The Heartbleed Bug - Small Business Impact
CVE-2014-016, or the Heartbleed internet bug as it is more commonly known, is the latest major scare to hit the internet, again pointing out how much businesses and individuals take the internet for granted as a part of their daily lives. In a nutshell the bug allows users to take advantage of a potential weakness in the way data is encrypted, then through a trial and error process gain access to the data stored within the server memory, which could be anything from user logs to passwords and encryption keys.
One thing to highlight first. The Heartbleed bug is not something that an average computer user is going to be able to take advantage of. It does require a decent amount of computer literacy (say that of a low to medium level software developer) to take advantage and even then the process requires time and effort, it's not a simple 'back door' into your system. That said, there are unfortunately many people who have this level of ability and are unscrupulous enough to try, meaning that it is imperative that businesses protect themselves urgently to prevent their data ending up in the public domain or in the hands of the wrong person.
The problem for small businesses is that many of them do not have reliable IT support, either due to cost or it simply not seeming a necessity. However with dependence on internet and emails at an all time high, not having the right IT support is like driving a car with no insurance. You might get away with it for a while, but in the end it's likely to land you in serious trouble. One business who has successfully hardened their infrastructure and protected their clients is Digivo Ltd. The Managing Director of Digivo, Matthew Foster, said that "the Heartbleed Error further highlights that small business need to protect themselves with their IT services. The problem with Heartbleed is that it's virtually impossible to know if you have been a victim, also that there is more action required than simply applying the patch and updating your affected software. If you have been a victim and someone has discovered your encryption key for example, updating your software won't fix the problem. There are many potentially far reaching issues which could present data protection problems for businesses, especially small businesses who do not have the right IT support infrastructure."
The long term impact of the Heartbleed bug will not become apparent for months. However it is strongly recommended that businesses contact their IT support service for more information, or visit http://heartbleed.com.