Endpoint
8/29/2013
12:07 PM
Doug Landoll
Doug Landoll
Commentary
Connect Directly
RSS
E-Mail
50%
50%

5 Factors Of Better SMB Security Software

Security software does not always play well within the SMB space

The complexity of information security threats, regulations, and risks to a small or midsize business (SMBs) can make the selection of security software a complex task in itself. Thankfully, there are a great many solutions available to address the confidentiality, integrity, and availability concerns SMBs have for their sensitive data and critical systems. Unfortunately, choosing the right one is not that simple.

To guide SMBs in the selection of security software, I have listed five factors to consider that not only helps to ensure that the software addresses SMBs' concerns, but also integrates effectively into the business.

1. Scalable: Mature security software has typically evolved to deploy into large organizations, integrate with other popular applications, and inherited functions derived from many customers over the years. If these same solutions cannot offer a model that scales (function and pricing) to the SMB, fitting these solutions into the SMB is typically more trouble than it's worth. Security solutions aiming to address the concerns of the small business need to have a pricing model that scales, without a high cost for administrative consoles or other required elements.

2. Simple: "SMBs investing in security software should focus on solutions that are easy to set up, configure, and maintain," says Mark Austin, CEO of Avecto. Using existing infrastructure and services, such as Active Directory, and avoiding the cost of additional servers are among the examples, Austin cites.

3. Integrated: Software solutions that take advantage of existing infrastructure (e.g., servers, Active Directory) provide additional value to SMBs. "Solutions that are configured through familiar management consoles, such as Group Policy, have a shorter learning curve than proprietary management consoles," Austin adds.

4. Automated Updates: Based on the changing threat environment and frequency of discovered flaws in deployed software, it is imperative that these solutions can be set to ensure updates are automatically applied. Updates need to affect not just the consoles, but software on user desktops as well. Consoles should be able to force desktops to update and provide reporting for instances that are out of sync with the current updates.

5. Intuitive Compliance: Last is the issue of compliance. Far too many software solutions boast "PCI compliant," "HIPAA/HITECH solution," and other claims without a reasonable explanation of what that means or assistance to get there. Software solutions that come with whitepapers or configuration guidelines that explain the regulation, what requirements this solution addresses, and how to configure the product to do so are in higher demand at SMBs.

Software solutions targeting the SMB market need to consider not only the functions of the software, but the five elements of software that make a good SMB solution: scalability, simplicity, integration, automation, and compliance.

Doug Landoll is the CEO of Assero Security, a firm specializing in SMB security. You can follow him on Twitter as @douglandoll Doug Landoll is an expert in information security for the SMB market with over 20 years experience securing businesses and government agencies. He has written several information security books and dozens of articles for national publications. He has founded and ran four ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5619
Published: 2014-09-29
The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which . is not a reserved name, which allows local users to hide activities it more difficult to conduct forensics activities, as demonstrated by Flame.

CVE-2012-5621
Published: 2014-09-29
lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connection with a party name that contains invalid UTF-8 strings.

CVE-2012-6107
Published: 2014-09-29
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2012-6110
Published: 2014-09-29
bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor.

CVE-2013-1874
Published: 2014-09-29
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.