Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

10/17/2019
03:00 PM
Connect Directly
Twitter
RSS
E-Mail

State of SMB Insecurity by the Numbers

SMBs still perceive themselves at low risk from cyberthreats - in spite of attack statistics that paint a different pictur
6 of 8

Where the Gaps Are

Lack of personnel and budget translate to some very big gaps in security coverage at SMBs. According to a report by VansonBourne on behalf of Continuum Managed Services, approximately 56% of organizations do not have any cybersecurity experts within their organizations, and 52% lack an incidence response plan in the event of a cybersecurity attack. Just over half of organizations do not have cyber insurance, either.

Image Source: "The State of SMB Cyber Security in 2019," VansonBourne/Continuum Managed Services

6 of 8
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Franois Amigorena
50%
50%
Franois Amigorena,
User Rank: Author
11/4/2019 | 5:55:33 AM
The business benefits for IT security in SMBs
SMBs that grasp the business benefits are often further ahead. They understand that any competitor can nowadays quickly adopt a new technology to gain new capabilities, improve efficiency and/or reduce costs. However, each new application does create a need to secure users, data and the environment that the solution integrates into. Those that treat security as an onerous requirement that is invoked each time a new technology is contemplated will be slow to adopt – and slow to profit from – new efficiencies.

SMBs that build effective IT security frameworks are able to move more quickly and surely than their competitors. Environments without effective IT security solutions will have difficulty innovating and are likely to fall behind more nimble competitors.
FLYING J3
50%
50%
FLYING J3,
User Rank: Apprentice
10/21/2019 | 4:02:59 PM
Re: cyber risk change hits small biz
If your a contractor with the DOD they are going to be requiring you to have a Cybersecurity Maturity Model Certification sometime in 2020. Because they are forcing this, Cybersecurity is going to be an alowable cost on new contracts sometime in mid to late 2020. .
blackjack0021
50%
50%
blackjack0021,
User Rank: Apprentice
10/21/2019 | 1:33:44 PM
cyber risk change hits small biz
As long as Security expense is optional then most SMB can't afford to add it. The market doesn't let them charge more if they do, and competitors will always run the risk or cut corners and costs. As Bruce Schneir points out in Click Here To Kill Everyone, if the cost of security measures isn't required of everyone then the market actually penalizes you for doing it. Customers of SMB especially have no way to know if your company is doing it right or better. There is no competitive advantage. It's a proverbial Catch 22. I've done consulting for SMB, super small <10 people up to midsize I'd guess around 2000, but I'm an enterprise guy mostly. There is a special focus for SMB on free- or low-cost solutions that is almost alien to most enterprise people. It just presents many different challenges.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM &amp;amp; Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.