The Many Ways Corporate Data Is Lost

Just when we think we have it all figured out about how our data is stolen, someone has to make us think again. Trend Micro took data breach figures collected by the Privacy Rights Clearinghouse over the past decade and found some interesting trends.

First, indeed much of the breach activity reported in the news is from those shadowy hackers, state-sponsored groups, and cybercrime rings with those numbers rising fast over the past couple years. However, when looking at the past 10 years, we are reminded how vulnerable our data is to our employees whether intentional or not. Employee related data leaks add up to a remarkable 70.4% making it obvious that implementing proper policies and procedures around sensitive data is no longer an option. Fortunately, many of the employee safeguards are easy and cost little or nothing to roll out.

2

Following are some ways to help alert you of potential issues as well as containing or mitigating as many as possible.  However, keep in mind there are always more. This list is to get you started:

• Be cautious of what devices are allowed on the company network. Create a “bring your own device” (BYOD) policy and enforce it.

• Ensure that any personal devices that are allowed to connect to the network have anti-malware installed and that users log in using a VPN connection from those when not in the office.

• Implement an employee education program to help teach them how to identify phishing attacks and protect company information.

• Encrypt any devices that employees are allowed to take out of the office. Device loss accounted for 11.6% of the reported breach methods observed in the report.

• Create a patch and update schedule and make sure all systems are attended to according to your schedule and when critical and security patches are released. Apply those as soon as they are available.

• Don’t allow software to be downloaded to corporate systems without permission from IT management or group. Restrict administrator rights on computers and devices.

• Create an incident response plan (IRP), assign roles to the tasks within it, and practice it! Review and update it at least yearly.

• Do regular backups of all corporate data. Depending on how much data and what it is, perhaps even more often than every 24 hours is necessary.

• Test yourselves regularly. Hire an independent company to test your systems with penetration testing, phishing testing, and to test your employees using social engineering methods.

• Have a plan in place for removing employees from network connectivity immediately upon their departure. Enforce that plan.

• Invest in data breach detection products and solutions and maintain and analyze data logs.

Insider leaks seem to be on the rise, but the reasons why are not known. It could be due to more data is being collected, but it also could be because employees are realizing how lucrative a business stealing from the company can be. 

There was a surprising statistic from the report: Payment card fraud was only 1.4%. This just emphasizes that while payment card fraud gets a lot of the press, it’s very important to educate employees and put network protections in place to protect your business.