Canadian SMBs taking risky approach to basic security practices 11 May, 2009 By Liam Lahey

"The importance of security is undisputed. As the report indicates, security and data protection are essential priorities for Canadian small and midsized businesses," said Michael Murphy, vice-president and general manager, Symantec (Canada) Corp. "Unfortunately, we continue to see SMBs lack the necessary budget and awareness of threats to ensure confidential data is secure, which can impact their bottom line. As the workforce becomes more mobile and adapts to new technologies to improve business efficiency, organizations must prepare for the future and be aware of the solutions available to them."

As the number of mobile workers continues to grow, Canadian SMBs need to take the proper measures to ensure their endpoints are protected. According to the survey findings, 60 per cent of companies polled have yet to implement an endpoint protection solution (software that protects "endpoints" such as laptops, desktops and servers against malware). This is despite the fact that one quarter (25 per cent) of companies polled do not have password protected desktops and laptops, and more than half (54 per cent) have had a lost or stolen laptop or smartphone.

"It's clear there was some awareness out there in these organizations about the importance of security and some of the trends . . . but the results speak to the fact that SMBs need help and on several fronts," he said. "They lack the time, skills, expertise, to more broadly make their protection more effective . . . they justify it simply by assessing the risk and importance, and they're willing to . . . live with the risk."

The survey investigated several variables to determine the reasons why Canadian SMBs are not fully protecting their company's confidential data. When asked to identify the top barriers preventing organizations from creating a more secure environment, the survey found 47 per cent lacked adequate budget, with the median IT security budget being just $6,000 per year. Additionally, one in four respondents identified the skills of employees as a top barrier, and one in three indicated there was not enough time to complete all security related tasks.

"It is no surprise that Canadian SMBs identified lack of budget as the main reason why they are not properly protecting their IT assets and data," Murphy said. "The reality, however, is the cost of security to help prevent a data breach far outweighs the costs a data breach may bring to a company not only financially, but to its public image and customer confidence as well.

"What we've seen, not just in this survey but also in our annual report on threats, vulnerabilities and malware is the landscape has changed and it's clear SMBs are unaware, unprepared, and unable to meet those challenges."

Channel partners too will have to switch up how they approach the SMB security opportunity, he remarked.

"I think they need to sell differently . . . the reason they have to is for those concerns of spending on new projects (that businesses have). Small businesses . . . are looking for better ways to stretch their dollars," he said. "So selling differently and positioning technology differently is key. The same old, same old won't get it done.

"Partners and SMBs have the opportunity to take a very complex environment they may have deployed . . . and unify it, make their solutions more integrated, more manageable, and more capable."

Almost one in three (27 per cent) companies polled have suffered a data breach (an instance where information has been subject to unauthorized access, often where the data is lost, stolen, or hacked into), further driving the importance of properly safeguarding important information. Despite these numbers, however, SMBs continue to lack basic security. For example, 35 per cent of respondents still do not have the most basic security solution installed -- antivirus protection. Further, 55 per cent of companies polled do not have server backup/recovery protection (40 per cent), or antispam protection (46 per cent).

According to the survey, Canadian companies are aware of the latest threats impacting their business. Seventy-nine per cent of SMBs polled are somewhat or extremely concerned with viruses. Other top concerns included phishing emails, loss of information and data breaches.

The report also noted that despite the current economic climate, 91 per cent of Canadian SMBs anticipated their IT budget to remain the same or rise within the next 12 months, with 43 per cent of budgets estimated to remain the same and 48 per cent estimated to rise. This increase in spending strongly indicates that SMBs are beginning to view IT security as a valuable tool to help meet bottom line objectives.

Considering the potential legal ramifications of a data breach on an ill-prepared SMB, Murphy said most are not in the same regulatory framework as larger companies. A potential risk does exist however and he added SMBs are also unaware of the social fallout that could follow confidential customer data being compromised.

Despite it all, Murphy added there is a growing awareness amongst Canadian SMBs of the need to improve security.

"Spending has at least been maintained in areas of security and protection and it's been marshalling across the globe and we've been seeing that in Canada as well," he said.

Symantec's survey was conducted in February of 2009 by Applied Research. The study targeted 1,425 small and medium sized businesses (10-500 employees) located in 17 countries around the globe. There were 200 respondents in Canada (75 in Ontario, 70 in British Columbia, and 55 in Quebec). Of those, 18 per cent are in manufacturing, 14 per cent professional services, 11 per cent telecommunications, 8 per cent health care, and 13 per cent are listed as 'other'. Worldwide, the survey has a 95 per cent confidence level with a margin of error of 2.6 per cent, officials said.