Case Study: A Risk Audit of a Very Small Business

Many security case studies focus on large businesses, or on small businesses, for limited values of 'small.' The US Federal Government defines a small business as having fewer than 100 employees and depending on industry an annual income of less than a number ranging from $0.75 Million to $28.5 Million.1 Many businesses however are far smaller than that but could still benefit from security awareness. This is a security audit of one such business focusing on the discovery and risk analysis process. This paper describes the environment determines and assesses risks and addresses the risks that we found. At the start of this process the biggest known risk was uncertainty the 'We don't know what we don't know' factor. Therefore this paper will focus on the discovery and risk analysis process and provide technical details in appendices.