Endpoint
8/29/2013
12:07 PM
Doug Landoll
Doug Landoll
Commentary
Connect Directly
RSS
E-Mail
50%
50%

5 Factors Of Better SMB Security Software

Security software does not always play well within the SMB space

The complexity of information security threats, regulations, and risks to a small or midsize business (SMBs) can make the selection of security software a complex task in itself. Thankfully, there are a great many solutions available to address the confidentiality, integrity, and availability concerns SMBs have for their sensitive data and critical systems. Unfortunately, choosing the right one is not that simple.

To guide SMBs in the selection of security software, I have listed five factors to consider that not only helps to ensure that the software addresses SMBs' concerns, but also integrates effectively into the business.

1. Scalable: Mature security software has typically evolved to deploy into large organizations, integrate with other popular applications, and inherited functions derived from many customers over the years. If these same solutions cannot offer a model that scales (function and pricing) to the SMB, fitting these solutions into the SMB is typically more trouble than it's worth. Security solutions aiming to address the concerns of the small business need to have a pricing model that scales, without a high cost for administrative consoles or other required elements.

2. Simple: "SMBs investing in security software should focus on solutions that are easy to set up, configure, and maintain," says Mark Austin, CEO of Avecto. Using existing infrastructure and services, such as Active Directory, and avoiding the cost of additional servers are among the examples, Austin cites.

3. Integrated: Software solutions that take advantage of existing infrastructure (e.g., servers, Active Directory) provide additional value to SMBs. "Solutions that are configured through familiar management consoles, such as Group Policy, have a shorter learning curve than proprietary management consoles," Austin adds.

4. Automated Updates: Based on the changing threat environment and frequency of discovered flaws in deployed software, it is imperative that these solutions can be set to ensure updates are automatically applied. Updates need to affect not just the consoles, but software on user desktops as well. Consoles should be able to force desktops to update and provide reporting for instances that are out of sync with the current updates.

5. Intuitive Compliance: Last is the issue of compliance. Far too many software solutions boast "PCI compliant," "HIPAA/HITECH solution," and other claims without a reasonable explanation of what that means or assistance to get there. Software solutions that come with whitepapers or configuration guidelines that explain the regulation, what requirements this solution addresses, and how to configure the product to do so are in higher demand at SMBs.

Software solutions targeting the SMB market need to consider not only the functions of the software, but the five elements of software that make a good SMB solution: scalability, simplicity, integration, automation, and compliance.

Doug Landoll is the CEO of Assero Security, a firm specializing in SMB security. You can follow him on Twitter as @douglandoll Doug Landoll is an expert in information security for the SMB market with over 20 years experience securing businesses and government agencies. He has written several information security books and dozens of articles for national publications. He has founded and ran four ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2012-2588
Published: 2014-09-19
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

CVE-2012-6659
Published: 2014-09-19
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-3614
Published: 2014-09-19
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.

Best of the Web
Dark Reading Radio