Risk mitigation is everyone's business, and SMB IT is uniquely positioning to manage reliability, privacy, and cyber-risk. In most SMBs, IT's role is to provide users with fast and reliable connections to needed systems and data. Increasingly IT is expected to prevent leakage of sensitive information that could harm the business or its customers. A global survey conducted by leading research firm Techaisle found that security solutions (cloud and mobility) are seen as a top IT priority by 75% of SMBs.
There is evidence of the enormous requirement for the defense of an ever-expanding perimeter – but if anything, it understates SMB's focus on cybersecurity. SMBs have deployed, and continue to deploy, increasingly-sophisticated shields to protect against the relentless advance of threat sources attacking businesses of all sizes through their cloud instances, mobile devices and connected users, and new technologies (such as IoT) and core networks and systems. SMBs (and the managed services suppliers they work with) are responding by developing better internal processes and deploying IT security solutions that are frequently enhanced by advanced features rooted in analytics and AI.
Defense against cyber-threats requires a comprehensive approach that spans people, process, and technology: appropriate systems need to be deployed, configured, integrated and continuously upgraded, processes – particularly related to the management of sensitive data – need to be established and embedded in work routines, and staff (all users, including IT) need regular and relevant training. A gap anywhere in this continuum will leave openings that intruders can exploit.
And as daunting as a defense against cyber-risk may be, the reality is that IT's role in ensuring information and infrastructure integrity is extending into other vital areas as well. With businesses now reliant on technology for most tasks' performance, IT must deliver continuous access to systems and safeguard data against loss. And in most environments, it is expected that IT will play a meaningful role in maintaining the privacy of sensitive data. In today's SMB, the IT leader is responding to multiple risk management demands.
SMBs typically start with basic endpoint/user security technologies – and many stop there as well. Even organizations that deploy additional 'shields' often shy away from taking the next step beyond trying to prevent a breach: assuming that a breach will occur and developing processes and deploying technologies needed to minimize the resulting damage and exposure. Some experts also point out that many firms – SMBs and enterprises – don't fully understand their devices (including back-end infrastructure, user devices and sensors), access points, applications, data, and system users. Building this inventory is an essential step in understanding the scope of potential exposure to breaches or losses.
Deployment of security technology will be an ongoing challenge as SMBs attempt to identify, budget for, deploy, integrate, and operate the security shields that are most important to their businesses' operations. In many cases, access to skilled professionals is the most tricky part of this equation. In this environment, SMBs struggle to attract and retain capable security staff members. Increasingly, this is leading to the use of managed security services: Techaisle's global survey shows that managed security, currently used by 29% of SMBs, is in the plans of an additional 44% of small and medium businesses – which will result in a 152% increase in the use of managed security services.
Privacy is a component of many different SMB business responsibilities: it is critical to compliance, and as a result, to senior executives and shareholders; it is a crucial issue for legal advisors; included in statements made by marketing; and of course, concerning data, it is assumed to be something that is managed by IT. Privacy is a cross-functional responsibility. Sensitive data needs to be classified as such and prioritized for the highest-level security; the security may be an IT function, but the classification needs to be done by the business leaders closest to the inputs and implications of disclosure. Leaks are very often the work of insiders rather than anonymous external hackers. Here, too, while IT plays a role (through monitoring technologies and systems that look to prevent data exfiltration), HR and business unit managers also need to be proactive in preventing privacy breaches.
Security – both the technology and the skills needed to optimize security systems and keep them current, integrated, and complete – is one of IT's most complex areas. To address these complex (and related) issues, SMB IT is needing to develop a portfolio of security technologies and skills that is equal to the task of defending against cyber-threats; develop and continuously execute on business continuity plans; deploy network and access technologies that are aligned with user needs; implement training approaches and management processes that reduce the risk that human error (or malfeasance) will bypass the SMB's technology shields.
They cannot do it in isolation. There is no 'silver bullet' that SMB executives can use to deliver a failure-proof, future-proof approach to risk management. However, by connecting security, privacy, and reliability/continuity – by working with the right suppliers who understand business requirements – SMB IT leaders want to make a real difference to their organizations' regulatory compliance, customer trust, and bottom-line success.
