Hackers are turning their attention from large corporations to small and mid-sized enterprises, as the prevalence of "DIY" malware tools makes it worthwhile for casual criminals to target smaller companies.
According to research carried out by Vanson Bourne for security vendor MessageLabs, opportunist hackers and cybercriminals are turning their attention away from large enterprises -- which tend to have good levels of IT security - towards smaller firms, which are less well protected.
In particular, MessageLabs has seen an increase in targeted phishing attacks, often based on information about companies or employees that hackers glean from social and business networking sites.
"Targeted attacks are at the sharp end of badness," said Mark Sunner, chief security analyst at MessageLabs. "These attacks are almost always dressed up as an Office document, probably from an email address you know, and often a document you are expecting. That document will activate a Trojan that goes on to target your systems," Sunner said.
Such attacks remain rare, but have increased dramatically over the past year. MessageLabs is seeing one targeted phishing attack per day, a tiny proportion of the 190m messages the company scans on a daily basis. Last year the vendor's networks picked up no more than two attacks a week.
SMEs are especially vulnerable, Sunner suggested, because they do not have the higher-level security systems maintained by larger companies, nor the in-house expertise.
Awareness of information security issues is also lower among smaller businesses' staff, Vanson Bourne found. The research singled out salespeople in particular for a lack of security awareness, because of their heavily reliance on communications technology as well as their working patterns.
"Salespeople are the power users of technologies such as email, VoIP, instant messaging and the web," said Sunner. "The salesperson used to be the road warrior, now they are cyber warriors, but security issues are almost certainly not top of mind for them."
However, trying to restrict the communications channels for people who are, in many companies, the main generators of company turnover, is often not a practical option. "It puts system administrators in a difficult position: if they are overly restrictive they risk cutting off their businesses' main source of income," Sunner conceded. Outsourcing security to a managed service provider, he added, would help SMEs keep up to date with the latest threats.
