The survey showed that the most popular reason for SMBs not having a "more robust" IT security platform was that it was "not a priority" (29 percent), 25 percent said that a lack of time prevented them from having additional security and 20 percent blamed budget restraints.
Managing director of Symantec, John Donavan, said budgets restraints and lack of expertise are putting small businesses at risk.
"With limited resources and smaller budgets than larger organisations, small businesses can be particularly vulnerable to Internet threats and often lack the appropriate protection," said Donovan.
Despite the lack of monetary commitment to IT security, the survey showed that 95 percent of the responding SMBs have antivirus software installed, 64 percent reported as using firewall software and 43 percent used spam filters.
"The results reveal a high level of technology adoption and sophistication among Australian small business with 66 percent providing Internet access to all staff and an average of 86 percent using notebooks," said Donovan.
The results showed that 61 percent of responding SMBs have experienced a virus attack.
The top four IT concerns amongst SMBs were viruses (21 percent), security (13 percent), Internet speed (13 percent) and spam filtering (12 percent).
However, 57 percent of the respondents said they have deployed a spam filter and reported receiving over 90 spam related emails a day.
The survey was conducted by Bread and Butter research to co-inside with the release of Symantec's new Gateway Security 300 series products.
Research was conducted from interviews with over 200 small businesses in Australia throughout manufacturing, legal, accounting, construction, education and advertising sectors.
Ten percent?
That sounds a bit steep, frankly. Including staff time, we must spend a lot less than that on our in-house solution. We use SpamAssassin, ClamAV, and MimeDefang to great effect. Combined with limited access to CD-ROM and other media on workstations and mail filter policies that quarantine attachments if there's any doubt, we find that everything goes very smoothly. Our firewall (a linux box) has needed almost no attention this year - all we've had to do is a apply a couple of software patches.
I'm sure our spam filtering is less effective than it would be if we used an external service, but it's also a lot cheaper to run. We're also not even using any RBL-based filtering or using SPF yet, so there's plenty of room for improvement.
As our IT budget is otherwise quite large, I'd say we probably spend as little as one percent on security and mail services, most of that being staff time.
Perhaps 10% or more is to be expected of a company that's outsourcing all security services, buys a firewall-in-a-box, and pays per seat for client and mail server virus scanning, spam filtering, and possibly external mail hosting. If you already have in-house IT staff you can often get away with a _lot_ less than that, though.
--
Craig Ringer