Attacks/Breaches
3/19/2009
05:53 PM
50%
50%

Small Business: The New Black In Cybercrime Targets

Enticed by poor defenses of mom-and-pop shops, hackers turn away from hardened defenses of banks and large enterprises

WASHINGTON, D.C. -- Visa Security Summit 2009 -- Hacking banks and large businesses? That's sooo 2008.

Hackers and computer criminals this year are taking a new aim -- directly at small and midsize businesses, according to experts who spoke here today at Visa's annual security event. The consensus: Smaller businesses offer a much more attractive target than larger enterprises that have steeled themselves with years of security spending and compliance efforts.

"As the security becomes better at large companies, the small business begins to look more and more enticing to computer criminals," said Charles Matthews, president of the International Council for Small Business, in a panel presentation here. "It's the path of least resistance."

Matthews quoted industry research that states small businesses are far less prepared to defend themselves against cyberattack. "Nearly one-fifth of small businesses don't even use antivirus software," he said. "Sixty percent don't use any encryption on their wireless links. Two-thirds of small businesses don't have a security plan in place. These numbers are both surprising and disturbing."

And many small businesses still don't know they are targets, according to Chris Gray, director of innovation policy at the Canadian Chamber of Commerce and another member of the panel. "According to a brief survey we conducted, about two-thirds of small and medium-sized businesses believe that large companies are the main target for cybercrime," he reported. "Yet 85 percent of the fraud we see in business occurs in small and medium-sized businesses."

David Hogan, senior vice president and CIO for the National Retail Federation, who spoke on a separate panel at the summit, said only about 60 percent of Level 3 businesses -- the level just above the mom-and-pop shops -- have met the Payment Card Industry's Data Security Standards (PCI DSS) for protecting credit card data. Compliance at Level 4 " the smallest businesses -- is generally believed to be even worse.

So with all of the hoopla surrounding PCI compliance -- not to mention numerous public breaches disclosed in the news and retail trade media -- why aren't more small businesses paying attention to security? The key problems are a lack of resources and time, according to Merrill Phelan, manager of IS and programming for the Washington Metro Airport Authority, a Level 2 merchant.

"You really have to work hard to maintain PCI compliance," Phelan said. "And although PCI all makes sense on paper, sometimes it seems like the security standards written for Fort Knox -- do we really need all of those requirements for a small business? The standards should apply to the business."

In the past, small businesses have been able to protect credit card data on their premises by using secure, dedicated point-of-sale hardware and connections provided to them by banks or financial institutions. But as small businesses begin to explore methods of doing business online, they are also beginning to handle their own credit card data, noted Paul Cook, managing director at Barclaycard, the credit card arm of the U.K.-based Barclays Bank.

"That can be very dangerous, both for the small business and for its customers," Cook observed. "Those businesses need the equivalent of the bank-owned terminal for their Websites -- enough secure payment pages that they don't need to worry about securing the credit card data themselves."

Other panelists suggested small businesses rely more heavily on banks and third-party security services to handle the entire credit card purchase process; that way they don't ever end up handling large amounts of credit card data. "We'd like to take the responsibility for handling that data out of their hands," Cook said. In a presentation here earlier today, executives from McDonald's described a payment system that essentially achieves this goal, allowing franchises to accept credit cards without ever storing any credit card data.

Phelan suggested that small businesses take that idea one step further. "If you can reset your business model so that you're no longer subject to PCI requirements because you aren't handling credit card data at all, that's the best solution," he said. "That's not as crazy as it sounds -- there are ways to accept credit card payments without ever touching the data itself."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.