Opportunities Abound In Managed Security Services

The typical SMB company has neither the staff nor the expertise necessary to secure its IT assets from internal and external threats. If an SMB company has any IT staff at all, it is focused on supporting line-of-business applications. Few if any SMB companies have an articulated security policy in place, and usually no means to enforce that policy. Often they rely on a firewall but have no antivirus protection, or they have antivirus but no firewall, and almost none have any form of intrusion detection, logging and mediation.

That's a dangerous position for any SMB company to be in because it can lead to a business-breaking loss of wages or even litigation. Work lost to a virus must be redone if possible and the network repair work is costly in time, money and the relationships an SMB company has with its customers and partners.

Furthermore, new legislation has made best-effort security practices mandatory for financial and medical practices, including those based in someone's home office. This legislation underscores the responsibility of even private-practice verticals to secure their data.

Solution providers can start in managed security services by offering security audits, which should be done regularly to find new holes stemming from changes in infrastructure of new exploits. The first audit can be followed by a proposal to establish a policy and secure the network. Next, training a customer's staff on the new policy and common-sense practices--such as handling attachments--is important to reduce an SMB company's legal liability and increase the success of security measures.

Data encryption is a must to limit the possibility of internal or external access abuses. Intrusion detection and misconduct detection can be offered as services to enforce the security policy and reduce customer risk. Only a system of accountability can make a policy effective. It can also help catch a security violator, which is important in building a legal defense if necessary. Logging attempt failures is also good to prove the ROI.

Automated firewall and antivirus updates also are ways to maintain security in an ever-hostile network environment. Finally, secure online backup should be offered as a last defense against data, productivity, business and monetary losses.