Even the smallest of businesses are not immune to Internet threats. Just a single security breach could bring your business operations to a halt, decreasing productivity, and potentially compromising data integrity, customer confidence, and revenue flow. And today's threats can come from anywhere--wired or wireless networks, internally or externally.

It seems like only yesterday that a firewall and antivirus were all a small business needed to protect its data. By current standards, yesterday's threats were slow-moving and predictable, and blocking them at the network perimeter kept their impact to a minimum. And studies have shown that small businesses often leave large security gaps. A recent survey of 1,000 small businesses by Symantec and the Small Business Technology Institute found that small businesses are largely unaware and uneducated about information security risks and their economic repercussions. Twenty percent of small businesses surveyed have yet to implement simple virus scanning on email.

Unfortunately, even simple virus scanning on e-mail won't cut it in today's business environment. Today, information is continually moving among employees, partners, and customers--few of whom operate within the controlled sphere of the small business network. Each endpoint represents a potential entry point for cybercriminals who are increasingly intent upon compromising sensitive information for financial gain.

Clearly, the network is no longer the perimeter. Today, people are the perimeter. Consequently, information protection is no longer about protecting the network. It's about protecting information wherever it resides.

A Data Explosion

In the digital age, business data constantly flows among an expansive range of organizations and individuals whose security status varies. Small businesses are dependent on these interconnections for the performance of their business--for the on-time delivery of goods and services as well as their financial performance.

For example, salespeople might connect to the small business network through a hotel network. Guests access the Internet through the wired or wireless LAN. Mobile workers at kiosks check email and download attachments. Customers transact business online from home Internet connections and public wireless hot spots.

Protecting information in such an environment requires the elimination of exposures not only inside the network but also across business boundaries. This includes endpoint enforcement through protection, configuration, and usage, as well as endpoint compliance--and that means securing all endpoints and all access points all the time.

Of course, simple user error can also put small businesses--not to mention their customers, partners, and employees--at risk for a security breach. For example, a government agency recently revealed that an employee's laptop was stolen--along with personal information on a staggering 2.2 million active-duty military personnel.

Evolution of a Threat

What a difference a few years can make, particularly where the Internet is concerned. In 1988 the first Internet worm was launched. It spread to just 6,000 computers--of course, that represented one-tenth of all the computers on the Internet at the time.

Those were the good old days. Where yesterday's threats were noisy and visible to everyone, today's threats are silent and often go unnoticed--by design. After all, with the current price of a successful adware and spyware install at somewhere between five and 20 cents a pop, stealth pays.

That's not all. While earlier threats were indiscriminate and hit virtually anyone and everyone, today's threats are highly targeted and regionalized. Cybercriminals are in it for the money now, unleashing quiet but sophisticated, modular malicious code aimed at perpetrating identity theft, extortion, and fraud.

In turn, the task of containing, managing, and protecting data has gone from challenging to being vastly more difficult, complex, and critical. Information protection has clearly moved far beyond network security and now extends to protecting data regardless of where it is.

After all, lose the data and you lose the business.

Focus on the Information--Not the Network

To reduce information exposure, small businesses must secure both their managed and unmanaged endpoints--because that's where the information resides. Since managed endpoints are within an organization's administrative control, persistent agents can be used to implement appropriate countermeasures. This is important, as these endpoints often have more extensive rights for accessing and storing information, which in turn signals the need for more robust security measures.

Among the most effective tools for protecting managed endpoints are antivirus, personal firewall, and intrusion protection technologies. While antivirus tools are ubiquitous today, the most effective protection comes from technologies that include anomaly or heuristic-based threat detection as well as antispyware capabilities.

Personal firewalls are another widely recognized countermeasure, although their effectiveness is limited to protecting at the network layer. Personal firewalls often cannot stop application layer attacks that utilize protocols and connections allowed by their rule base. Nevertheless, personal firewalls are a valuable component of managed endpoint protection as they permit only traffic that is explicitly allowed by policy.

Intrusion protection technologies offer another layer of security for managed endpoints. Host-based intrusion protection complements antivirus by guarding against unknown attacks that operate at the system and application levels. Network intrusion protection tools guard against network-based threats such as worms. While some network intrusion protection solutions rely on signatures and, therefore, guard against known attacks, other solutions provide more advanced mechanisms such as vulnerability-based signatures and protocol anomaly detection to keep unknown threats out.

Rounding out these more common security technologies are application control, host integrity checking, patch management, buffer overflow protection, and encryption technologies. Application control picks up where personal firewall technology leaves off and further defines allowable traffic. Host integrity checking evaluates various security attributes to ensure that the endpoint is defended against any threats it may encounter.

Patch management identifies and eradicates weaknesses in software code, while buffer overflow protection monitors endpoints for known and unknown threats that attempt to exploit buffer overflow vulnerabilities. Finally, file and disk encryption guards against information loss in the event that an endpoint such as a laptop is stolen or lost.

Protecting unmanaged endpoints is also critical in order to reduce the risk of information exposure. However, because these devices are outside an organization's control, they require "on-demand" protection that does not impose changes or restrictions beyond the duration of a specific interaction.

To that end, small businesses can leverage a number of on-demand technologies, including host integrity checking, cache cleaning, malicious code protection, firewalls, and a secure virtual workspace. On-demand host integrity checking and on-demand firewalls provide much the same protection as their agent-based counterparts, while on-demand cache cleaning removes information remnants from browsers and application-specific caches when a session ends.

Of course, no information protection solution is effective without the cooperation of the people who actually use the managed and unmanaged endpoints. While business security responsibility and accountability is widely acknowledged as a vital yet challenging component of an information security strategy for any small business, its effectiveness can be greatly enhanced when organizations carefully codify requirements and responsibilities and apply automation to ease enforcement.

As the borders of a typical small business network continue to expand, the potential for attack continues to grow. The good news is that small businesses can conduct business online more safely by staying informed about the latest technologies required to protect their most vital asset--information. Together with enforceable employee best practices for security, small businesses can leverage technology to keep a handle not only on systems under their immediate control but also on the devices upon which their valued partners, employees, and customers rely to do business in a highly interconnected world.

Jonathan Brody is a senior director with Symantec's Security and Data Management Group.