Security Risk Management in IT Small and Medium Enterprises

Data breaches, security incidents and the threat landscape has been widely researched and documented. Different defence measures and policies, their effects and implications have also been researched extensively. However, most security research focuses on different sectors or on large companies. This research aims to map the prevalence of defence measures, policies and their use in small medium enterprises (SMEs) in a single industry (the IT service industry). Data is elicited by using a questionnaire. Results imply that SMEs indicating that their infrastructure is vital to the business, did not log access to their website, while SMEs indicating that their websites are unimportant did often log access. Therefore, SMEs are often not able to tell if they are victimized. Furthermore, the use of the cloud for file-exchange increases as opposed to the use of thumb drives. This trend introduces new security risks and allows attackers to access this storage via stolen mobile devices. Furthermore, the rampant use of pirated software and lack of enforcement of installation policies allow authentication details to be stolen rather easily. Those stolen details are a precursor for more targeted privilege escalation. SMEs reported theft of mobile devices, yet they did not have any policy or recovery plan concerning this matter. Most operating systems do offer remote wipe functionality to prevent escalation of this kind attack. This can be a cost effective solution and is presumably an easy-to-implement solution.