Attacks/Breaches
3/19/2009
05:53 PM
Connect Directly
RSS
E-Mail
50%
50%

Small Business: The New Black In Cybercrime Targets

Enticed by poor defenses of mom-and-pop shops, hackers turn away from hardened defenses of banks and large enterprises

WASHINGTON, D.C. -- Visa Security Summit 2009 -- Hacking banks and large businesses? That's sooo 2008.

Hackers and computer criminals this year are taking a new aim -- directly at small and midsize businesses, according to experts who spoke here today at Visa's annual security event. The consensus: Smaller businesses offer a much more attractive target than larger enterprises that have steeled themselves with years of security spending and compliance efforts.

"As the security becomes better at large companies, the small business begins to look more and more enticing to computer criminals," said Charles Matthews, president of the International Council for Small Business, in a panel presentation here. "It's the path of least resistance."

Matthews quoted industry research that states small businesses are far less prepared to defend themselves against cyberattack. "Nearly one-fifth of small businesses don't even use antivirus software," he said. "Sixty percent don't use any encryption on their wireless links. Two-thirds of small businesses don't have a security plan in place. These numbers are both surprising and disturbing."

And many small businesses still don't know they are targets, according to Chris Gray, director of innovation policy at the Canadian Chamber of Commerce and another member of the panel. "According to a brief survey we conducted, about two-thirds of small and medium-sized businesses believe that large companies are the main target for cybercrime," he reported. "Yet 85 percent of the fraud we see in business occurs in small and medium-sized businesses."

David Hogan, senior vice president and CIO for the National Retail Federation, who spoke on a separate panel at the summit, said only about 60 percent of Level 3 businesses -- the level just above the mom-and-pop shops -- have met the Payment Card Industry's Data Security Standards (PCI DSS) for protecting credit card data. Compliance at Level 4 " the smallest businesses -- is generally believed to be even worse.

So with all of the hoopla surrounding PCI compliance -- not to mention numerous public breaches disclosed in the news and retail trade media -- why aren't more small businesses paying attention to security? The key problems are a lack of resources and time, according to Merrill Phelan, manager of IS and programming for the Washington Metro Airport Authority, a Level 2 merchant.

"You really have to work hard to maintain PCI compliance," Phelan said. "And although PCI all makes sense on paper, sometimes it seems like the security standards written for Fort Knox -- do we really need all of those requirements for a small business? The standards should apply to the business."

In the past, small businesses have been able to protect credit card data on their premises by using secure, dedicated point-of-sale hardware and connections provided to them by banks or financial institutions. But as small businesses begin to explore methods of doing business online, they are also beginning to handle their own credit card data, noted Paul Cook, managing director at Barclaycard, the credit card arm of the U.K.-based Barclays Bank.

"That can be very dangerous, both for the small business and for its customers," Cook observed. "Those businesses need the equivalent of the bank-owned terminal for their Websites -- enough secure payment pages that they don't need to worry about securing the credit card data themselves."

Other panelists suggested small businesses rely more heavily on banks and third-party security services to handle the entire credit card purchase process; that way they don't ever end up handling large amounts of credit card data. "We'd like to take the responsibility for handling that data out of their hands," Cook said. In a presentation here earlier today, executives from McDonald's described a payment system that essentially achieves this goal, allowing franchises to accept credit cards without ever storing any credit card data.

Phelan suggested that small businesses take that idea one step further. "If you can reset your business model so that you're no longer subject to PCI requirements because you aren't handling credit card data at all, that's the best solution," he said. "That's not as crazy as it sounds -- there are ways to accept credit card payments without ever touching the data itself."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2227
Published: 2014-07-25
The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file.

CVE-2014-5027
Published: 2014-07-25
Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query parameter to a diff fragment page.

CVE-2014-5100
Published: 2014-07-25
Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to admin/users/add, (2) insert cross-site scripting (XSS) sequences via the api_key_...

CVE-2014-5101
Published: 2014-07-25
Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) TPL_name, (2) TPL_nick, (3) TPL_email, (4) TPL_year, (5) TPL_address, (6) TPL_city, (7) TPL_prov, (8) TPL_zip, (9) TPL_phone, (10) TPL_pp_email, (11) TPL_authn...

CVE-2014-5102
Published: 2014-07-25
SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.