While reflecting on enterprise scale security program, I had this question if small scale businesses benefit at all from an ad-hoc security testing?

What are some suggestions that will solve the security problems in a small organization where human resources aren't available compared to that of an enterprise scale?

  • I'm not sure that the title of your question and your question match. It sounds like the title should be What are good strategies to manage a security program in a small, resource limited, business? – Neil Smithline Sep 9 '15 at 22:43
  • @Neil Smithline the entire question revolves around the concept of ad-hoc security testing and if these random test could be of any benefit to small organization. The latter if human resources are limited or not, depends. Since the project is in build phase, I would be less worried about extra staffing for this. – Shritam Bhowmick Sep 9 '15 at 22:47

I would argue that any testing is better than no testing. The problem with ad hoc testing is it runs the risk of creating a false sense of security or is not targeted at the right level. The business feels it has overall increased security due to the ad hoc testing. This may be true, but at the same time, due to the nature of this type of testing, it is quite possible that a major security hole has not been identified.

Security for small business is extremely difficult. In addition to the lack of staff resources available to perform the work, you frequently have a low level of security awareness as well. Getting basic technical configurations right is relatively easy compared to ensuring the users of the system are informed and don't do silly things, such as click on bad links in suspicious emails. It really doesn't matter how much testing of the software and infrastructure you have in place if one of the users is going to accidentally bring malicious code into your network and bypass all your measures put in place to protect the systems.

One of the largest challenges in small businesses is getting the owners to realise that information technology investment is different to other infrastructure investment. When you invest in new physical assets, such as a building, updated furniture and fittings etc, once that investment is paid for, you normally won't need much on-going investment/maintenance. With IT infrastructure, the on-going maintenance and need for on-going investment tends to be much higher. Too often, small business think they can buy a server, possibly pay someone to develop a little bit of specialist software and their done. They fail to recognise the on-going investment required to ensure the server is patched and up-to-date, the maintenance for the simple bit of software to ensure it stays current, is compatible with later versions of supporting software and operating systems and is patched against evolving threats etc.

My approach is to actively discourage small businesses from running infrastructure where possible. I encourage small businesses to take advantage of SaaS and cloud services. As far as possible, limit what IT they are actually responsible for maintaining to the absolute minimum. This can be a challenge as they don't understand all the hidden costs - it looks cheaper to do it yourself. You need to expose the hidden costs to allow them to make a fully informed decision and ensure this includes some basic regular testing/checking, reliable automated backups etc and ensure there is a plan for when things fail. The plan needs to include how to recover from the failure i.e disaster recovery as well as how to continue business while you are recovering i.e. business continuity.

In those situations where the business has no choice other than to run/develop their own software, look for solutions which will limit their need to invest in security. For example, a hosting provider where the hosting company takes care of hardware and operating system security and the business only needs to worry about application security. Work to help the business develop procedures which facilitate good practices and understanding of the risks and try to ensure these actually reflect the real risks faced by the business (rather than just implement good practice, assess the risks specific good practice is designed to protect against and determine if that really is a risk for that business) and recognise you cannot eliminate all security risks - there is never enough resources. You need to identify exactly what the real risks are for the specific business and prioritise them so that whatever resources are available for ad hoc testing are targeted at the highest priorities. Clearly communicate the risks which are not being addressed and what their likelihood and consequence is so that the business can make an informed decision as to whether they need to invest in additional resources.

  • I have learned that the overall ALM process cost is more heavy on maintenance. Your point makes it very clear that how much cost weight-age has to be distributed. But if you advice on cloud or SaaS security services, are these services largely not automated already where the manual touch is left out of the equation? – Shritam Bhowmick Sep 29 '15 at 19:32
  • The biggest challenge with cloud and SaaS is that quality and the effectiveness of their security and maintenance varies greatly. This means such services must be evaluated individually and you need to be very careful about assuming their maintenance and security practices are adequate. This is a real challenge for smaller businesses - how to they get the resources or skills to be able to make this assessment? To some extent, despite the growth, much of the cloud offerings are still a little 'frontier' or 'wild west' in nature. It is good to have a healthy dose of skepticism when assessing. – Tim X Sep 29 '15 at 21:49
  • exactly, it's never clearer if services which are provided are 'assured for effectiveness' to the security program or eventually a greater risk in security investments without knowing the direction. I think a better part of the process could be to integrate security right from the SDLC phases as small businesses could that way know their requirements and map to the compliance they would have to choose. Now, when we reach to this point, most SaaS services deprive away from any particular compliance or how should one get 'assurances' if any such compliance were followed? – Shritam Bhowmick Sep 30 '15 at 10:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.