Ryan discusses how medium and small businesses need to be thinking about an information security program.