Small business, big enterprise: Sometimes size really doesn’t matter

As you’ve read everything I’ve written about large enterprises, you’ve no doubt felt a sense of detachment. After all, the chances are good that you don’t work for a truly massive enterprise but for what business writers consider a midsize or small business. But that doesn’t mean you don’t share some of the same issues — and security is one of the bigger ones.

In some ways, smaller businesses’ security problems are more challenging. Not only do you have to protect yourself from the usual collection of hackers, disgruntled employees, thieves, and crooks, but you have to protect your business partners and protect yourself against your business partners.

Sounds weird, I know. Look at it this way: Sure, you’re not exactly the biggest business on the planet, but your Web site is still visible, so you have to protect that with an application firewall. And your customer information is still valuable to you (not to mention identity thieves), so that needs protection. Add to that the security requirements from the companies you supply, and your job just became more complex.

You have to protect your partners because there are numerous miscreants who will use your company as a means of attacking your larger partners. The assumption is that because you’re a smaller business, you can’t afford a big enterprise’s level of security.

Worse, any large enterprise with tens of thousands of employees is bound to have some with too much time on their hands and too few scruples. This means that if you have a connection between your enterprise and your customers’ enterprises, you also have to protect yourself against the activities of your customers’ potentially disgruntled employees. Your security problem just got even more complicated.

As if this weren’t bad enough, you have to look for solutions. In one sense, these things are a little easier for a small business: Your company has fewer employees, fewer servers, and fewer entry points to the outside world, so that part of your enterprise is easier to handle in terms of sheer volume. You also (one hopes) know your employees better, so the disgruntled-employee problem is at least manageable and perhaps easier to spot.

Unfortunately, the rest of the problem is just as complex for your company as it is for a company with 100,000 employees. The number of hackers and thieves doesn’t change, the number of viruses and worms floating around the Internet is the same, and you’re expected to maintain the same level of security as your most paranoid customer.

Fortunately, security vendors are starting to realize that the great middle ground of business needs to be just as secure as the big enterprise sector. Products that serve small-business needs are now available; for example, when we recently tested the Ingate SIP-enabled firewall , we found that the product is designed to provide services to businesses of different sizes. As a result, even smaller companies can get top-quality firewall protection, as well as the benefits of secure SIP-based telephony.

Likewise, a number of other security companies are making changes aimed at smaller companies. When we reviewed CheckPoint NG last year, you could install the firewall for either a large enterprise or choose a configuration for smaller businesses that included a complete suite of services ranging from network address translation to Internet routing.

Unfortunately, not every security appliance and not every security solution available provides equal protection for businesses of all sizes, but the picture is improving. Now, at least, it’s possible to provide your company with world-class protection, even if it’s not very big.