Big risks for small businesses who ignore data security

Password through a magnifying glass Several tech firms encouraged people to change all their online passwords in light of the Heartbleed bug

The recent security scare over the Heartbleed bug should send shivers down the spines of most small businesses.

Technology of Business

There you are thinking all your online customer data is safe, thanks to popular open-source encryption software called OpenSSL, and it turns out to be anything but.

This small vulnerability has potentially compromised two-thirds of all websites.

"The main worry is for small e-commerce sites that do not know they have been affected," says Keith Cottenden, director at cybersecurity specialists CY4OR.

"Any business that takes customer details could be vulnerable because this encryption is designed to protect personal data… Businesses need to apply mitigation now."

But finding effective and affordable ways to keep "mission critical" data safe from hackers, fraudsters and natural disasters can be a daunting and difficult task for small firms.

Busted flush

Poor data security can literally ruin your business.

Bitcoin trader Kolin Burges MtGox's shutdown prompted anger among bitcoin traders

For example, weak security measures and alleged poor infrastructure brought Japanese Bitcoin exchange MtGox to its knees before it eventually went bust.

The exchange, which was handling about 70% of the world's bitcoin trades at its height, said 850,000 of the digital currency coins were stolen by hackers.

The company was forced to file for bankruptcy in February.

But in March, MtGox then said it had found 200,000 "lost" bitcoins - worth about £70m - in an old digital wallet dating from 2011.

When security is your business, such laxity is obviously disastrous.

The UK's Federation of Small Businesses (FSB) believes unchecked cybercrime is severely stunting the growth potential of its members.

Cybersecurity best practice

Firewall lock on main board, with a concept background
  • Implement antivirus, anti-spam, and firewall protections
  • Carry out regular security updates on all software and devices
  • Implement a resilient password policy (minimum eight characters, change regularly)
  • Secure your wireless network
  • Establish a clear security policy for email, internet and mobile devices
  • Train staff in good security practices and consider employee background checks
  • Implement and test back-up plans, information disposal and disaster recovery procedures
  • Carry out regular security risk assessments to identify important information and systems
  • "Stress test" websites regularly
  • Check provider credentials and contracts when using cloud services

Source: Federation of Small Businesses

The risk of fraud and online crime, both real and perceived, is costing each UK small business up to £4,000 per year, the FSB says, while cybercrime as a whole costs the UK economy an estimated £27bn a year.

About a third of FSB members have been victims of online crime over the last year, whether from virus infections, hacking attacks or other system security breaches.

As well as the financial loss and inconvenience, there is the potentially disastrous loss of customer trust.

Crime and complacency

Despite the critical importance of data security, many businesses appear almost oblivious to the risks.

A 2013 survey by security software firm AVG revealed that a large amount of data loss occurs simply due to human error and carelessness.

It seems many businesses are more concerned with tidying their desks or ordering new business cards than backing up data.

A reported 43% of UK and 53% of US small businesses said they spend more time changing passwords than backing up.

And about a quarter of them leave longer than a week between back-ups.

"Too many times an act of carelessness or a security breach has led to information going missing, and in some cases businesses have found themselves in a position where the data is non-recoverable," a Microsoft spokesman told the BBC.

Floods and fires

Natural disasters can pose just as big a risk to small firms as cybercrime.

An estimated 25% of businesses do not reopen following a major disaster, according to the Institute for Business and Home Safety, a not-for-profit organisation.

In 2012, Hurricane Sandy destroyed thousands of small businesses in the US, while many others still felt the effects at least a year after the event.

Hurricane Sandy damage Hurricane Sandy wreaked havoc along the East Coast of the US

Rob Cotton, chief executive of Manchester-based NCC Group, a data security firm, told the BBC that adapting good security practices can be difficult for small businesses.

"SMEs that are using their own IT services in-house need to consider the physical security of the equipment, as well as whether the IT is vulnerable to external threats," he says.

"It's also important to consider the risk from your own staff, since many incidents result from rogue employees - the so-called 'insider threat'."

Cloud all hot air?

Start Quote

Putting business-critical information in the hands of a third party demands a degree of trust”

End Quote Microsoft spokeman

A common piece of advice is to back up data securely and often, but should this be to locally stored servers or to remote cloud services?

"Cloud providers will generally be more proactive in terms of ensuring software is up-to-date and maintaining patch levels," says Mr Cotton.

"They will also have better security knowledge and awareness, meaning servers and services will generally be well configured. On top of this they are more resilient and most will have robust disaster recovery and continuity plans in place."

Another advantage of the cloud is that thieves won't necessarily know which service your business uses or where it keeps its servers.

But Mr Cotton admits there are certainly risks around adopting cloud services.

Cloud computing Using cloud services has several advantages but is no guarantee of keeping your data safe

One obvious one - often overlooked - is that the provider itself suffers a break in service or a breach of its defences, so it makes sense to interrogate the reputation and reliability of any cloud service provider very closely.

"Putting business-critical information in the hands of a third party demands a degree of trust," said a Microsoft spokesman. "Solid providers will explain their security methodologies and commitment to the business."

That said, a "belt-and-braces" local back-up plan may be a good idea.

Spread your eggs

Small firms need to protect their data against viruses, malware and natural disasters, as well as disgruntled or careless employees.

But how defences against these threats are implemented will depend upon the circumstances and nature of each business, experts say.

In finance, keeping all your eggs in one basket is rarely a wise idea, and the same applies to data. So for maximum security, spreading data around both traditional and non-traditional services seems to be the best policy.

Perhaps most importantly, the FSB stresses the need for education.

If your managers and employees don't appreciate the need to protect data, the whole future of your business could be on the line.

More on This Story

The BBC is not responsible for the content of external Internet sites

More Business stories

RSS

BBC Business Live

  1.  
    QATAR AND AIRBUS 10:59:
    Airbus A380

    Qatar Airways has taken delivery of its first A380 superjumbo, following a three-month delay, during which it wrangled with Airbus over cabin fittings. Airbus has also been trying to fix an issue with seals around the doors of the jet. Qatar will be the first customer for the Airbus A350 and Airbus says it will deliver the first plane by the end of the year.

     
  2.  
    UNEMPLOYMENT 10:46:
    A  general view of a Jobcentre Plus in Glasgow.

    The ONS data also shows the claimant count - the number of people claiming Jobseeker's Allowance - has fallen below 1 million for the first time since September 2008. It now stands at 966,500.

     
  3.  
    'SICK' FRANCE 10:36:
    Emmanuel Macron

    "France is sick," the country's new economy minister Emmanuel Macron has told French radio. He said France has no choice but to "reform the economy". Unemployment is currently at a record 10% and there's been no growth for two quarters. Meanwhile the government budget deficit is expanding. The Business live page wishes Mr Macron good luck.

     
  4.  
    UNEMPLOYMENT 10:14:
    Iain Duncan Smith

    Work and Pensions Secretary Iain Duncan Smith tells the BBC News Channel that pay in the financial services industry is distorting current average wage growth statistics. He says pay rises in the manufacturing industry are up 2% year on year. He also points out that food prices are coming down and inflation generally is falling.

     
  5.  
    Via Twitter Andrew Sentance, former member of Monetary Policy Committee

    tweets: "UK unemployment rate at 6.2% & still falling sharply. At current rate of decline it'll be <5% next summer - pushing up pay & inflation."

     
  6.  
    WAGE GROWTH 09:58:
    Hand and coins

    The ONS data shows average pay was 0.6% higher in the three months to July, compared to a year earlier. That's an improvement on the previous figure which showed a 0.2% decline. Pay excluding bonuses also rose slightly by 0.7%, the previous figures was 0.6%. Pay rises are still running well below the rate of inflation. On Tuesday data showed consumer price inflation running at 1.5% in August.

     
  7.  
    INTEREST RATES 09:35:

    There was no change in voting patterns at the Bank of England's Monetary Policy Committee at September's meeting. Two members voted in favour of raising interest rates to 0.75%.

     
  8.  
    UNEMPLOYMENT 09:32: Breaking News

    The unemployment total fell by 146,000 to 2.02 million in the three months to the end of July, official figures show. The Office for National Statistic said the unemployment rate for the period was 6.2%, down from the previous level of 6.4%.

     
  9.  
    EUROPEAN CAR SALES 09:27:
    The new body of the Volkswagen Passat

    Car sales across Europe rose for the 12th month in a row industry figures show today. They were 1.8% higher at 701,118 in August, from 688,464 a year-earlier the Association of European Carmakers (ACEA) says. Volkswagen, Ford and Opel all benefited from improved demand in Spain, Portugal and Ireland. But car sales in Germany - Europe's largest car market - were 0.4% lower.

     
  10.  
    INTEREST RATES 09:20:

    At 09:30 the Bank of England publishes minutes from the interest rate policy meeting in September. In August's meeting two members of nine-strong monetary policy committee voted to raise interest rates. Will others have joined them in September? Watch this space.

     
  11.  
    Via Twitter Kevin Peachey Personal finance reporter, BBC News

    tweets: "Hold music among biggest consumer service irritations says @WhichUK survey - any views on the most annoying?"

     
  12.  
    TECH SHARES ARE UP 09:04:
    imagination technologies

    Shares in two of Britain's most successful technology companies are sharply higher this morning. Imagination Technologies, which designs chips for mobile devices, has seen its shares jump 6%. That's after the company forecast a strong performance in the second half of the year. Fellow chip designer, ARM Holdings is leading the FTSE 100 higher with a 1.9% gain.

     
  13.  
    HEADLINES
     
  14.  
    MARKET UPDATE 08:34:

    Shares in London are higher in early trading with the FTSE 100 up 16 points

    • Smiths Group slumps 5.4% after sales fall
    • JD Sports up 2.7% following half year results
    • Pound slightly higher at $1.6296
     
  15.  
    SCOTTISH REFERENDUM 08:26: BBC Radio 4

    Former Bank of England Deputy Governor, Sir John Gieve says the Bank is "a creature of Westminster" and will be an adviser in any currency negotiations. "I think it could work, " he says of currency union but adds it "relies on careful negotiation". A lot of policy decision would remain in London, he adds. If the economies of Scotland and the rest of the UK began to diverge more than they do at present that could be a problem.

     
  16.  
    INTERNET OF THINGS 08:17: BBC Radio 4

    The Internet of Things is a phrase bandied around. ARM Holdings boss, Simon Segars is fresh from a conference about it - but it all sounds a bit pedestrian. Mr Segars says one example is a coffee cup that has a microchip in it that could tell you if you're consuming too much coffee. There is already a fork that can tell you if you are eating too quickly. On Today he also mentions apps that help you find a parking space.

     
  17.  
    JD SPORTS 08:11: Radio 5 live

    We're not far off being saturated with sports shops in the UK says Peter Cowgill, executive chairman of JD Sports on Radio 5 live. But the company is having "significant success" competing in Spain, German, France and the Netherlands.

     
  18.  
    PHONES 4U RESCUE 07:57: BBC Radio 4

    It is "perhaps not surprising" that Vodafone and EE are looking at buying parts of Phones4U now that it is in administration, says Laura Lambie of Investec Wealth and Investment on Today. Both EE and Vodafone had been approached by Phones 4U which tried to interest them in buying the retailer, she says. After refusing that approach, Vodafone and EE are now looking "to pick up assets on the cheap", according to Ms Lambie.

     
  19.  
    SONY PROFIT WARNING 07:50:
    xperia phones

    The profit warning at Sony is the result of a review of its mobile phone business. It says there has been "a significant change in the market and competitive environment". As a result, it has taken a £1bn charge to reflect the loss of value of the mobile business. It is reducing the number of models it produces and is concentrating on a premium lineup.

     
  20.  
    JD SPORTS PROFITS 07:36: BBC Radio 4

    "The high street is alive and well," says Peter Cowgill, executive chairman of JD Sports on Today. The retailer has a strong presence in shopping malls and online but Mr Cowgill says a high street presence is "still very important to JD Sports". The retailer has a contingency plan if Scotland votes Yes to independence. But he adds: "We don't think there will be a major impact on our trade. We think there will be no change to prices [if Scotland votes Yes]."

     
  21.  
    SONY PROFIT WARNING 07:32: Breaking News
    Sony office

    Sony expects to report a much deeper loss this year than originally forecast. The firm now expects a loss of 230bn yen (£1.3bn) for the year which ends 31 March. Its previous forecast was for a 50bn yen loss.

     
  22.  
    JD SPORTS PROFITS 07:29:

    Profits at retailer JD Sports doubled in the first half of the year. Before exceptional items it made a pre-tax profit of £19.9m. Sales at stores open for more than a year rose 13% from the same period a year ago. But its fashion business which includes Scotts and Bank had a "disappointing" first half, the company said.

     
  23.  
    INDITEX RESULTS 07:10:
    Zara store

    The world's biggest clothing retailer, Inditex has posted a 2.4% fall in first half net profit. The owner of Zara, made 928m euros (£738m). That was not as bad as some analysts were expecting. The company also said that sales for the start of the third quarter rose 10%.

     
  24.  
    SPACESHIP CONTRACT 06:56: Radio 5 live
    Space X Capsule

    Nasa has awarded up to $6.2bn (£3.8bn) to Boeing and SpaceX to develop space vehicles that can take crew into space. The firms are aiming to have their spaceships ready by 2017. Since the space shuttles were retired in 2011, the Americans have relied on Russia and its Soyuz vehicles to get to the International Space Station.

     
  25.  
    SCOTTISH REFERENDUM 06:38: BBC Radio 4
    Scottish bank notes

    Former Bank of England deputy governor Sir John Gieve tells the Today programme he expects Bank staff to be at work very early on Friday morning to try to calm markets, whichever way Scotland votes in the independence referendum. In particular, the Bank will be busying itself with the possibility of "deposit flight" so that "we don't get the sort of panic that there was with Northern Rock". That means for starters making sure that cash machines remain fully stocked.

     
  26.  
    ARM CHIEF EXECUTIVE 06:27: Radio 5 live
    Arm processor

    It's arguably Britain's most successful technology company, but you may have never heard of it. ARM designs computer chips and is worth almost twice as much as Marks and Spencer. On Wake Up to Money chief executive Simon Segars says most of the firm's customers are in California, China, Taiwan and South Korea. "It's a shame" there are not more technology companies in the UK, he says. People have been keener to go into financial services, Mr Segars says.

     
  27.  
    SCOTTISH REFERENDUM 06:16: Radio 5 live

    Whichever way the Scottish independence vote goes, the business impact "remains unclear" says Nora Senior, chair at Scottish Chambers of Commerce on Wake Up to Money. Big questions over currency, Europe, debt, pensions and tax were raised in the run up to the vote, she says. "Business wants a decision that is clear and swiftly executed," Ms Senior says.

     
  28.  
    BEREAVEMENT AND WORK 06:10: Radio 5 live

    A third of employees who have suffered bereavement in the past five years felt that they had not been treated with compassion by their employer, according to a survey by the Advisory, Conciliation and Arbitration Service (ACAS). It is launching guidance for companies. "Managers need appropriate training and support," said Sir Brendan Barber, ACAS chair on Wake Up to Money.

     
  29.  
    PHONES 4U RESCUE 06:00:
    Phones 4U sign

    The Financial Times is reporting that Vodafone and EE have approached the administrators of Phones 4U about buying parts of the failed business. Around 550 shops and 6,000 jobs are at risk. The private equity owners of Phones 4U and its founder, John Caudwell have blamed the aggressive tactics of EE and Vodafone for the collapse of the firm. Both network operators deny those accusations.

     
  30.  
    05:59: Matthew West Business Reporter

    Morning everyone. As always you can get in touch with us via email on bizlivepage@bbc.co.uk or twitter @bbcbusiness.

     
  31.  
    05:59: Ben Morris Business Reporter

    We'll get the latest unemployment figures and data on earnings at 09:30 this morning. Plus the Financial Times says that Vodafone and EE are looking to buy parts of their former customer, Phones 4U. Stay with us.

     

Features

From BBC Capital

Programmes

  • Cinema audienceClick Watch

    Brighter 3D films - the new laser-based system promising to deliver crisper, clearer movies

BBC © 2014 The BBC is not responsible for the content of external sites. Read more.

This page is best viewed in an up-to-date web browser with style sheets (CSS) enabled. While you will be able to view the content of this page in your current browser, you will not be able to get the full visual experience. Please consider upgrading your browser software or enabling style sheets (CSS) if you are able to do so.