All news

Human Errors Cause Data Breaches, Too

January 30, 2012

Although much coverage of data breaches puts the focus on attempts to breach the technology tools most companies use, a new survey draws attention to another element – those caused by human errors. The study concludes that consumer and customer information collected by organizations is at great risk due to employee negligence, insider maliciousness, and system glitches, as well as attacks by cyber criminals.

Aftermath of a Data Breach, sponsored by Experian, conducted by Ponemon Institute, and published in January 2012, included 584 IT practitioners who had reported that their organization had experienced at least one data breach in the previous 24 months. It draws attention to some interesting statistics:

• Human causes of data breaches include negligent insiders (34%), outsourcing to third-party (19%), malicious insiders (16%), failure to shred confidential documents (6%), and data lost in physical delivery (5%).

• Causes of systems data breaches include system glitches (11%) and cyber attacks (7%).

• In 60% of reported incidents, customer data was not encrypted.

The authors also drew attention to an earlier Ponemon study (Reputation Impact of a Data Breach, published in November 2011), which reported that it can take a year after a data breach incident for an organization to restore its reputation. That study also reported that the average loss in the value of an organization’s brand over that year was $332 million.

The negative consequences of a data breach are striking:

• Loss of productivity (50%)

• Loss of customer loyalty (41%)

• Legal action (34%)

• Unfavorable media coverage (30%)

• Customer turnover (28%)

• Decline in company’s share price (25%)

Even after experiencing a data breach, the IT practitioner participants acknowledged that they feel their organizations are still vulnerable to another breach due to:

• Negligent employees, temporary employees, or contractors (66%)

• Negligent third parties, such as vendors and outsourcers (53%)

• Missing equipment, including portable devices (45%)

• Social media (25%)

• Missing backup media (23%)

As noted by Aftermath of a Data Breach, human risk factors are easier to mitigate than those due to outside attacks. In establishing data breach procedures and considering cyber insurance, companies should not overlook the “low tech” solutions that can have a real impact on preventing data loss. Risks can be mitigated through fairly simple solutions such as developing and implementing policies and procedures, providing employees training and raising their awareness, negotiating tighter contractual protections and service level agreements with vendors, and encrypting mobile devices.

Diane Carlisle

NewsWire