• No results found

2012 Endpoint Security Best Practices Survey

N/A
N/A
Protected

Academic year: 2022

Share "2012 Endpoint Security Best Practices Survey"

Copied!
9
0
0

Loading.... (view fulltext now)

Full text

(1)

Key Learnings for Small and Medium Businesses

2012 Endpoint Security Best Practices Survey

Who should read this paper Who should read this paper

Small and medium business owners and IT administrators

WHITE PAPER:2012 ENDPOINT SECURITY BEST PRACTICESSURVEY. . . .

(2)
(3)

Content

Introduction . . . 1

Doing the bare minimum—No longer an option . . . 1

Findings from the Symantec 2012 Endpoint Security Survey . . . 1

Bottom tier: 80 percent of physical endpoints left vulnerable . . . 1

Top tier: Nearly all physical and virtual endpoints secured. . . 2

Best practices to thwart a cyber attack . . . 3

Summary recommendations . . . 4

2012 Endpoint Security Best Practices Survey

Key Learnings for Small and Medium Businesses

(4)

Introduction

A perfect storm is brewing for small and medium businesses (SMBs). Just as cybercriminals are becoming more sophisticated, they are turning to traditionally less protected SMBs. At the same time, lawmakers are requiring all businesses to protect their customers’ sensitive data—regardless of size—and they’re enforcing those requirements with stiff penalties.

To make matters worse, SMBs have a slightly higher risk of data breaches resulting from employee negligence or maliciousness and are more vulnerable to the fallout from a serious data breach than a larger enterprise. According to the recent survey, "The Human Factor in Data Protection," a report released by Ponemon Institute, SMB employees were more likely to engage in "risky" behavior than enterprise employees. In fact, 58 percent of them will or have already opened attachments or Web links in spam, versus 39 percent from enterprises;

and 77 percent will or have already left their computer unattended, compared with 62 percent from their enterprise counterparts. The survey also found that more than half (55 percent) of SMB employees were likely to visit off-limit websites, compared with 43 percent of enterprise employees.1

The inherent cost of a breach can be quite high to an organization, with fees assessed according to the number compromised records. With hundreds of records often affected in a security failure, the numbers add up quickly. SMBs experiencing a breach can be faced with hiring IT consultants to repair affected endpoints; loss of sensitive company or customer data; and damage to the organization’s brand and

reputation. And don’t forget to factor in the cost of anxiety. Business owners can’t focus on the business when they’re worried about Internet security. This white paper outlines some of the endpoint security best practices employed by security-conscious organizations today and some of the pitfalls to avoid when assessing the security practices for your organization.

Doing the bare minimum—No longer an option

It’s becoming abundantly clear that SMBs can’t afford not to invest in cybersecurity solutions to protect their own and their customers’

sensitive data. Traditional antivirus software is no longer enough. To keep computers, employees, and data safe from cybercriminals, SMBs need fast, effective, and reliable threat detection technologies that can be deployed to an increasing number of devices in the workplace.

Once restricted to PCs on the desktop and servers in the data center, endpoint protection now extends to laptops, smart phones, tablets, virtual servers, and virtual desktops.

Findings from the Symantec 2012 Endpoint Security Survey

The Symantec 2012 Endpoint Security Best Practices Survey reveals how enterprise IT departments are coping with endpoint security and provides insight to how SMBs might follow suit. Based on the safeguards, policies, and procedures the surveyed organizations employed, Symantec divided the businesses into three tiers of preparation, and compared the organizations in the top tier with those in the bottom tier.

No surprise—organizations employing best practices are enjoying dramatically better outcomes, and many of these best practices can and should be leveraged by SMBs.

Bo

Bottom tier: 80 percent of ph ttom tier: 80 percent of physical endpoints lef ysical endpoints left vulnerable t vulnerable

Enterprise organizations in the bottom tier of results tended to have experienced damaging cyber attacks and heavy losses. Predictably, these enterprises had not deployed the technologies necessary to thwart today’s sophisticated cyber threats, and had not adequately trained their employees on security best practices.

1-http://www.eweek.com/c/a/Security/Data-Breach-Risk-Higher-Among-Small-Businesses-Ponemon-805511/

1

(5)

In fact,

• Less than half kept their endpoint devices current with operating system and application updates across their virtual and physical servers and devices

• Only 20 percent of their physical endpoints including desktops, laptops, and mobile devices had virus and spyware protection

• Only 10 percent of their virtual servers and desktops had those technologies deployed

• Only half considered technologies such as encryption, access control, data loss prevention, and reputation-based security as somewhat or extremely necessary

• Only 66 percent trained their employees at least once a year

The percentages are similarly low for physical and virtual endpoints with firewall protection, intrusion prevention systems, and tools to prevent unauthorized copying of data to and from peripheral devices such as USB drives.

Overall, it is clear that those in the bottom tier were functioning with inadequate security and were failing to follow basic security best practices.

TTop tier: Nearly all ph op tier: Nearly all physical and virtual endpoints secured ysical and virtual endpoints secured

On the other hand, the top tier organizations tended to have employed the latest in endpoint protection technologies and practices. Nearly all of these top tier companies:

• Kept their endpoints—including virtual and physical servers, virtual and physical desktops, laptops, and mobile devices—updated with current operating system and application updates

• Deployed virus and spyware protection across nearly all of their virtual and physical endpoints

• Deployed firewall protection, intrusion prevention systems, and tools to prevent unauthorized copying of data to and from peripheral devices such as USB drives

• Agreed that a wide range of endpoint security safeguards and technologies, including encryption, access control, data loss prevention, and reputation-based security were necessary

2012 Endpoint Security Best Practices Survey Key Learnings for Small and Medium Businesses

2

(6)

• Provided some form of employee security training, with 82 percent doing so annually

The organizations that had deployed comprehensive security technologies and practices were better prepared and better able to thwart attacks and reduced the amount of money and time spent doing so. In addition, these top tier companies were significantly less likely to experience a large number of cyber attacks, or to experience downtime as a result of such attacks.

Best practices to thwart a cyber attack

While no single solution can prevent all attacks, implementing endpoint security technology is an imperative first step. Businesses of all sizes should take the following additional steps to reduce the risk of a successful cyber attack:

Assess risk—Identify and classify confidential information. Know where sensitive information resides, who has access to it, and how it is entering or leaving your organization. Assess the network and endpoints to identify possible vulnerabilities.

Minimize risk—Implement a multi-layer protection strategy to minimize the risk of exploited endpoints. In addition to traditional antivirus, firewall, and host intrusion protection technology, deploy recent innovations in endpoint security, such as reputation-based security and real-time behavioral monitoring to thwart new wave cyber attacks. Patch applications and systems regularly.

Educate—Train employees on the basics for safe computing and hold them accountable. Stress the importance of protecting their mobile devices, systems, storage devices, and the confidential data these contain from loss or theft.

For example, make sure they:

• Do not share passwords or store them in email or text files

• Do not open unknown email attachments or email from unknown senders, be wary of unexpected attachments from known senders

• Do not save, install, or run software downloaded from the Internet, unless it has been scanned for viruses

• Know how to use and update antivirus software on their laptops, and scan the laptop for viruses before reconnecting to the network

• Do not click on links to unknown websites

Prepare—Create an incident response plan and practice implementing the plan to improve response time and ensure an appropriate response.

3

(7)

Summary recommendations

Small and medium business owners must protect their sensitive business data from breaches by cybercriminals. They need:

• A relatively simple, easy-to-install endpoint security solution that protects endpoint systems including desktops, laptops, and file servers

• Advanced technologies for antivirus, antispyware, firewall, and host intrusion prevention

• Multiple layers of protection, including the latest improvements such as reputation-based security and real time behavioral monitoring

• An overall security process to assess and minimize risks, educate employees, and respond if/when attacks occur

Symantec™ Endpoint Protection Small Business Edition protects computers and servers with fast, reliable, and effective threat detection technologies in a single, integrated solution. The solution leverages the extensive Symantec™ Global Intelligence Network and Symantec Insight™ technologies to protect SMBs against threats not yet identified by other security vendors, and runs quietly in the background without slowing down computers or the network.

With solutions by Symantec, small and medium business owners can stop worrying and focus on growing the business, knowing their data is safe from cybercriminals.

Link to survey

2012 Endpoint Security Best Practices Survey Key Learnings for Small and Medium Businesses

4

(8)
(9)

About Symantec

Symantec is a global leader in providing security, storage, and systems management solutions to help consumers and organizations secure and manage their information-driven world. Our software and services protect against more risks at more points, more completely and efficiently, enabling

confidence wherever information is used or stored.

Headquartered in Mountain View, Calif., Symantec has operations in 40 countries. More information is available at www.symantec.com.

For specific country offices and contact numbers, please visit our website.

Symantec World Headquarters 350 Ellis St.

Mountain View, CA 94043 USA +1 (650) 527 8000

1 (800) 721 3934 www.symantec.com

Copyright © 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

3/2012 21239769

2012 Endpoint Security Best Practices Survey

Key Learnings for Small and Medium Businesses

References

Related documents

Pennsylvania johnny cash won't back down, Illinois grammar rules for essay writing article on importance of sports in school curriculum how to order critical thinking on gay

Right Balance • Business Challenges • Best Practices • Endpoint Protection Right Balance for Laptop D t Endpoint Protection Data Protection?. 2012 ISACA

Finally, the book returns to the trajectory of multi-media theatre and the performance of mediation from the Wooster Group’s early incorporation of film and video into their

But to avoid weaknesses in your defenses, your branch offices need exactly the same firewall protection, secure VPN connections, intrusion prevention systems, web and email security

Vontu™ Network Data Loss Prevention Vontu Endpoint Data Loss Prevention Vontu Storage Data Loss Prevention Database Security Endpoint Encryption Endpoint Protection

Source: Online study conducted by Forrester Consulting on behalf of Vontu, November 2006.. Half of companies DLP in their budgets and are increasing their

This paper tries to show how genetic algorithms can be used in the field of information retrieval and which the differ- ences between a static are and a dynamic ap- proach, used

However, note that if the file does not include images, Remote Operator will display a red 'X' in place of graphics.. The HMI cache files are in