Download the entire April, 2011 InformationWeek SMB Digital Supplement, distributed in an all-digital format as part of our Green Initiative
(Registration required.)

We will plant a tree for each of the first 5,000 downloads.

We analyzed 699 responses to our InformationWeek Analytics 2011 Strategic Security Survey from IT and security pros at companies with fewer than 1,000 employees, and we found that they take information security every bit as seriously as large enterprises. They're wrestling with the same challenges, including managing the complexity of security, enforcing policies, preventing data breaches, and assessing risk, but they're doing it with less funding, expertise, and technology.

"Somewhere between 30 and 150 people, you reach the really scary spot," says Lee Sharp, network and systems manager for recycling company TerraCycle. "Midsize companies have all the complexity of big companies but can't afford the big tools and can't easily enforce policy."

Problem 1: Managing Security Complexity

Managing the complexity of security is far and away the greatest challenge midsize IT organizations face--50% of our 699 survey respondents identified it as problem No. 1, 16 percentage points ahead of the next biggest issue, enforcing security policies. A smaller number of people and nodes to protect is little comfort when criminals have diversified their attacks and you're faced with increasingly mobile employees accessing business networks from insecure wireless hotspots, often using unmanaged devices.

Oh, and most midsize companies must comply with at least one, and frequently multiple, regulations, including PCI DSS, HIPAA, state privacy laws, and the Sarbanes-Oxley Act for public companies. Audits are a major time suck.

The complexity problem is exacerbated by stringent requirements from partners--often much larger companies, with more resources--whose information they handle. Small companies are being forced to sign on to stronger policies, processes, and controls and adopt expensive, sophisticated security technologies as a condition of doing business with those larger partners.

SMBs in the Crosshairs

Understanding the Threats, Defending the Business
Become an InformationWeek Analytics subscriber and get our full "SMBs In The Crosshairs" report.

This report includes 15 pages of action-oriented analysis. What you'll find:

• The 3 most common SMB vulnerabilities
• The 5 top attack vectors, and how to defend yourself
• 8 ways to make your company a difficult target

Get This And All Our Reports