WASHINGTON, US: Small business owners' cybersecurity policies and actions are not adequate enough to ensure the safety of their employees, intellectual property and customer data, according
to the 2009 National Small Business Cybersecurity Study. 

The study, co-sponsored by the National Cyber Security Alliance (NCSA) and Symantec, as part of this year's National Cyber Security Awareness Month, surveyed nearly 1,500 small business owners across the United States about their cybersecurity awareness policies and practices, said a press release.

The survey confirmed that small businesses today are handling valuable information such as customer data, financial records, credit card information, intellectual property and other sensitive corporate content online. 

65 per cent of the business survey claimed that the Internet was critical to their businesses success yet they are doing very little to ensure that their employees and systems are not victims of a data breach.

The survey shows discrepancies between needs and actions regarding security policies and employee education on security best practices.  Only 28 per cent of U.S. small businesses have formal Internet security policies and just 35 per cent provide training to employees about Internet safety and security.  At the same time, 86 per cent of these firms do not have anyone solely focused on information technology (IT) security.  For those small businesses that do provide cybersecurity training, 63 per cent provide less than 5 hours per year.

The lack of focus on cybersecurity awareness and education on the part of U.S. small businesses can lead to the loss of vital customer and company data.

The study found that while more than 9 in 10 small businesses said they believe they are safe from malware and viruses based on the security practices they have in place, only 53 per cent of firms check their computers on a weekly basis to ensure that anti-virus, anti-spyware, firewalls and operating systems are up-to-date and 11 per cent never check them. 

"The 20 million small businesses in the U.S. are a critical part of the nation's economy.  While small business owners may understandably be focused on growing their business and the bottom line, it is imperative to understand that a cybersecurity incident can be disruptive and expensive," said NCSA
executive director Michael Kaiser. 

"To the millions of very savvy entrepreneurs across our nation, our message is simple - being smart about the online safety of your employees, business and customers is a critical part of doing business. Cybersecurity is not a nice thing to have for American businesses, it is critical to their survival."

75 per cent of small businesses said that they use the Internet to communicate with customers yet only 6 percent fear the loss of customer data and only 42 percent believe that their customers are concerned about the IT security of their business. What's more, 56 per cent of small businesses believe cybersecurity is the cost of doing business while 21 per cent believe it is just  'a nice thing to have'.

62 per cent of the companies surveyed have a wireless network but 25 per cent of them do not password protect their wireless networks.  This is a significant security risk as hackers can steal information being passed through these open networks.

"Security threats are becoming more complex and employees of small businesses are increasingly  the target of attacks that expose their organizations to data loss," said Sheri Atwood, vice president, global solutions and programs, Symantec.

Atwood further added that security awareness and education, combined with a comprehensive security solution, can empower small businesses and their employees to protect themselves and their information.