The risk to small businesses from viruses, trojans and malware is on the rise. This is according to a report by the Poneman Institute, which researches data protection. This is because unlike big companies and organizations, they “don't have large information technology staffs and many don't have expensive, sophisticated software designed to monitor their systems and defend against attacks” (See MSN article: Small businesses increasingly a target for cybercriminals).

So what are the options for small businesses and entrepreneurs? Believe it or not, very few. For most of the people that the Colégas Group has spoken to about this, computer security is an always-present fear but very far down the list of priorities… that is, until something happens. Then it’s an all-hands-on-deck emergency for which they will spend entire budgets to get back online – just ask anyone who’s been subject to a ransomware trojan.

Part of the reason is that most small business owners still operate as they did with their home computers. A virus, trojan or malware attack is merely an inconvenience. However, when you run your own business, you may no longer have the luxury of dismissing computer security because your business now depends on a new approach.

A case-in-point

I once assisted a small company in Newport Beach who threw out all their computers to upgrade them – “a good tax write-off” the owner told me. The computers were infected with all sorts of viruses and malware, so they were just too slow to use anymore. I offered to fix the problem, but the new computers were already on their way and my “job was just to get them up.” I tried to explain that these new computers would also be subject to attacks unless they changed their policies and practices, but the owner wouldn’t hear of it. I suppose the cost to “upgrade” was bearable.

However, the problem for most small businesses is that this is an expense they can’t incur. If you are just starting out, you are probably a company of one, you wear many hats, and computer support is just the one you put on late in the evening. If you haven’t fixed it by morning, you’ll call a contractor (like me) and pay him just enough to get you back up. There simply isn’t enough time or budget for more, and certainly not for changing policies and practices. It is just part of being a small business owner.

There is however, one thing you can do and that is to install Linux. Yes, I’ve covered many of the hurdles you will run into when you do, but the one big advantage is that when all your other computers are down because of a virus, trojan or malware, your Linux computer will likely be working just fine. This will allow you to continue working while your contractor fixes all the other systems.

Now this isn’t going to be an in-depth technical discussion about Linux and computer security – there are enough of those online. Instead, I wanted to explain this in layman’s terms for those who are not computer geeks, but who do need to know enough to know what business decisions to make when it comes to computer security.

How Linux is Different

There are three main reasons why Linux offers a real advantage when it comes to computer security. These lie in where Linux came from and while this makes using it a bit less convenient, it also offers greater security as a result.

1. Security through obscurity
   
   You may have heard that Linux is more widely used than MacOS, so one would think it is more vulnerable. However, this is primarily because it is used on servers and larger systems that consequently are also managed by professional teams of people. These specialists can do more to harden them against infection. On the desktop, and especially in use with small entrepreneurs, Linux is extremely rare. Of course, that also makes it much less vulnerable, because hackers who want their viruses to spread widely aren’t interested in obscurity.
   
   2. Linux was not originally designed for mass adoption
   
   Because of its non-commercial roots, Linux was never about gaining large market-share. So, making it easy to use, was a very late development. Consequently, hacking it is also harder. It simply does not offer ways around its security with the same ease and frequency than Windows and MacOS. A good example of this is how passwords are handled. Most people with a Windows or Mac computer do not use complex passwords. They also create shortcuts to those passwords to get to their work faster, and they have common methods for storing passwords. Linux can certainly do those things as well but makes them a less simple to implement - in essence, it discourages them.
   
   3. Linux was designed for large, secure enterprise systems
   
   While the popularity of Linux as a desktop is growing, it still retains many of the enterprise features that make the internal workings very complex, which is harder for hackers to access and manipulate. Linux’s roots lie in the Unix world which was designed for governments and large organizations who managed larger and more important data than your typical home-use desktop computer. They were designed to reduce risk, so being a derivative of these system, Linux retains many of its security features in its overall architecture.

The bottom line is that Linux was not designed from the ground up to maximize convenience or commercial success. In contrast, Windows and MacOS want to encourage users to buy and use their products, so they are designed to minimize such pesky impediments like security. Granted, all operating systems can implement comparable security features, but they all originate from different design goals.

How this impacts small business users

Typically, small business owners purchase consumer-grade products and expect the same level of convenience that they have on their home computers, so security becomes less of a priority. By default, Linux works against those tendencies that place convenience over good practices. While Linux may hamper productivity a bit, it does re-enforce the security features that all operating systems are capable of. With Windows and MacOS those security measures are optional, but by making these security measures the default in Linux, it is simply more secure.

That is not to say that Linux has no viruses, trojans and malware, but these issues typically do less harm to a Linux system. Most of the time, the virus, trojan or malware just sits on the Linux system without doing much harm, because it likely can’t do any harm.

A caveat!

Now that does present a unique quandary if, like me, you are integrating Linux into a Windows network. Just because they typically can’t do much harm to a Linux system, they also tend to not be detected. One bad habit that Linux users have is to not install any security scanners or blockers on their systems because it simply doesn’t affect them. This means that the Linux computer could easily pass the virus on to other computers on the network.

Just like the Newport Beach business owner I mentioned at the beginning of this article, this is both selfish and short-sighted. If they had been working at a larger company or organization, this would be cause for reprimand from above. Unfortunately, small business owners typically don’t have an “above.” This is why I sincerely hope that people like that read this article. It is simply not good practice, not unlike seeing someone breaking into their neighbor’s business and not reporting it.

More to the point, with such an approach, viruses, trojans and malware will likely cause harm to their business eventually - just as the robber will eventually target their business too. These nefarious programs are created by criminals and miscreants. Such people are motivated by finding the path of least resistance for their criminal intent. If that path just happens to be through a Linux computer, then that is the path they will take.

Conlusion

The reason I wrote this article is because I had a persistent malware infection on one of our Windows systems. While my regular methods were able to detect it and (from what I can tell) they were also able to disable it, they were not able to completely remove it. So it was sitting there, and the whole time I was working I was thinking about what that pesky program could be doing – was it snooping on me, was it replicating, was it waiting for a later date to fully deploy its payload?

As soon as I found the malware I followed all the proper procedures. I even removed the computer from the network and the internet. Because I’m a computer tech, I happen to have many systems at home to work on, so I could take that luxury. But what if that was my main computer and I had no other? Would my whole business be down until I removed the virus? Is that how it is in your business? Are you one of those statistics from the article I linked to above?

If so, I highly recommend you read my next article about how I removed the malware, once and for all. By the way, this procedure would not have been possible without Linux…