- Cybercriminals have become increasingly sophisticated in the methods they use to breach the enterprise, but the biggest risk may still be plain old human error.
- Recent research shows that lost physical documents, missing memory devices, and misplaced laptops are the source of more breaches than online hacking attacks.
As an industry, we spend a considerable amount of time dissecting the latest cyber attacks and forecasting where the next source of trouble will be. We advocate for enterprises to mount multi-layer defenses against a diverse set of threats leveled by an increasingly well organized contingent of hackers motivated by profit or ideology. However, recent research serves as a clear reminder that the biggest threat posed to an organization’s data security may not be driven by malice or money. In fact, the biggest threat may come from plain old fashioned human error.
Survey findings published earlier this year from joint research by The Society of Corporate Compliance and Ethics and the Health Care Compliance Association show that carelessness rather than advanced threats are the most frequent source of a breach. In the “Data Breach Incidents and Responses” survey of 450 organizations, mislaid paper files, lost memory devices and lost laptops were the most often cited causes of data loss or leakage. This shouldn’t be particularly surprising given how often the human element comes into play even in high profile incidents like the recent loss of a laptop by an employee of Canadian insurance regulator Investment Industry Regulation Organization of Canada, which put personally identifiable information (PII) of more than 50,000 patients at risk.
This isn’t to say that online and other more highly sophisticated threats don’t still loom large for most organizations. However, incidents like the one in Canada highlight the importance of taking a data-centric approach to security. This requires well thought out polices that extend from data creation and data handling through to data transformation, and sharing These policies also need to take into account what kind of remediation efforts should be exercised in the event of a loss. Without these kinds of policies and practices in place, an organization may be leaving its most valuable assets at risk.
Do you think your organization has a good handle on its data security? What steps do you take to ensure employees follow policies and procedures when it comes to interacting with data?