2015 State of SMB Cybersecurity Report
description
Transcript of 2015 State of SMB Cybersecurity Report
Primary research conducted by Spiceworks Voice of IT on behalf of CloudEntr. September, 2014
Abstract SMBs are relying more and more on web and cloud-based services to scale their businesses, reduce costs,
enable mobility and increase employee satisfaction. At the same time, the consumerization of IT has
empowered SMB employees to bring their preferred IT devices and applications to work. IT professionals are
left balancing the need for convenience – to move fast, to scale quickly and to empower employees – critical for
a growing business, when one breach could close the door. This report provides detailed insight into how IT
pros in SMB organizations are handling timely cybersecurity issues.
Methodology • CloudEntr conducted research in an online survey in conjunction with the Spiceworks Voice of IT* market
insights program to determine where the SMB industry currently stands on the issue.
• Data was collected in September, 2014.
• A total of 438 surveys were collected.
Demographic Representation • The IT pros were located in the US and represented six industry segments:
• Financial services
• Public
• Professional services
• Manufacturing
• Non-profit
• Other
About Spiceworks Voice of IT®
The Spiceworks Voice of IT® market insights program publishes stats, trends and opinions collected from small and medium business technology professionals who are among the more
than 5M users of Spiceworks. Survey panelists opt-in to answer questions on technology trends important to them. 2
Background & Methodology
Table of Contents
3
In This Report
Summary of Findings 4
Security Practices 8
Cloud Practices 17
Budget Profiling 24
Respondent Profile 26
As cloud usage grows within SMBs, the IT pros that work for them are feeling the impact of increasing security breaches. The cause – and solution – according to our survey of SMB IT pros? Employees.
The current cybersecurity landscape
• Of IT pros surveyed, 60% say recent security breaches have no actionable impact on security policies. Those in financial services are most likely to re-evaluate or change policies (49% vs. 40% on average).
• Across organizations surveyed, roughly three-quarters of IT pros (77%) said employees are the single weakest link in their security infrastructure, and this is especially true among larger organizations (83%) with more users and risk factors.
• Employees are perceived as most problematic in financial services (81%) and non-profit organizations (84%).
• The top challenges organizations face with their IT security are employee focused, including social engineering (48%) and managing BYOD (42%).
• Regulated industries (e.g., finance, government, healthcare, etc.) have greater challenges than non-regulated industries with compliance (51% vs. 28%) and access management (37% vs. 23%).
• Authentication (71%), password management (52%) and access management (50%) are the top technologies used to secure company access to the web and/or cloud.
Summary of Findings
5
Cloud and security
• One-third of IT pros (29%) reported that they have no plans to use the cloud, and of that group, 80% said they have no formal policy or regulations against cloud use.
• Nearly half of IT pros not currently using cloud (43%) actively know of departments or individuals within their company that use cloud without company approval.
• Unsanctioned employee use of cloud services is more of an issue in non-regulated industries (45% vs. 37%) as they are not required to comply with industry regulatory laws.
• SMBs deploy the cloud evenly as company-wide and point solutions.
• Deployment of cloud applications as point solutions increases to 62% among in companies with 250-499 employees.
• When weighing security versus convenience in cloud-based applications, 63% of all respondents ranked security as the higher priority. Even so, the majority of IT pros surveyed (89%) are concerned with cloud security, and 53% report that employee use of cloud-based applications makes their company less secure.
• Not surprisingly, security is a considerably higher priority for regulated industries (77%) vs. other organizations (57%).
Summary of Findings
6
Cloud and security, continued
• As with overall security, the top cloud security concern (75%) is employees—specifically fear of employees unintentionally exposing data.
• IT pros at larger organizations are more concerned with hackers getting in using employee credentials and employees stealing data than their smaller counterparts.
• Regulated organizations (e.g., healthcare, finance, government etc.) are also more concerned with compliance in the cloud than others (56% vs. 25%).
• The extent to which IT pros said they use various methods to improve security for cloud-based applications differs, but roughly three-quarters are relying on employee/end-user education.
Future plans
• When considering their overall security strategy, recent security breaches won't impact 2015 security purchases for 64% of IT pros surveyed.
• Those most impacted by recent security breaches primarily plan to provide more employee education in the next year (89%). Other goals are to provide stronger network perimeter security (62%) and stronger server security (46%).
• Approximately half of the IT pros did not know or preferred not to say if their 2015 budget allocates for cloud security, but this may be a factor of certain respondents role/limited involvement in budget planning.
Summary of Findings
7
• Eighty-nine percent of IT pros surveyed reported some impact from recent security breaches. For approximately half, these
recent security breaches simply raised concerns, and only 40% were actually re-evaluating or changing policies based on
recent security breaches.
• Those in financial services reported the most actionable impact with 49% indicating some or significant impact.
9
60% say recent security breaches have no actionable impact on security policies
11%
49%
34%
6% 9%
61%
28%
1%
10%
39% 44%
8%
16%
46%
29%
9% 9%
49%
37%
4%
0%
20%
40%
60%
80%
100%
No impact Minimal impact (e.g., raised concern, but didn’t change policies)
Some impact (e.g., lead us to re-evaluate policies)
Significant impact (e.g., lead us to change policies)
Impact of Recent News Coverage around Security Breaches on Security Policies (e.g., Heartbleed, Adobe, Target, eBay, iCloud)
Total Co Size 20-49 Co Size 50-99 Co Size 100-249 Co Size 250-499
Impact Net (Total) = 40%
49% 39% 41% 36% 34% 44%
Financial Svcs
Public Professional Svcs
Mfg Non-Profit Other
Key Differences by Industry: Impact Net
• Those reporting some or significant impact to their organization primarily plan to better educate employees regarding security.
• IT pros at organizations with less than 50 employees are the least likely to invest in security software tools (14%), and those at
organizations with 250-499 employees are the least likely to strengthen server security (29%).
10
Overwhelmingly, those impacted are turning to employee security education in 2015 to prevent breaches
89%
62%
46%
37%
86%
68%
55%
14%
88%
55% 53%
43%
90%
70%
50% 47%
90%
58%
29%
36%
0%
20%
40%
60%
80%
100%
More employee education Stronger network perimeter security
Stronger server security Investing more in security software tools
New Security Plans in 2015 to Prevent Breaches (Asked of those reporting some or significant impact. Multiple selections permitted.)
Total Co Size 20-49^ Co Size 50-99 Co Size 100-249^ Co Size 250-499
• While 76% of IT pros reported varying levels of impact on 2015 security purchases from recent security breaches, 44% have
raised concerns. Only 32% will re-evaluate or adjust planned security purchases for 2015.
11
Recent security breaches won't impact 2015 security purchases for 64% of IT pros surveyed
20%
44%
29%
3% 4%
27%
44%
25%
3% 1%
19%
39% 35%
4% 4%
19%
45%
26%
5% 5%
16%
48%
31%
1% 4%
0%
20%
40%
60%
80%
100%
No impact Minimal impact (e.g., raised concern, but won’t change
2015 purchases)
Some impact (e.g., will re-evaluate 2015 purchases)
Significant impact (e.g., will change 2015 purchases)
Don't know
Impact of Recent News Coverage around Security Breaches on Planned Security Purchases in 2015
Total Co Size 20-49 Co Size 50-99 Co Size 100-249 Co Size 250-499
Impact Net (Total) = 32%
• End users are perceived as the single weakest link in security infrastructure by 77% of IT pros surveyed.
• This is especially true among IT pros at larger organizations (83%) with more users/risk factors.
12
Weakest link in security infrastructure? Employees.
77%
8% 7% 5%
2%
72%
13%
8%
1% 4%
74%
4%
14%
5% 3%
78%
11%
3% 6%
1%
83%
4% 4% 8%
1%
0%
20%
40%
60%
80%
100%
Employees/Users Passwords Mobile devices Third-party vendors’ data treatment
The technology we use internally for security
Weakest Link in Organization’s Security Infrastructure (Single selection permitted)
Total Co Size 20-49 Co Size 50-99 Co Size 100-249 Co Size 250-499
• While employees are perceived as the single weakest link across all industries, they are perceived as most problematic in
financial services and non-profit organizations.
• Mobile devices are also considered more problematic in financial services and professional services.
• Third-party vendors’ data treatment is considered a weaker link in financial services and “other” organizations.
13
Weakest link in security infrastructure varies slightly by industry
74%
3%
11% 9%
0%
81%
9%
5% 2%
5%
77%
7%
12%
3% 2%
74%
12%
7% 3% 5%
84%
9%
3% 3% 0%
73%
7% 6%
13%
0% 0%
20%
40%
60%
80%
100%
Employees/Users Passwords Mobile devices Third-party vendors’ data treatment
The technology we use internally for security
Weakest Link in Organization’s Security Infrastructure: By Industry (Single selection permitted)
Financial Services Public Professional Services Manufacturing Non-Profit Other
14
Top IT security challenges are employee-focused: Social engineering and BYOD management
2%
3%
3%
8%
11%
26%
27%
33%
34%
42%
48%
0% 20% 40% 60%
Don't know
None
Other
Controlling SaaS apps
Outages and remediation after a security incident
Preventing breaches
Access management
Enforcing password policy
Compliance
Managing BYOD
Social engineering
Top IT Security Challenges
• Top IT security challenges vary by industry type:
• Those in regulated industries (e.g., finance, government, healthcare, etc.), have greater challenges with compliance and
access management.
• Those in non-regulated industries have greater challenges with social engineering, managing BYOD and controlling SaaS
apps.
15
Social engineering and managing BYOD are greater IT security challenges for those in non-regulated industries
40%
31%
51%
35% 37%
31%
11%
3% 4% 0%
2%
52%
47%
28% 31%
23% 25%
11% 11%
2% 4% 2%
0%
20%
40%
60%
80%
100%
Social engineering
Managing BYOD
Compliance Enforcing password
policy
Access management
Preventing breaches
Outages and remediation
after a security incident
Controlling SaaS apps
Other None Don't know
Top IT Security Challenges: By Industry Type
Regulated Industries (E.g., Healthcare, Finance, etc.) Non-Regulated Industries
• Authentication, password management and access management are the top technologies currently used to secure company
access to the web and/or cloud across for organizations using the cloud.
• IT pros at companies with 50-99 employees (80%) are taking stronger action than others around authentication.
16
Primary technology used for Internet security? Authentication.
71%
52%
50%
42%
25%
6%
64%
51% 47% 47%
21%
8%
80%
60%
54% 50%
37%
0%
65%
50%
43%
35%
19%
10%
75%
47%
59%
36%
24%
7%
0%
20%
40%
60%
80%
100%
Authentication Password management Access management Secure file sharing Single sign-on tools None
Technologies Used to Secure Company Access to the Web and/or Cloud
Total Co Size 20-49 Co Size 50-99 Co Size 100-249 Co Size 250-499
• Among organizations with no plans to use cloud, the majority (80%) do not have a formal policy prohibiting cloud-based services.
• Just under half of the organizations with no cloud plans have employees/departments that use cloud-based services
regardless of company policy.
• Unsanctioned employee use of cloud services is more of an issue in non-regulated industries as they are generally less
concerned about security threats.
18
Many employees use cloud services regardless of company usage or policy
Incidence of a Formal Policy to Prohibit Cloud-based
Services Usage
(Asked of those with no plans to use cloud)
Incidence of Employees/Departments Using
Cloud-based Services
(Asked of those with no plans to use cloud)
6%
80%
5%
10% Yes, company policy prohibits cloud-based services
Yes, abide by industry standards/ regulations that prohibit cloud-based services
No formal policy or regulations
Don't know
Yes Net: 15%
13%
45%
43%
Yes
No
Don't know
Regulated Industries = 37%
Non-Regulated Industries = 45%
• Most participating organizations are nearly evenly split between deploying cloud-based services company-wide and as point
solutions.
• Smaller organizations (<100 employees) have slightly higher rates (61%) of company-wide cloud deployments, while larger
organizations (250-499 employees) have higher rates of point solutions (62%), likely due to greater variance in services
needed.
19
SMBs deploy the cloud evenly as company-wide and point solutions
56%
47%
9%
61%
45%
5%
62%
42%
8%
50%
39%
19%
51%
62%
4%
0%
20%
40%
60%
80%
100%
Company-wide Point solution (e.g., employee/ department/ site-specific)
Don't know
How Organizations Currently Deploy or Plan to Deploy Cloud-based Services (Asked of those currently using or planning to use cloud. Multiple selections permitted.)
Total Co Size 20-49 Co Size 50-99 Co Size 100-249 Co Size 250-499
• The top concern with cloud security is employees exposing data.
• IT pros at smaller organizations are more concerned with hackers getting in through servers than those at larger
organizations, which aligns with their plans to strengthen server security. Further, IT pros at larger organizations are more
concerned with hackers getting in using employee credentials and employees stealing data.
• Regulated organizations (e.g., healthcare, finance, government, etc.) are also more concerned with compliance than others.
20
The top concern with cloud security? Employees exposing data.
75%
49% 48%
34%
23%
10%
75%
55%
43%
29%
13% 12%
74%
53%
45% 44%
23%
12%
73%
49% 46%
28% 26%
6%
78%
38%
57%
35%
30%
8%
0%
20%
40%
60%
80%
100%
Employees unintentionally exposing
data
Hackers getting in on the server side
Hackers getting in using employee credentials
Compliance Employees stealing data Government spying
Top Concerns with Cloud Security (Asked of those currently using or planning to use cloud. Up to 3 selections permitted)
Total Co Size 20-49 Co Size 50-99 Co Size 100-249 Co Size 250-499
Regulated
Industries
Non-
Regulated
Industries
56% 25%
• Security is considered more important than convenience by 63% of the organizations surveyed.
• Security is particularly important for regulated organizations (e.g., healthcare, finance, government, etc.), particularly
financial services.
21
Security wins out over convenience
*Respondents were provided with the following definitions of “security” and “convenience:
Security - making sure that access to cloud apps and vendor treatment of my information is secure.
Convenience - employees having quick, easy access to applications to get their jobs done.
4% 33% 63%
Most Important Factor for Cloud-based Applications (Asked of those currently using or planning to use cloud)
Other Convenience* Security*
Regulated
Industries
Non-Regulated
Industries
77% 57%
Financial Services Public Prof. Services Manufacturing Non-Profit Other
80% 65% 62% 57% 59% 58%
Key Differences by Industry: Importance of Security
• Roughly half of IT pros report that employee use of cloud-based applications makes their company less secure as they may
unknowingly expose data during the process.
22
IT pros believe employee cloud use makes their organization less secure
53%
27%
10% 10%
0%
20%
40%
60%
80%
100%
Less secure No impact More secure Don't know
Impact of Employees Using Cloud-based Applications (Asked of those currently using or planning to use the cloud)
• Companies with 50-99 employees are taking a more proactive stance than other company sizes in educating employees and
implementing processes to improve cloud security.
23
Primary tools used to improve security for cloud-based apps: Education and processes
76%
66%
52%
8%
68%
56%
51%
13%
86% 82%
59%
4%
70%
55%
43%
10%
81%
69%
57%
4%
0%
20%
40%
60%
80%
100%
Education Processes Technology None of the above
Tools Used to Improve Security for Cloud-based Applications (Asked of those currently using or planning to use cloud. Multiple selections permitted)
Total Co Size 20-49 Co Size 50-99 Co Size 100-249 Co Size 250-499
25
2015 IT budgets are trending less than $250K
• More than half of IT pros (60%) indicate their IT budget is less than $250K for 2015.
• Nearly half state they “don’t know of” budget specifically allocated for their organization’s cloud security in 2015, and 18%
don’t have budget allocated. However, 13% plan to spend $1,000 or less, and 19% plan to spend more than $1,000 on
cloud security.
• While many are also unclear on their budgets specifically for cloud services/projects in 2015, 21% report they will spend
less than $5K on cloud-based services/projects, 16% will spend $5K-$15K, and 19% will spend more than $15K.
26%
20%
14% 12%
28%
0%
20%
40%
60%
80%
100%
Less than $50k $50k to $100k $100k-$250k More than $250k
Don't know/ Prefer not to
say
Total IT Budget Planned for 2015
49%
19%
7%
5%
2%
18%
0% 20% 40% 60% 80% 100%
Don’t know
More than $1,000
$501-$1,000
$101-$500
$1-$100
Nothing
Planned Spend on Cloud Security
39%
11%
8%
16%
21%
5%
0% 20% 40% 60% 80% 100%
Don't know More than $25k
$15k-$25k $5k-$15k
Less than $5k Nothing
Planned Spend on Cloud-based Services
Company Size
(# of employees) Industries
Title Purchase Influence
26
Respondent Profile
Use of Cloud
24% 25% 26% 24%
20-49 50-99 100-249 250-499
80%
20%
Currently use
Plan to use net
To get a full perspective of the SMB market's cybersecurity perceptions and practices, respondents were limited to those at
companies with 20 to 500 employees with influence over IT security or cloud purchase decisions. An overview of key
respondent demographics is below.
22% 20% 20%
11% 10%
18%
Public Manufacturing Professional Svcs
Financial Services
Non-Profit Other
91% 95%
75%
16%
Determine the need
Evaluate vendors/ solutions
Make decisions
Approve funds
4%
22%
27%
37%
6%
1% 3% VP IT / CIO
IT Director
IT Manager
Network / Sys. Admin.
Help Desk Tech.
Tech. Consultant
Other IT related
The simple and secure way businesses access the cloud.
For more information, visit www.cloudentr.com.
About