There are two facts which are nearly always true about information security resources. Almost all experts price their services for big corporate clients (with big corporate budgets), but almost all tools are way too complicated for small businesses to implement – and reliably maintain – on a “do-it-yourself” basis.

This leaves us in a little bit of a sticky situation. Our small businesses don’t have the budgets to engage a $300.00 per hour information security expert. But, our small businesses rely more and more every year on digital records and electronic transactions.

The Wall Street Journal published a front-page article earlier this year (July 21, 2011) reporting on the increasing risks and rising costs of information security breaches at small businesses. The article focused on several small businesses that had been bankrupted by the actual liabilities that occur when customer information is breached.

The Wall Street Journal article emphasized that the bad guys are getting tired of wasting their time on the big companies who can afford premium information security programs. They want the easy pickings. And, as our small businesses grow increasingly dependent on digital records – the easy pickings are us.

It is simply no longer viable for a small business owner to cross their fingers and hope that business information is secure.

What are our options?

Here are three tips that any small business owner can implement – with zero cost – to improve their information security in the new year.

1) Get serious about your passwords

When I started my business services and security practice this summer, I decided it was time to get some real information on what the bad guys are doing. So I went to a weeklong hacker’s convention and tried to blend in.

There were about 300 hackers in attendance. During one of the sessions, the hacker who was speaking said that he was getting bored with breaking into businesses. “I never get to do anything fun”, he lamented, “because 90% of the time, all I have to do is guess the password.”

The room erupted with laughter and shouts of agreement.

The days are long past when we can safely use passwords like “123456” or “admin” or the ever-popular “password”.

There are software tools – available for free download on the Internet – than can crack just about any password in seconds.

Stop thinking password, and start thinking passphrase. Put together several words, with a few numbers and special characters (such as @, $, &, %, etc) included. A strong passphrase takes significantly longer to crack, and makes your business systems a much less attractive target.

2) Evaluate the access which your employees have to systems & resources

The Computer Emergency Response Team (CERT) at Carnegie Mellon University conducted a study several years ago in cooperation with the US Secret Service. The research paper which they published provided significant insights into the characteristics of actual information security breaches.

Their research emphasized the risks that are posed by “insiders”, meaning employees and others who have been granted authorization to use business systems for otherwise legitimate purposes. The study found that:

In 87% of the cases, the information security breach was performed by an insider using simple, legitimate system commands.
In 77% of the cases, the insider who performed the breach was not a technical expert.
In 83% of the cases, the breach took place within the business’s premises.
In 70% of the cases, the breach took place during normal business hours.

What’s the upshot of this?

In addition to protecting your business information from hackers attacking from outside – your business information also needs to be secured from the inside. There is a strong possibility that your business information systems can be breached from inside your office, during normal business hours, by a non-technical employee using routine system access.

We can’t let our lives be ruled by paranoia, and every business relationship – especially that between employer and employee – requires some degree of trust.

But, we also need to be realistic. Evaluate which employees have access to which systems, and update this evaluation every so often. If someone changes roles, review their system access. Don’t allow anyone to create “dummy” user accounts, and don’t share user accounts – this makes it impossible to trace if something does go wrong.

3) Understand your liability for credit card (and debit) transactions

I believe that this is the hidden landmine right inside the front room of every small business that accepts credit card (and debit) transactions.

When your small business was provided with an electronic card reader, you were required to sign a contract with the vendor which states your responsibility for compliance with the rules of the Payment Card Industry (PCI).

The PCI rules are lengthy and complex; and full compliance is difficult even for large companies with big security budgets and full-time security staff.

The standard PCI contract stipulates that – if there is any incident involving customer data, and the incident is traced back to the card reader at your business – the bank will conduct an investigation to determine liability & damages.

Industry standard PCI agreements also state that, as part of this investigation, the bank can hire a forensic investigator to review the breach at your business. However – even though you did not select the investigator or agree to their compensation rate – standard PCI agreements allow the entire cost of this forensic investigation will be charged back to your business.

Do you have a copy of your PCI agreement? Have you read it?

Do you have a copy of the PCI rules & regulations which your PCI agreement requires you to follow?

What is the possibility that you have not implemented every single requirement in these rules?

The potential damages to your business that can result from a PCI breach are what we professionals in the audit & security industry refer to as a “low likelihood, high consequence” risk.

This means that the chances of such an incident are not great – but, if the incident does occur, the results could be catastrophic for your business.

Make sure that you have a full copy of your PCI agreement, and the PCI rules & regulations to which your business is bound by this agreement. Read the documents, and understand both your rights and liabilities.

The times require you to be vigilant about your business systems security.

James Wiley, CPA
Bookworm Business Services & Sly Fox Security

http://www.bookwormcompanies.com/

317-397-4712
james@jameswileycpa.com

Hazel Walker
Referral Institute, llc
BNI
hazel@bni.com

The marketing world is changing. We know that. And with the change in process comes a change in budget. We have been talking about it for years. However, there were two amazing blog posts published today that talk about the changing world of public relations. They are a must read.

Jay Baer published a post called Blogger Outreach Changes the PR Timeline Forever. KD Paine also published a post called Memo to the PR Profession, budgets are there, just not for what we used to do.

Many of you know that I have been an outspoken critic of traditional PR and ad firm practices over the past few years. This does not mean I disagree with the need for marketing and guidance but I do believe the entire model is changing. It may not be changing drastically now… but it will in the near future.

Jay’s post talks about the changing world of strategies to pitch bloggers on upcoming events and public relations needs within the market. Like Jay, I receive pitches on a daily basis that are not personalized or relevant whatsoever to my content or blog. The mass distribution of content is still around in the PR and marketing world. However, the world of relationship management and budget development is changing drastically. Jay states:

PR firms need to be billing their clients to develop relationships on a retainer basis, so those blogger bridges can be crossed whenever necessary. That’s also why I see smart PR firms starting to specialize more and more in a particular vertical, whether it’s B2B technology, marketing to women, or food and beverage. It’s much easier and cost effective to develop and maintain many blogger relationships when doing so can benefit multiple clients instead of just the one client with the big launch coming up soon.

It is the truth and it is nothing new. Just like customers, bloggers need to be developed before agreeing to pitch your product, service, idea, or event to their masses. Also from Jay’s post:
Despite all the apps and influence metrics and crazy stunts, social media isn’t a game. It’s about business. Relationships are the foundation of success in business, and Twitter and Facebook and Klout and WordPress don’t change that one iota.

If we are still following the traditional model of relationship development with media professionals… why are we changing the model with social media? KD Paine’s post is related to the way companies are spending money in the world of marketing and PR. She talks about budget battles not being between advertising and PR. However, the battle is between “traditional PR thinking that can’t get beyond AVEs and HITS and the PR pros that understand two way relationships fueled by social media are the future.”

In her post, KD quotes Pierre Loic from Traackr in which he states:

For generations, mass media has governed marketing. TV alone would represent over 80% of an average marketing budget. Ad agencies have made a living of charging brands obscene amounts of money for creative and media buy. A senior exec at one of the top ad agencies told me just a few months ago, “when I meet with a CMO for an hour, do you think I sell them a $15M ad campaign or $200k in social media?” This is still today’s reality in an ad agency. The truth is that the economic model of an ad agency is based on big dollars and social media is small dollars – ad agencies haven’t figured out how to earn money on it, and this is their Achilles’ heel.

For better or for worse, PR firms have experience working with small budgets. They have also cultivated the art of the two-way communication with their target required to perform on social media. In many ways, social media is very much an extension of PR’s existing business model that only requires tweaks to succeed, not a business overhaul. This is the edge PR has over advertising in the land grab for social media ownership and budgets.

PR firms should have been the social media and digital mavens from the beginning. They have the ability to shift and communicate with individuals in a different way. However, I am witnessing many cases where PR firms are taking the traditional route of communication and not shifting fast enough for the market.

What do you think? Are PR firms the future of marketing and communication? We both know that traditional agency models are dying… but what is next?

kyle lacy
mindframe
(blog) www.kylelacy.com
(web) www.yourmindframe.com
(join) www.smallerindiana.com
(tweet) kyleplacy

Can you remember this?

All of a sudden retro commercials seem to be in. The latest Geico commercial, “Do dogs chase cats” features a car chase (the photos look like old sepia print) with old cars and the old adage about dogs chasing cats. If you’re like me, you’re not only looking at the cats and dogs but you’re looking at the other familiar things in the commercial. You’re probably looking at the cars and the background. All of these things bring you back to a nostalgic time. Just for a moment you forget the reality of the non-existent housing market, high jobless rates and the price of food and gas. In other words, these ads are producing positive feelings.

Let’s go back to why and how people buy. Buying is first emotional and then justified with logic. The internet has changed the customer. Customers are coming into buying situations armed with plenty of ammunition and are no longer dependent on the salesperson. They have the Internet and their Facebook friends and Citisearch; all of which can provide information on products and services. The information they’re receiving is logical, what we need to do is add the emotion. What better emotions to add than those that make us feel good?

Studies show that advertisements showing surprise and joy are both hugely effective in concentrating attention and retaining viewers.

If you’re looking to keep the audience’s attention, surprise is the most effective. On line videos that engage the audience with surprise have a higher retention rate than any other. However, the particular effects of each emotion varied. If you are looking to monopolize the audience’s attention, surprise is the most effective emotion. The more surprising the ad, the longer the customer stays to watch. Hence the Geico commercials such as “does it really take two to Tango?” It seems that all of their ads are joyful, funny or both. They are also nostalgic.

What does this mean for your business? How about having a “nostalgia” event focusing on a particular time period? A disco night would be perfectly acceptable with the best John Travolta moves and polyester suit! Or maybe a 40′s night with all Frank Sinatra tunes?

Get your mind off reality! Play have fun.

Make your store fun and interesting; celebrate anything; how about “TGIF,” remember that?

Great oldies music is a good start. If you notice your customers singing along it’s a hit. Remember customer service is giving the customer what they want and if they like it they’ll let you know.

Decorate your stores for the holidays, don’t forget July 4th and what it means to our country.

Hula Hooping is back, and it will take a few inches off your waist.

Maxi dresses, boyfriend jackets, capri pants and wedgie shoes are still in.

How about this: leggings, large hoop ear rings, leg warmers, big hair and bright lipstick? Don’t foget the blue nail polish I wore in the 50′s.

I saw a 65 Mustang yesterday; baby blue.

Have a “dress up day,” you pick the type of “dress up.” Remember fun and surprise are both in so include both. Your employees will probably have some great ideas for the “dress up day.”

Anything you can do to take our mind off gas prices will help us all.

Lisbeth Calandrino
Fabulous Floors
Associate Publisher &
Director of Consumer Research
lcalandrino@nycap.rr.com