When the next data breach occurs, executives who know the facts will have an advantage
1) Data Breaches Will Continue to Escalate
After the Equifax data breach, companies now fear that the question is when, not if, their data will be compromised. U.S. companies and government agencies experienced a record 1,093 data breaches in 2016, a 40% increase from 2015. Moreover, this may be the tip of the iceberg; a significant portion of cybercrime goes unreported.
IBM’s 2017 Ponemon Cost of Data Breach Study reported that as of 2017 the average cost of a significant global data breach is $3.62 million. While this was a 10% decrease from previous years, the size of the theft has increased by 1.8%. On average, more than 24,000 records costing $141.00 are being stolen with each breach.Some studies have suggested that this cost will continue to climb. It is estimated that the expense of data theft will reach $2.1 trillion globally by 2019, four times what it was in 2015. The majority of these breaches will likely come from existing IT and network infrastructure, meaning that the IoT (Internet of things) does not yet figure prominently in these projections. The huge network of smart devices coming on line may present their own security problems, but so far the number of devices breached is minimal in comparison to more traditional computers.
2) Cybercriminals are Becoming Professionals
This cost escalation may be partly due to a change in crime statistics. The average cybercriminal now appears to be greedier, as the hactivist gives way to a more professional class of data thieves. Financial breaches may be relatively small in number, but banking and credit financial leaks have increased to 5.8% of total breaches, up from 3.6% for the first half of 2016. These are small percentages, but the increase suggests that breach trends may be changing.
An IBM study of reported leaks in 2016 found that financial services firms were hit unusually hard that year, on average 65% more often than other organizations. Businesses are seeing fewer casual activists hacks, and instead more precisely targeted breaches aimed at bringing the thief a financial return. For companies, this means that data breaches will continue to become more costly.
Juniper Research report author James Moar believes that this change is why we are seeing comparatively little dangerous IoT malware. He expects IoT hacks that are not financially lucrative will continue to remain a relatively small problem.
“It’s not profitable [IoT hacks],” he noted. “The kind of threats we will see on these devices will be either ransomware, with consumers’ devices locked down until they pay the hackers to use their devices, or as part of botnets, where processing power is harnessed as part of a more lucrative hack.”
3) Most Data Breaches Are Internal Problems
The extraction of meaning from search queries is a very powerful capability that is having repercussions on content creation and usage. The future of semantic search may involve coordinating even more powerful artificial intelligence than is currently possible with semantic search methodologies. When that happens, the resulting evolution of research, optimization and publishing strategies will change the meaning of search again.
Serious threats to information security usually originate internally, partially because the people abusing it already have access to sensitive data. 60% of all breaches are due to current and former employees who, deliberately or not, take proprietary information with them when they depart. 44.5% of insider breaches have been found to be malicious, while 15% are inadvertent. In the latter cases, employees may be accidentally granting thieves company access by opening malware or sending sensitive information to phony email accounts through phishing scams.
The prevalence of insider breaches suggests that the remedy for a cyberattack is as much an issue of correcting corporate culture as introducing technical safeguards. It is pointless for a company to invest in a cutting edge IT system if staff remains ignorant of proper security protocols to follow. And as the government gets into the act by requiring greater data protection and leak transparency, the pressure for companies to introduce reform and better governance will only increase.
Conclusion
It is important that companies have in place a proactive strategy for addressing breaches in anticipation that they will happen. Such a strategy may include:
- Not hiding it. This would only make the problem worse when its magnitude becomes evident to the government and the public.
- Making legal preparations. It is prudent to assume that a data breach will involve litigation; better safe than sorry.
- Having the right deals in place. Purchase data breach insurance coverage or have a strategy in place to address the issue without it. If necessary, consider providing credit monitoring to potential victims in advance of a breach.
Ultimately, data security involves more than making sure that employees learn to recognize and report suspicious emails. It also involves recognizing that given the current climate of insecurity, data breaches will occur.
Technological innovations may ease the threat that individual firms face, but broadening data security throughout the market will require greater federal oversight and redesigned security protocols. If a human component of those protocols is enforced, the change in user behavior may yet prevent more data breaches than technology ever could. Users are still the weak point in any security system – a final, sobering fact that executives should always keep in mind.
COMMENTS