Imagine that you live in a neighborhood that has several mansions, surrounded by a large number of more modest homes. Suppose that in the past, burglars concentrated their efforts on breaking into those large houses and stealing everything of value. Knowing this, you didn’t bother to lock your door most of the time. Why would you worry about someone stealing your small television, when they could go after priceless jewelry and art?

Now, imagine that the burglars are changing tactics to target the smaller homes like yours. Instead of robbing fewer houses to gain a lot of goods, they watch to see who in the smaller houses is leaving the doors unlocked. They might not gain as much from one robbery, but they would target more houses and gain access more easily.  Small businesses owners may have felt and acted the same way as the modest homeowners in our analogy, thinking cybercriminals would focus on the Fortune 500 and simply leave them alone.

The Changing Tactics of Cybercriminals

But cybercriminals are just as opportunistic as people who commit physical robberies, and their methods are constantly changing. According to Verizon’s 2011 Data Breach Investigations Report (PDF), these hackers are carefully targeting a more diverse pool of victims ranging from small businesses to large enterprises, using a variety of methods.

The report, conducted in cooperation with the U.S. Secret Service, shows a new landscape of threats faced by businesses as they work to protect sensitive data. The total number of attacks is on the rise, as cybercriminals shift to focus on small and medium businesses, while the number of records exposed per breach declines.

Another trend in data breach activities is the increased compromise of physical entities such as POS systems, ATMs and gas pumps, which tends to more acutely impact SMBs. With the access these devices have to identifying information, they are becoming desirable targets for attack. These attacks are often the work of networked groups of criminals, stealing credit card numbers and other confidential data.

Malware continues to play a strong part in data loss, leading to approximately 80 percent of total data loss in 2010. Additionally, networks and systems with weak credentials leave enterprises unnecessarily vulnerable to outside attacks.

Protecting Your Data

In light of the findings of the report, Symantec recommends that businesses take the following precautions to protect sensitive corporate data, as well as customer information:

• Begin by assessing your current risks. Examine the location of valuable data, as well as who has access to it. In order to protect your data, you need to know exactly where it resides and where it is flowing to.  Think about deploying data loss prevention to scan your networks and systems for unprotected sensitive information.
• Integrate information protection into your business processes. Your business practices must foster security.
• Ensure that employees are educated regarding these security policies, and hold them accountable. An unenforced policy does not reduce risk.
• Deploy data loss prevention solutions to enable policy compliance and enforce protection.
• Bolster the security of mobile devices such as laptops through the use of encryption software, to reduce security risks posed by loss or theft of the device.
• Evaluate your current malware protection and consider whether you need additional defensive measures to protect against evolving threats.

The majority of data breaches are preventable with sufficient preparation, and SMBs should work now to implement security best practices to protect sensitive data from the attacks that are becoming more and more common. The report underscores the importance of not only being aware of the activities and methods of cybercriminals, but also taking whatever steps you can to make sure your doors are locked before the criminals arrive on your doorstep.