SMEs still failing on security

Less than a quarter of small and medium sized enterprises see IT security as a priority, with many underestimating the increased risks that could result from the worsening economic climate, according to new research released today by network security firm GFI Software.

The firm found that IT security came way down in sixth place on the top ten list of priorities, behind buying new laptops, desktops and peripherals, with 37 per cent saying they see security as an area of minimal investment that could be cut if necessary.

And while many think they are up to speed with security, most of those surveyed displayed a worrying ignorance about emerging internal threats.

"People are fixing the things they know about - anti-virus, anti-spam, firewalls and so on - thinking 'I've done IT security', but ... they are not focusing on what happens internally," said Guy Washer, managing director of Redshift Research, which carried out the report.

"Only 45 per cent have the means to prevent USB network access, for example."

However, that figure could be even lower, according to some. Tony Brown, technical director of IT support firm Phillips Taylor Brown, argued that in his experience the figure is more likely to be five to ten per cent.

He added that it's a constant struggle to get small firms to take security seriously, with most neglecting more than the very basics, unless they are hit with an attack. "If they're not pushed, smaller firms will fight it all the way," he argued.

Less than half of the respondents surveyed said they thought the recession would change the types of threats they'd face.

But Phil Bousfield, vice president of product engineering at GFI, argued that the recession could greatly increase the insider threat, as sacked employees seek to hack their former employers.

"If people are made redundant their attitude to the company changes and they will steal stuff," he warned.

Bousfield added that during a recession there is a greater imperative on small firms to monitor productivity through web filtering technologies.

"Web borne viruses are one thing but the biggest driver is people surfing to undesirable places - it's the work of 20 minutes, all you need is some simple web filtering."