The information security status of small-to-midsized businesses (SMBs) lags far behind that of larger firms, new survey results have revealed.
The preliminary findings of research conducted by Anas Tawileh, a Cardiff University researcher were revealed yesterday to delegates of the independent Information Security Solutions Europe (ISSE) conference being held this week in Madrid.
They revealed that, of the respondents responsible for IT security in companies of less than 250 employees in a variety of industries and geographies including the UK, only 47 per cent kept track of what information their IT systems handled.
Nearly half (46 per cent ) of large organisations said they had conducted a comprehensive impact assessment of the information they held in IT systems, compared to only 31 per cent of midsized and 24 per cent of small organisations.
Another area Tawileh highlighted was around data backups. While most SMBs were quite good at backing up their data, he said 85 per cent admitted to not testing that their backups were effective or how long it would take restore systems using them.
And half of the SMBs questioned said they do not assess the security status of personally identifiable information held by their systems, much as less confidential corporate data.
"The survey revealed more of a focus on maintaining the confidentiality of data and authentication of access than data integrity and non-repudiation, Tawileh said.He said this would be most relevant where smaller firms supply larger ones and have to comply with contractual security requirements, in line with the larger organisation's regulatory requirements.
"There may be less regulation for SMBs, but they need to think carefully about the threats to their businesses associated with disclosing a key customer's confidential data, as well as their own," he added.
"They need to start taking a more holistic approach to their security that encompasses all aspects, including the social and human, as well as technical,"
