A report by the Applied Research Laboratory at Penn State University, Understanding Security is targeted to incite immediate action to secure the critical information held at Small to Medium Businesses (SMBs). Special focus is given throughout to establish business value that will drive substantive action. First, the realities of escalating informational threats to SMBs are illuminated through examples and details of attacks. Second, a list of ‘100 things under $100’ that can be done to mitigate risks and vulnerabilities is provided. The inclusion of specific measures in this list follows the findings of a survey of small businesses and a realistic assessment of the current state of security and the expertise and capabilities possessed by SMBs. Context and sufficient technical detail are provided for espionage techniques, organizational policies and contemporary computer technologies to allow managers to understand the driving factors for these measures.