03/ 12/ 2002
by Michael Grebb
Even as the horror of Sept. 11 continues to fester in the national psyche, Americans are beginning to go about their lives again. For small businesses, many of whom were hit the hardest by the economic downturn that followed the attacks, this crawl back to normality has been encouraging but also slow.
While the new war on terrorism tends to focus on securing physical buildings and public spaces, small business owners should also take the opportunity to look at securing more intangible assets: computer networks. After all, if hijacking a few planes could devastate the airline industry and throw the economy into a downward spiral, imagine what a coordinated cyberattack could do to a business community utterly dependent on the Internet and computer networks.
And even if organized terrorists never attacked cyberspace, random attacks--whether malicious or mischievous--can be just as devastating. The recent "Goner" virus disrupted global corporate networks for days in November and was conceived by a few bored teenagers. "The biggest threat is the sheer number and growing sophistication of the attacks out there," notes Tom Turner, director of marketing at network security firm OKENA. "It's a big enough headache for large companies. Small businesses may feel that they're under the radar, but they're as prone as anyone to these random attacks." Turner says that studies suggest most IT budgets devote only 5 to 10 percent to network security. "It should be 20 to 30, or even higher," he says.
That's easier said than done, of course. Large corporations have multi-million dollar IT budgets with much devoted to security, but small businesses often hit their budgetary ceiling before they've even bought mousepads. Just the same, there are a few things that small businesses can do to fit security into the overall picture:
- Don't splurge buying fancy computers and software unless high-end equipment is an absolute must to compete. Buy or lease lower-end models and use the extra money to buy firewall software.
- Consider hiring an outside network security firm, which may be cheaper than you think. "Protecting data does not have to break the bank," says Michael Wheeler, CEO of Mindshift Technologies. "Quantify the data that's important to your business. Then examine all of the costs associated with protecting it." At the very least, back up data often (daily, if possible) to make sure you can recover it if a virus or cyberattack corrupts your database.
- Buy affordable virus protection software (often bundled into firewalls) and assign someone to update it frequently, at the very least. Furthermore, stress to all employees that they should NEVER open attachments unless they came from a trusted source.
Of course, the best course is to get outside help if you can afford it--and that doesn't mean waiting for the next big virus to hit and then frantically dialing security firms out of the yellow pages. If the attack is widespread, they will already be busy with other clients. "Contingency planning is usually not a primary focus for a small business until a worst-case scenario occurs," says Wheeler. "But by then it's too late." If Sept. 11 taught us anything, it's to always be prepared.
Grebb is a Washington, D.C.-based writer who focuses on technology and Internet issues.
This article originally appeared in the February/March 2002 issue of MyBUSINESS Magazine.
