications, their data bank becomes easily accessible to outsiders, which poses a threat to the organisation. Hence, IT security is becoming an integral part of their operations.

Deviation Management

There should be clear cut guidelines around security that can be incorporated in every employee’s job description and key result areas.

SMBs should build processes to minimise any risk to the organisation due to human error. Using instant messengers or free e-mail sites, for instance, could be a security risk to the organisation, so it’s important to provide guidelines on such issues. A proper framework needs to be established to ensure that security incidents and suspected breaches are reported, and weaknesses are removed. There should be provision for deviation management because different individuals have different needs. Network security, therefore, begins with an educated user.

Four Measures Of SMB Security

Security breaches can happen from inside or outside the network. Outside threats can come either through an Internet gateway or e-mail message, while a disgruntled employee or an imposter gaining access to a vulnerable system could be an inside threat.

Given the sources of these threats, a complete security solution should include the following components.

Firewall: To protect a network from threats coming from the Internet.

Anti-virus/anti-spam: To protect all systems from viruses and threats entering through spam.

Patch management: To eliminate vulnerabilities from servers, desktops and networking hardware such as firewalls and routers.

Intrusion detection: To detect suspicious activity on the network.

First Line Of Defence

The main function of a firewall is to act as the first line of network defence, protecting it from external attacks. Firewalls can also be used to open up ports for specific incoming and/or outgoing traffic. It has logging facilities that will inform the user about any failed attacks on the network.

Implementing a firewall is a must for a large enterprise network, whether to protect its Internet gateway or to secure a WAN link between two offices. It will also help prevent unauthorised traffic from flowing out of your network. A good firewall would, therefore, keep track of the kind of applications that are trying to access the Internet and control their access.

Implementation expenses are certainly a consideration for India’s cost-conscious SMBs, so personal firewall deployments on each PC would keep the network small and maintain its manageability, thereby being cost-effective.

Worms, spam and Trojans are now collectively labelled as blended threats. In order to be effectively protected against these threats, SMBs need to install anti-spam and anti-virus solutions, and update their software regularly.

In the case of medium-sized businesses, a server-based solution and a central-management console is needed; this will ensure that all the clients are kept updated with the latest anti-virus and anti-spam updates. A small organisation consisting of a handful of computers may simply have a peer-to-peer network without any server. In such a case, anti-virus and anti-spam software on each desktop is effective.

Fortunately, most security vendors allow their subscribers to update their software over the Internet with minimal effort. Thousands of software vulnerabilities, including those in operating systems, are discovered each year. The time between the discovery of new vulnerabilities and related virus attacks is shrinking. To protect against such vulnerabilities, software vendors often release patches to cover newly discovered vulnerabilities in their products. SMBs need to install such patches regularly.

SMBs can also use patch management software that keeps an inventory of operating systems, other software installed on PCs, their release versions, installation dates, and patches installed. It also automatically obtains information on new patches from the software vendors, and allows businesses to install them at pre-scheduled times.

Detecting The Intruder

An intrusion detection system (IDS) is required to prevent hackers from bypassing firewalls and accessing the organisation’s network. Every organisation, big or small, must have some form of IDS in place. An IDS need not be a large and expensive commercial package—a simple packet-monitoring utility can also serve effectively. SMBs should install some basic tools on each desktop such as personal firewalls, spyware and script blockers. However, packet-monitoring software on the network is enough to keep track of any suspicious activity.

Strategy In Decision-Making

Many SMBs find themselves burdened with numerous applications, each dedicated to individual and specialised business functions. Therefore, in order to streamline security processes, an SMB’s security solution should be driven by its strategic business needs. So whether Internet access and e-mail facilities are required or not, and whether remote connections should be allowed on the network or not, the answers are all driven by business needs.

It is of course assumed that such business decisions are taken carefully, and the decision to grant rights or access is based on business requirements only. A security policy document is framed based on these. Securing an organisation therefore means enabling it to continue doing its business normally without powering down the system.

As SMBs grow, the effects of incremental adoption are magnified, as are the costs and complexity. It is therefore important for SMBs to think strategically about how they use IT solutions.