When it comes to data security, many people think they have an abundance of systems and precautions in place to keep their data secure. Sure, you will have antivirus software and you may even update it regularly. You may also feel that you’re too small of a company to be a target of a hacking attempt. Only big firms that have tens of thousands of clients need to be concerned about cyber criminals, right? Wrong. Hackers and cyber criminals have in fact escalated their focus on small businesses. We would like to help you understand the dangers your small business may be facing.

Small firms: low-hanging fruit

The truth is, hackers have realized that small businesses are easier targets, and therefore are increasingly preying upon them. They are able to infiltrate their systems at a considerably faster rate, and with a better percentage of success as well. This means a cyber criminal can invade multiple targets in the time it would take them to lay siege to a better-guarded system with a higher level of data security. How can it be worth their while to steal from a mom and pop operation? In today’s modern world, practically every business makes use of digital payment processing methods. When your customers pay using a credit card, this data must run through your system to be validated. This represents a goldmine of data for hackers, as they can lift this data without being detected. With your customers’ credit card numbers, addresses and names, they can make fraudulent charges on their accounts.

How hackers gain access to your data

Hackers usually take a multiple-point-of-entry approach when trying to breach your company. Don’t be fooled that email is the only way a hacker will try to infiltrate you. While harmful email attachments are the most widely used tactics that hackers use to mine data from a company, they also use low-tech methods as well. Direct phone calls to lower level employees or even a in-office visit posing as system administrator are among the low-tech ways criminals may target your enterprise. You might believe your employees are impervious to these seemingly evident ploys, but it only takes one error to open your company up to an attack.

The buck stops with you

Many people believe that since credit card companies are usually liable for any deceptive charges that occur from a hacking event, that data security isn’t crucial. While this may be true for a consumer, for a business owner the outcome may be very different. Consumers will hold you accountable personally should their information be stolen. Damage control after an attack can cost a business thousands of dollars and in some cases a single attack can spell the end of business in general.

An ounce of prevention…

Data security is very important and any extra precautions you can take would be wise. Use strong passwords and update your existing security systems often. Educate your staff on safety measures they can take, such as creating strong passwords and never giving out login information. Hiring an outside consultant to help you ensure you and your client’s information is safe is another good idea. Simple measures can give you peace of mind that your systems are safe, and your clients will know you have their best interests at heart.

Cyber crimes happen everyday, and everyday IT security companies track and record details around these attacks. Microsoft is upping its game and launching a real-time threat feed so that its fellow partners can study existing threats it finds and learn the best steps to proactively take against them.

Microsoft presently has a process set up to take down dangerous botnets. Microsoft “swallows” the botnets and lets them infect accounts that are highly controlled by Microsoft’s team. Once the botnets infect the accounts, Microsoft learns the way they work and eliminates them as a threat.

Microsoft can now collect threat information and share it with ISPs, government agencies, private companies, and CERTs. The impact of such a move by Microsoft could be significant. Analysts point out that while a real-time threat feed won’t lower the amount of attacks, it will help information security specialists react to these threats faster. This might limit the amount of damage brought on by these attacks.

Another great result a real-time threat feed could have is an increase in overall information sharing between IT security companies. For too long IT companies have been hesitant to share threat information for the fear that it could fuel more attacks. Most experts say this an unsupported fear.  The cyber criminal “community” has already been sharing and gaining knowledge from each other.  It’s only logical therefore that IT security professional share as much information as possible to fight the seemingly endless barrage of new cyber threats.

Let’s hope that security professionals soon understand that sharing information is more valuable than secrecy. And let’s hope that Microsoft’s move is a first step in this change of attitude.

There are numerous benefits to cloud computing. Backing up important data makes it easily accessible to everyone in your company and frees up space on your servers. You almost certainly have several questions about cloud security and might be pondering if cloud security will protect your client’s data and adhere to HIPAA, PCI or Sarbanes-Oxley regulations.

It can be difficult to tell if your cloud storage solution follows these requirements, as many don’t specify in their privacy policies. To help you navigate these difficult waters, let’s consider this topic in depth below.

Compliance

Cloud security has become an important issue recently, as increasing numbers of companies turn to online storage solutions, looking for greater simplicity, scalability and affordability. However the cost in both money and reputation for improper handling of customer data can be extremely high indeed. If your organization should comply to key regulations associated with patient privacy (HIPAA), credit card security (PCI) or the finance-sector strictures of Sarbanes-Oxley, it can be hard to find out if a service complies with these important restrictions.

Who is responsible

Who’s shoulders does the responsibility fall on? There is no law requiring that cloud service providers disclose the level of security they maintain. While they probably do have a respectable amount of safety protocols set up, the safest option is to take their privacy policy at face value. In this case, if you wish to stay in compliance with HIPAA, PCI or Sarbanes-Oxley, cloud computing may not be for you. That said, if your industry doesn’t require tight regulations, then you could make use of the benefits cloud-computing offers. 

Currently there is no law in place that requires a company to divulge this information. Cloud computing services can save your business money while boosting efficiency, but they could also risk noncompliance with privacy laws. This leaves the risk on your shoulders and it is up to you to weigh the benefits and threats for yourself. The topic of cloud security will probably be one of much debate in coming years. At the moment, the right road to travel is the the one that best meets your company’s specific needs.