We Are Failing With SMB Information Security

According to the U.S. Small Business Administration (SBA), there are 33.3 million small businesses in the United States, comprising by number 99.9 % of all U.S. businesses[1]. Many of these provide services for larger organizations. Small businesses, as defined by the SBA as approximately 500 staff or less, are essential components of the country’s economic system.

However, from my perspective, the information security needs for small and midsized businesses (SMBs) are underrepresented in our industry. As an example, the sessions and vendors at a typical information security conference seem mostly geared to large organizations with corresponding large budgets.

I work with small businesses daily. I also operate two. Small businesses have many of the same information security concerns as large corporations, much of which goes unaddressed, creating a significant risk.

Look at the Bank of America breach earlier this year. A third-party had a vulnerability leveraged to compromise Bank of America information assets. Does this sound familiar? It should because it’s not new. Those who have worked in the industry for some time will recall the Target breach in late 2013, which also began as exploiting a small businesses’ information security vulnerabilities[2].

Yet our usual conclusion is that third-party risk management failed. This is the common response, followed by TPRM vendors leveraging the most current supplier breach to showcase how their product would have likely prevented the loss of information.

Why do we ignore the root cause of the problem?

Small businesses not only don’t have the resources and expertise to identify and address information security concerns, but they also often prioritize such low. It’s understandable; they are trying to grow a business. Margins are tight, and personnel wear many hats. Most rely heavily on SaaS products, and often assume incorrectly because of this they are secure and have effectively transferred risk.

Larger organizations come knocking on the door with questionnaires to assure the security of their partners, who will inevitably answer the questionnaires in a favorable light. They need the business, and anything less than a great response risks revenue loss. The process stops, and down the line a breach occurs.

I’m not saying this was the case with Bank of America. What I’m illustrating is that the process failed with the introduction of the self-assessment questionnaire. The large business did nothing to help the small business’s information security posture. In fact, both parties likely didn’t care much. They both just wanted a completed, clean questionnaire.

This is backwards. Our industry needs to focus more on ensuring small businesses have a solid information security posture. There are resources available, such as CISA’s Cyber Guidance for Small Businesses[3], which while is an excellent base for securing small businesses, how many small business executives know, or care, about it? How many information security practitioners? How many industry associations?

I’ve been in IT and information security for over 30 years. It’s not hyperbole when I say I believe this to be a serious issue. On The Virtual CISO Moment podcast[4] I always ask my weekly guest what is the most significant risk to small business’ information security? The best answer I’ve received, which I agree with, is “bad advice” (I would add no advice as a part of that as well).

I want to help change that, drawing from my seven years’ experience as a virtual/fractional CISO practitioner. In future articles, I'll look closer at some ways we in the information security industry are failing small and midsized businesses and offer possible directions to consider to help solve these problems.

[1] https://advocacy.sba.gov/wp-content/uploads/2023/11/2023-Small-Business-Economic-Profile-US.pdf

[2] https://www.commerce.senate.gov/services/files/24d3c229-4f2f-405d-b8db-a3a67f183883

[3] https://www.cisa.gov/cyber-guidance-small-businesses

[4] https://vcisopodcast.net/