Attacks/Breaches

Small Business: The New Black In Cybercrime Targets

Enticed by poor defenses of mom-and-pop shops, hackers turn away from hardened defenses of banks and large enterprises

WASHINGTON, D.C. -- Visa Security Summit 2009 -- Hacking banks and large businesses? That's sooo 2008.

Hackers and computer criminals this year are taking a new aim -- directly at small and midsize businesses, according to experts who spoke here today at Visa's annual security event. The consensus: Smaller businesses offer a much more attractive target than larger enterprises that have steeled themselves with years of security spending and compliance efforts.

"As the security becomes better at large companies, the small business begins to look more and more enticing to computer criminals," said Charles Matthews, president of the International Council for Small Business, in a panel presentation here. "It's the path of least resistance."

Matthews quoted industry research that states small businesses are far less prepared to defend themselves against cyberattack. "Nearly one-fifth of small businesses don't even use antivirus software," he said. "Sixty percent don't use any encryption on their wireless links. Two-thirds of small businesses don't have a security plan in place. These numbers are both surprising and disturbing."

And many small businesses still don't know they are targets, according to Chris Gray, director of innovation policy at the Canadian Chamber of Commerce and another member of the panel. "According to a brief survey we conducted, about two-thirds of small and medium-sized businesses believe that large companies are the main target for cybercrime," he reported. "Yet 85 percent of the fraud we see in business occurs in small and medium-sized businesses."

David Hogan, senior vice president and CIO for the National Retail Federation, who spoke on a separate panel at the summit, said only about 60 percent of Level 3 businesses -- the level just above the mom-and-pop shops -- have met the Payment Card Industry's Data Security Standards (PCI DSS) for protecting credit card data. Compliance at Level 4 " the smallest businesses -- is generally believed to be even worse.

So with all of the hoopla surrounding PCI compliance -- not to mention numerous public breaches disclosed in the news and retail trade media -- why aren't more small businesses paying attention to security? The key problems are a lack of resources and time, according to Merrill Phelan, manager of IS and programming for the Washington Metro Airport Authority, a Level 2 merchant.

"You really have to work hard to maintain PCI compliance," Phelan said. "And although PCI all makes sense on paper, sometimes it seems like the security standards written for Fort Knox -- do we really need all of those requirements for a small business? The standards should apply to the business."

In the past, small businesses have been able to protect credit card data on their premises by using secure, dedicated point-of-sale hardware and connections provided to them by banks or financial institutions. But as small businesses begin to explore methods of doing business online, they are also beginning to handle their own credit card data, noted Paul Cook, managing director at Barclaycard, the credit card arm of the U.K.-based Barclays Bank.

"That can be very dangerous, both for the small business and for its customers," Cook observed. "Those businesses need the equivalent of the bank-owned terminal for their Websites -- enough secure payment pages that they don't need to worry about securing the credit card data themselves."

Other panelists suggested small businesses rely more heavily on banks and third-party security services to handle the entire credit card purchase process; that way they don't ever end up handling large amounts of credit card data. "We'd like to take the responsibility for handling that data out of their hands," Cook said. In a presentation here earlier today, executives from McDonald's described a payment system that essentially achieves this goal, allowing franchises to accept credit cards without ever storing any credit card data.

Phelan suggested that small businesses take that idea one step further. "If you can reset your business model so that you're no longer subject to PCI requirements because you aren't handling credit card data at all, that's the best solution," he said. "That's not as crazy as it sounds -- there are ways to accept credit card payments without ever touching the data itself."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18913
PUBLISHED: 2019-03-21
Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location with...
CVE-2018-20031
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to preemptive item deletion in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2018-20032
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor daemon t...
CVE-2018-20034
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2019-3855
PUBLISHED: 2019-03-21
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.