Why don't small businesses Secure Value?

 

We don't build buildings without locks but we do build intellectual, informational and digital assets without locks, why?

 

I asked a number of people last week:

Regarding Twitter's security breach announced today as an example, how should startups consider information security in their planning?

I got a mix of responses that boiled down to:

• Information security is too complicated, too technical for startups to consider.

• Start ups don't have the capital to invest properly in information security.

In the context of the Twitter story .... one of the founders, first name Jack, had as his username / password combination to use Google apps Jack with the password, password .... the responses do not make sense. 

Twitter has brilliant innovative people working for them who fundamentally understand information technology.  The information security control (read: lock) that wasn't in place would cost $0 as their bad week could have been prevented by a hard to guess user name and a strong password.  In the end it is negligence and a lack of awareness about how important this stuff is (or perhaps awareness that bad things do happen).  How many other startups and growth companies enter the marketplace without proper protections?

Comments

[mlgreen8753]

It doesn't take much to secure information. Zip files can be created with password protection and there are even more sophisticated security features that can be purchased for cheap.

[Douglas Davidson]

It takes intentional effort to secure information. Simply zipping up your confidential files won't necessarily secure them. A lot of product vendors answer the question in a similar way. It is easy to secure information, all you have to do is install Firewall Brand X, anti virus, etc. and you are secured.

Securing value entails safeguarding your critical data, information and processes to ensure they are confidential, available and have integrity (think accurate information). Even small business owners have a plethora of government regulations to adhere to.

Just zipping files won't provide for all of those needs. My answer ignores the fact that a zipped file with a weak or non-secret password isn't secure. And ignores the fact that zipped archives have been cracked.

We say there is no such thing as a silver bullet. One technology won't provide all the security functions you need.