Information Security Framework for Small and Medium Sized Businesses

2006-05-19 (Removed from collection 2006-11-21) Revised version reinstated 2009-06-17Information security issues are a challenge to everyone who uses computers. The rise of the personal computer as a common business tool and the Internet as a common means of business communication and commerce have also created an environment that criminals with technical knowledge can exploit to prey upon the less technically savvy. The cost of computer crime to business in the United States has risen to $67 billion according to the 2005 FBI Computer Crime Survey. Not a day goes by that a computer security exploit or identity theft scheme makes national headlines. The impact to small and medium sized businesses is tremendous. These businesses have the least amount of resources to use to help defend against hacker attacks and they suffer some of the largest net financial impacts when victimized by an attack. The good news is that there are some simple things a business owner can do to greatly reduce the risks of being victimized by an information security failure. Education and awareness of the most prevalent risks to business information and commonly exploited security holes can quickly close the door to a security incident. Just as with traditional burglary attempts, the computer criminals will first look for the path of least resistance when trying to break in to a computer system. If a door is unlocked, all the criminal has to do is walk right in. The problem with computer technology is that many people do not even know when the doors are unlocked. By raising awareness of the most common vectors of attacks against business computer systems, this field project seeks to help business owners better manage and protect their information assets. The computer risks and mitigation approaches outlined in this project will not completely eliminate all the computer security exposures that company can face in the 21st century business environment but they will help a business owner know what they can do to quickly reduce their risk exposure. Just like with any other type of crime, a determined criminal may eventually find some type of security weakness that can be exploited for illicit purposes. The goal of the business owner is to make the criminal’s work so hard that they look elsewhere to commit their crimes