
A study released this week showing survey results among more than 800 IT professionals from small to medium businesses (SMBs) with between 100 to 5,000 employees showed that while SMBs are well aware of the security threats they face, they’re still tackling problems ineffectively. Sponsored by Webroot, the survey shows that SMBs are struggling with new Web-based threats and with dealing with internal risks.

80% of respondents say Web 2.0-based malware will be a problem in 2010.

23% report that they are very or extremely vulnerable to these Web 2.0 applications, such as Facebook, Twitter and Google Docs.24% of SMBs report that they’ve been compromised in the past through social networking sites.

23% of them have also suffered compromise through employees accessing personal Web-based e-mail accounts.

73% reported that Web-based threats are more difficult to manage than e-mail-based threats.

24% of respondents think that they are very or extremely vulnerable to threats from browser vulnerabilities.

32% of organizations have suffered from SQL injection attacks on their Web sites.60% have reported attacks from viruses.57% have suffered phishing attacks.35% have suffered hacking attacks.

24% believe that unpatched client-side software such as Adobe Reader and Microsoft office make them very or extremely vulnerable to attack.25% of organizations say their company is very or extremely vulnerable to threats from Microsoft operating system vulnerabilities.

88% SMBs have an Internet use policy and 56% have Internet use policies against visiting social networking sites.95% say they do something to enforce the policy.

The big BUT, though, is that:69% say enforcement is explaining policies at employee orientation.44% say enforcement is sending explanatory reminders one or more times per year.