Risk
12/19/2012
07:24 PM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%

Only 47% Of SMBs Ask Partners About Their Security Processes

nCircle-sponsored survey finds 61% of respondents share customer data with partners or vendors

SAN FRANCISCO, CA – – nCircle, the leader in information risk and security performance management solutions, today announced the results of a sponsored study commissioned by nCircle and conducted by Dimensional Research. In the study, over 240 small and mid-sized business participants were asked how they evaluate their business partners' security programs.

"Business partners and vendors can be a weak link in the security of sensitive business information," said Diane Hagglund, principal researcher at Dimensional Research. "SMB IT teams often have a level of confidence in their partners' security that hasn't been fully vetted."

Key study findings include:

61% of respondents said they share customer data with partners or vendors, 44% share financial data and 37% share legal information

80% say their organization is more effective at securing sensitive customer and business information than their business partners

Only 47% of respondents said they always ask business partners for details about their security processes before sharing confidential information

74% of respondents are confident or very confident that their business partners adequately protect their companies sensitive business information

"This study had some good news and some bad news," said Andrew Storms, director of security operations for nCircle. "It's encouraging that half of small businesses ask their business partners about security because it means more businesses are aware of the importance of their security. It's discouraging that 80% of participants believe their security is better than their business partners', but they continue to share customer data with them. Let's hope that greater security awareness means more detailed, actionable security requirements for partners are in the works. Better business partner security is everyone's responsibility."

The study is illustrated in nCircle's "Business Partner (In)Security" infographic. Interested parties have permission to embed and share the infographic on their websites or blogs with attribution.

For more information about the study, please visit: http://www.ncircle.com/index.php?s=resources_surveys_Business-Partner-Survey-2012

About nCircle

nCircle is the leading provider of information risk and security performance management solutions to more than 6,500 businesses and government agencies worldwide. nCircle solutions enable enterprises of all sizes to (1) automate compliance and reduce risk, and (2) measure and compare the performance of their IT security program with their own goals and industry peers. nCircle solutions may be deployed on a customer's premises, as a cloud-based service, or in combination, for maximum flexibility and value.

nCircle has won numerous awards for growth, innovation, customer satisfaction and technology leadership and has been ranked among the top 100 best places to work in the San Francisco Bay Area. nCircle is headquartered in San Francisco, CA, with regional offices throughout the United States and in London and Toronto. To learn how you can more effectively protect your company visit us at http://www.ncircle.com.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2003-1598
Published: 2014-10-01
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

CVE-2011-4624
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

CVE-2012-0811
Published: 2014-10-01
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files gene...

CVE-2014-2640
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2014-2641
Published: 2014-10-01
Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Chris Hadnagy, who hosts the annual Social Engineering Capture the Flag Contest at DEF CON, will discuss the latest trends attackers are using.