Why Small Businesses Have Zero Information Security — An Honest Talk

We run a free IT audit for every new client

In most small businesses where we've done an initial IT audit, the level of information security is close to zero. Users have administrator-level rights, which means they can install any application on their work computer themselves — including malware, out of ignorance. Passwords for those accounts are either missing or identical — "123", "qwe", "Aa123" and so on — which every colleague knows and which are trivial to guess.

What manager or business owner doesn't want stable, fast work from their fleet of computers? Yet far from everyone takes action to achieve it. Without initiative from management, or at least its cooperation, it's extremely rare to achieve even the slightest change. We're not talking about expensive cryptographic tools or biometric scanners — most of the tools are free, and the only real limit is laziness.

System administrators, too, often simply can't be bothered to deploy centralized management systems (Active Directory), finding plenty of excuses: low pay, no free time, a small fleet, and so on — without realizing that it would ultimately make their own job many times easier. The internet is full of step-by-step guides on how to do it. In Russian.

Network security is no better — shared network resources are open for reading and writing even to the guest account. That means all the files accumulated over years can be deleted from a neighboring computer, by accident and forever. Just by pressing one "delete" key.

Or the poor old port 3389, exposed on a public IP straight to the file server with the password "Qwerty" — practically waving a red flag at any lazy hacker. Another classic. Unfortunately.

And a properly configured — and, most importantly, actually working — automatic data backup is something we have yet to encounter even once.

There's an explanation for all of this: small-business owners don't want to, or can't, pay experienced IT specialists properly. And so they get low-quality expertise.

Our company is no exception to this scheme. We try to pick the best among our clients, because we can't take on everyone who wants a staff of ten IT people for pennies. Many of whom have wives and children 🙂 If you want it cheap — we're clearly not for you. But we do try to stay affordable for the budgets of most companies.

We work honestly. Since 2007.

We wish everyone growth!