Spyware a barrier to small business productivity 30 March, 2008 By Patricia Pickett

In a recent survey commissioned by CompTIA and conducted by Washington, D.C.-based consultancy Kotler Marketing Group, which polled 537 non-IT employees at businesses with 10 to 200 computer users, more than one in four end users reported having their productivity impacted by a spyware infection during the past six months. Of these, more than one-third reported multiple spyware infections.

According to Steven Ostrowski, director of corporate communications at Oakbrook Terrace, Ill.-based CompTIA, lack of training seems to be behind much of the spyware problem. "Users don't know oftentimes how to compute safely, how to do e-mail the proper way, and that they shouldn't open certain e-mail attachments or visit certain web sites," Ostrowski explained. He added that education has to become more of a business issue rather than a responsibility that sits on the shoulders of the IT department. "The human element continues to be probably the biggest factor in computer security issues that companies are facing...but it has not resonated with a lot of companies that they need this educational component."

The spyware problem is also cropping up more frequently simply because there is more of it. "The numbers continue to increase despite the efforts of companies to come up with anti-spyware technology," said Ostrowski. "It seems to multiply and for every step we take to address the problem, it seems that (spyware makers) are two steps ahead."

The survey also found that users of spyware-infected computers reported living with the problem for 18 work hours -- more than two full work days -- before getting it repaired. This tended to happen even though users realized that their work productivity was reduced due to the problems associated with spyware. In fact, respondents estimated that their productivity was reduced by 21 per cent when the spyware issue was first noticed, and was reduced by 32 per cent when the problem was at its peak.

While there may be some users who are simply unaware that spyware has infected their computers, it is likely more common that employees will know the source of the problem but will not report it because they are afraid of getting into trouble, Ostrowski said. "There is a fear factor involved because they may be doing something they shouldn't be doing on their computers during work hours," he explained. "Eventually after a day and a half they will call the IT department and say 'I've got this problem.'"

CompTIA also polled 200 IT professionals who support small and mid-sized businesses on some of the issues they face. PC support pros who had fixed at least one spyware incident during the past year reported spending an average of 2.8 labour hours per infected PC. That translates into more than 20 hours of reduced worker productivity for each spyware incident at a small business.

Ostrowski stressed education as one of the best ways to tackle the spyware problem. "Even a small business can take the time to educate people on how to use their computers safely," he said. "If any amount of human error or mistakes can be corrected, I think that a lot of these security issues cold be resolved." He added that if an organization doesn't have an internal expert who can train users, it can turn to an outside resource for help.

The spyware problem could provide opportunities for solution providers, service providers or resellers to get into managed e-mail or security services. "That way (customers) can do the things they're used to and not worry about whether they're infecting their PCs with spyware," Ostrowski said.

As with many other technologies offerings, customers may understand the benefits of managed services, but it is often a challenge for managed service providers (MSPs) to make a case for return-on-investment (ROI). Ostrowski said it can be difficult for the customer to grasp what exactly it is that they're getting, especially when most of the work is being performed off site. To help MSPs overcome this hurdle, CompTIA has come up with an ROI calculator that can be used to demonstrate the cost savings that could be realized from managed services.