An IDG News report yesterday announced the availability of a free Better Business Bureau (BBB)customer data security kit through their "Security and Privacy -- Made Simpler" website that was launched on Monday (3/27) for the benefit of small businesses, that typically do not have the resources to have a full information security program.  The report contained some interesting statistics:

• 56% of U.S. small businesses experienced data breaches in 2005.
• 20%  of small businesses do not use virus-scanning software for email.
• 60% of small businesses do not protect wireless networks with encryption.

The report did not define what a data breach, so that could be a very wide range of incidents.

The Small Business Association generally defines a small business as one that has 500 - 1000 (depending on the industry) employees.  Using 999 or fewer employees as my rule of thumb, according to the U.S. Census Bureau (their range broke at 999 or less employees) there were 5,775,535 small businesses in 2003.  If the number is still the same (I imagine there are more now though), this means that based on the given percentages:

• 3,234,300 small U.S. businesses had data breaches
• 1,155,107 small U.S. businesses do not use virus-protection software to scan emails
• 3,465,321 small U.S. businesses do not use encryption with their wireless networks (if all had wireless networks)

YIKES!!  However...

I'm not too surprised by these numbers; I've performed a large number of business partner security program reviews over the past few years, and it is still common to find small- to medium-sized organizations, as well as large organizations, with no documented information security policies or procedures, no encryption used anywhere, no wireless security, and...something missing from the report that is very common and critical...no documented business continuity (including backup and disaster recovery) plans. 

The BBB also plans to release an employee data protection toolkit later this year.

The BBB site is very new, but looking at the headings it could potentially contain very useful and interesting information as it becomes populated; e.g., "Data Breach Horror Stories" and "Current Security and Privacy News" (which are currently empty).

It would be helpful if the BBB and the others involved with the creation of the toolkit could provide some studies or statistics about the breaches that have occurred...considering how many there have been, there should be some data, even at least partial, available to learn from.

Technorati Tags
small business
data protection
data breach
privacy
encrypt
virus
better business bureau