Business Security Information

Businesses just like yours spend time, money and energy every day trying to protect their assets from a variety of security issues.  How do you know if you are expending that time, money and energy covering the right security issues?

This month I came across a survey of security directors from a variety of companies that covered the major security issues they face and the cost of security incidents when they did occur.  I will highlight some of that information in this article so you can see the type and cost of a variety of security issues.  You can use this information to evaluate if you are addressing the right security issues in your own business.  Here is the list of security issues based on the highest annual dollar losses to the lowest dollar losses:

When most companies think about disaster planning, a variety of thoughts come to mind.  Some businesses I have dealt with think about preparing for a natural disaster or a fire while others think about nothing but planning for an IT or network outage.  For the purpose of this article, I am referring to the planning for and recovery from a disaster.  This definition encompasses more than just the planning and recovery of IT services, infrastructure, data (information) and other technology resources of a company.  Disaster planning must include preparing for and recovering from the loss of human resources, such as key employees of a business, and other essential resources that allow a business to function.

A couple of months ago I was having a discussion with a contractor who had thousands of dollars worth of tools and equipment stolen.   I was discussing with him different ways to make improvements to security so that he would be less likely to experience some of the large security losses he had suffered.  One of his comments was that he had a $1000 deductible with his insurance company so he would never spend any more than that to improve security.   I realized then that a lot of businesses really feel that security is just a waste of time and money.  In this short article, I am going to share some of the reasons security should be thought of as an investment and not a waste.

While trying to catch up on some of my reading this week, I came across an article from the December 14, 2009 edition of Forbes magazine which discussed computer-controlled vending.  A vending machine is equipped with an add-on box which captures all the transactions and transmits the information back to the company.  The boxes can also send an e-mail or text message when a vending machine sells out of an item.  This type of electronic device saves the vending company money in lower fuel costs and more efficient use of their manpower.  If you are interested in learning more, you can check out the website for Cantaloupe Systems .

I have written numerous articles covering the different elements and aspects of security, but one issue I have never touched on is the importance of having quality information to make good security decisions for your business.  Quality or complete information is key to any business decision including security issues, but most businesses fail to track security incidents or issues at their company.  I have worked with a lot of small and medium-sized businesses over the years, and I have not run into one yet who does.

Before I start this article, I want to say this is strictly an opinion piece and may not be directly related to the emphasis of this site which is security for small and medium sized businesses.  I do think the basic premise of the article will be relevant to any business, not just a company that has ships on the high seas.

What are Insiders?

I have read a number of articles related to the security issue of insider threats over the past month or two and thought it would be a good idea to cover that issue in one of my posts.  First, what is an insider–just an employee or more than that?  Insiders are more than just employees or staff and can include consultants, vendors, contractors, service providers and other that you deal with on a regular basis.  Insiders are dangerous because in your dealings with them, you have  probably given them access to your company’s network and/or business facilities.  This opens you up to all kinds of threats.

As a business owner, you must sometimes ask yourself this question when talking to an employee and maybe at times when talking with a customer.  How can you know if you should investigate further or if you should trust that gut feeling you get sometimes?  Well, Carolyn Finch recently had an article in CSO (Chief Security Officer) magazine covering body language and how to use it when looking for signs that someone is lying.

On this site I cover physical security, computer security and fraud (on and off-line) issues.  When I read a recent survey report from Panda Security regarding small and medium-sized businesses, it made me take a look at the number of articles I have written for each of those categories.  I found that I have written more articles covering computer security and fraud issues than I have physical security issues.

I have written about PCI Compliance in a previous article and will not repeat that information here, but I did want to discuss the issues of PCI Compliance related to a recent data breach at Network Solutions.  If you have not heard anything about this particular case, the incident occurred on March 12th of this year but was not discovered until July 13th.  Approximately 573,928 credit card accounts were compromised in this attack.  Currently, it appears that it was an outside attack.