Spyware: Not a Friend to Small Businesses
Surreptitiously installed programs can compromise privacy and data security, and tax system resources.

By Kevin Haley

The number of high-profile data breaches this year should serve as a warning to small businesses about the damage a data security leak does not just to your business transactions, but also to your reputation.

One of the most imposing risks for small businesses come from spyware and its supposedly less harmful cousin, adware. These surreptitious applications are overwhelming networks everywhere and stealing sensitive, personal information, while enabling identity theft and tracking of online information.

Spyware is the term used for a program that is installed on your computer without your knowledge and that covertly monitors the activity on your computer, gathering personal information and monitoring Internet behavior. After gathering this data, spyware transmits it to another computer, usually for advertising purposes, but sometimes for a malicious purpose.

Despite the obvious risks associated with spyware, a recent Forrester report found that 56 percent of customers could not predict what percentage of their systems was infected with spyware.
What steps can small businesses take to guard against spyware and adware? And how can they fight back?

Understand the Threat
The first step is to recognize and understand the threats spyware and adware create for small businesses.
The largest threat spyware imposes is its ability to steal sensitive personal or business-related data. But, it also can pose other threats that are often overlooked:

• Privacy impact. The obvious cost that most people consider, spyware compromises privacy by capturing information about users for use by a third party.
• Network traffic impact. Less obvious than the privacy impact, it is often more costly to a company's success. Spyware can slow systems, cause system crashes, bog down Internet connections and cause unusual Web browser behavior.
• Employee productivity impact. Difficult to measure in terms of financial impact, small business employees who are constantly fighting spyware and adware on their systems are less productive. Often PCs are replaced if spyware is not identified as the problem, adding to the cost.

Adware is often more predominant in a small business than spyware. Similar to spyware, some forms of adware will install themselves without any human interaction. Adware can risk the disclosure of confidential data by redirecting unknowing individuals to "look-alike" Web sites. Although it is less harmful, it is constantly eating up network traffic to pull down graphical ads. So, business owners also should consider adware's potential impact on system resources.

Fight Back
Although it can be difficult to eradicate spyware from your system, there are steps you can take to drastically reduce the financial impact caused by malicious spyware. Obvious steps include installing an antivirus solution, securing encrypted Internet connections, implementing more restrictive Web browser settings and disabling the acceptance of third-party cookies. But to deal with spyware's hidden costs, consider the following steps:

• Keep your computers current with the latest patches and updates
• Make sure your computers are configured securely
• Choose strong passwords and keep them safe
• Review bank and credit card statements regularly

Plan Ahead of Time
You need a solid plan to regain control of your environment and systems. Some questions to consider when developing a security plan are:

• What is your normal bandwidth usage? Examining your bandwidth usage and understanding when spikes occur that are not consistent can help you determine when threats are elevated.
• Are you regularly scanning your systems? Conducting full system scans can identify and quarantine spyware and adware that are known to be malicious before they get out of hand.
• Does your staff understand the difference between spyware and adware? Hold classes to instruct users on the differences between these two threats.
• Do you have a company policy for software installation?

As dependence on technology grows, developing a plan to combat spyware and adware is crucial. The financial consequences to a company's brand integrity and trust in the marketplace are enormous should a system breach occur.

Spyware doesn't have to be a problem, but you need to take proper steps to protect your small business and ensure the security of your sensitive information.

Kevin Haley is group product manager at Symantec Corporation.