-4

We are in the process of updating our IT infrastructure and part of this will be a security review. I want to make sure we review every relevant security point.

So, what are all the IT security concerns a small business should address?

Assume the business has a typical network, fileserver, backup drives, internet access, company email, wifi, and all manner of software.

To keep this focused, please just list concerns and not remedies.

Also, since the list of potential vulnerabilities is huge and ever-changing, one need not list all vulnerabilities in a single answer.

closed as too broad by Steffen Ullrich, Robert Mennell, Mike Ounsworth, Tobi Nary, Ulkoma Apr 20 '16 at 23:02

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • It would be very helpful if those down-voting the question explained what they didn't like. I'm happy to edit the question into compliance. – Dave Apr 20 '16 at 21:40
  • 1
    Flagged as too broad. Really with ANY company the security concerns are the same. The scale of attack and threats is what changes. Someone could just as well attack your small business as much as a fortune 100. In fact you need the same type of security in both places for IT since all of the same problems that exist for big business exist for small businesses IT. – Robert Mennell Apr 20 '16 at 21:40
  • I added this below: "What are all the IT security concerns of a small business?" You asked people to enumerate all of the security concerns, but then state that there's no need to list every vulnerability in one answer. There's no way that we can enumerate all security concerns in a single answer. There's supply chain, there's contractors, there's ... I would recommend having a professional risk assessment done for your specific circumstance. – h4ckNinja Apr 20 '16 at 21:45
  • OK done. We are having a professional assessment done, but I don't like putting all the eggs in one basket. – Dave Apr 20 '16 at 21:47
  • 1
    The problem is that we don't know your business. Do you manufacture products? Who is in your supply chain? Do you use contractors for your IT? Managing your HVAC? Finances? Do you have food delivered for your employees? Do you have sensitive contracts? We don't know, so there's no way we can know the security posture of your existing infrastructure, nor do we know what you are trying to change. – h4ckNinja Apr 20 '16 at 22:05
1

You are asking for a comprehensive list of security concerns that a company might face. This question is way too broad to be answerable because security is a huge and ever changing field. That said, I'll try to give an answer that at least introduces the size of the problem.

Just thinking about software for the moment - you should start your security review by listing every operating system (including version and patch number) that you're running in your company. Now list every piece of software that's running (Including version and patch number), now look up that entire list on https://cve.mitre.org or elsewhere for known vulnerabilities against those versions of those softwares. Now what about patching: do you have procedures in place to make sure your software stays up to date? What about configurations: have you introduced any vulnerabilities because of the way you've configured your software? (Active port scans and things can detect some of these problems, but not all). Anyway, the list goes on...

And that's just software. You should do similar things for hardware (ex. telephone and network routing equipment), physical access (ex. which rooms contain sensitive info? What are the door locks like? Who has access? Do you log or record who enters? etc), and people (ex. what security training do you provide your employees? Do you have checks-and-balances in place?).

Finally, I'll address your point that you're a small company. The only way the above differs for a small company compared to a Fortune 500 is in the amount risk: the amount of effort that you expect an attacker to spend on you, and the amount of the damage if there is a breach, and the complexity of an audit: bigger companies just have more machines, people, and data to secure

-3

Viruses and malware

Whether from malicious emails or websites, employees may unwittingly download something nasty. This can do something as harmless as serving up unwanted ads, or something extremely costly like encrypting everything on your network and demanding a fee to de-encrypt it (ransomeware).

Less likely but still a concern, malicious code may be introduced by hardware. For example, an employee might bring in an infected USB stick and introduce a virus that way.

edit: This is only one of many vulnerabilities! I put it in as an example of the type of answers I'm looking for.

  • There is much more: part of IT security are also data security (backups!), restricting access to information, stealing of credentials and other kinds of identity theft (phishing...), Web 2.0 attacks like CSRF or XSS, ... – Steffen Ullrich Apr 20 '16 at 21:35
  • What about malicious users within the company? No viruses or malware required to seriously trash things. – Simon B Apr 20 '16 at 21:37
  • It's only a partial answer, just as an example! There's no need to list every vulnerability in one answer. – Dave Apr 20 '16 at 21:38
  • 1
    "What are all the IT security concerns of a small business?" You asked people to enumerate all of the security concerns, but then state that there's no need to list every vulnerability in one answer. There's no way that we can enumerate all security concerns in a single answer. There's supply chain, there's contractors, there's ... I would recommend having a professional risk assessment done for your specific circumstance. – h4ckNinja Apr 20 '16 at 21:44
  • 1
    I have to agree with Micheal. Things change so drastically from theater to theater that the play is never the same, and it is never simple. – Robert Mennell Apr 20 '16 at 21:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.