Study: Organizations With Enterprise-Wide Approach To Encryption Experience Fewer Data Breaches
PGP Corp. recently announced the results from a second annual study by The Ponemon Institute identifying key areas of focus in enterprise encryption use, planning strategies, budgeting and spending, deployment methodologies, and impact on data breach incidents. The key findings of the 2008 Annual Study: U.S. Enterprise Encryption Trends demonstrate organizations continue to move towards a more holistic approach to encryption including a larger focus on key management, especially those organizations identified as having the most effective IT organizations.
The study of nearly 1,000 U.S.-based IT and business managers, analysts and executives (40 percent at the director or VP level), identifies a new trend that shows organizations with a more strategic, enterprise-wide approach to encryption have experienced fewer data breaches. In response to increasing demands for data security, 21 percent of organizations surveyed now having an encryption strategy applied consistently across the organization, up from 16 percent in 2007.
"This study continues to break new ground in identifying enterprise IT security trends," said Dr. Larry Ponemon, chairman and founder of The Ponemon Institute. "Organizations are spending significant portions of their encryption budgets on key management and are looking for more complete solutions from a single vendor instead of point products. With more organizations experiencing data breaches, those who deploy a holistic enterprise encryption strategy will significantly reduce their risk."
The study also shows that 84 percent of organizations surveyed suffered at least one data breach over the last 12 months with 44 percent of organizations suffering two to five breaches during the same time period. However, organizations with an enterprise encryption strategy showed a statistically significant lower rate of data breaches. This demonstrates that an encryption strategy, especially one implemented across the enterprise, reduces the costs and brand damage associated with data breaches and likely leads to a more profitable business.
Other key findings in this year's research include:
Encryption use across multiple applications growing. Respondents reported the consistent encryption of laptops, file servers, e-mails, and backup tapes increased. Laptop encryption is the most common, with 20 percent reporting use most of the time.
Key management is more frequently budgeted for in 2008 as organizations seeking to reduce operational costs prefer to choose just one enterprise vendor. Organizations surveyed on average plan to spend 34 percent of their total encryption budget on key management solutions:
- 45 percent of organizations expect their key management investments to reduce the overall operational costs of enterprise data protection.
- 58 percent of organizations expect to deploy a single enterprise- wide key management solution or deploy a single vendor's key management solution for different purposes in 2008.
- Only 13 percent of organizations are seeking a tactical key management solution for just one encryption application.
Organizations more interested in a platform approach. With a need to enforce policy and increase automation for key management, respondents were overwhelmingly interested in a platform approach, with up to 75 percent rating key features as important or very important. Respondents believe a platform approach enables their business to reduce expenses and improve productivity and identified these top three benefits of this approach:
- Reduction of operational expenses (63 percent of respondents).
- Flexibility to add other encryption applications in the future, as needs (61 percent).
- Elimination of redundant administrator tasks (54 percent).
Finding that organizations with enterprise-wide encryption strategies are reducing the risk of data breaches and organizations overwhelming prefer a platform approach to encryption is significant in the evolution of data security. The increased interest in automated policy enforcement, single administration interface, and comprehensive key management continue to favor adoption of an encryption platform solution. The preference for adopting this approach to managing multiple encryption applications from a single console continues to mirror the progression seen with other important enterprise applications such as ERP and CRM.
Recent research conducted by the Ponemon Institute found the cost of a data breach averaging $197 per record compromised or an average total of $6.3 million per breach. For the third year, research by The Ponemon Institute revealed the average cost of a data breach continued to rise, growing 43% since 2005 to an average $197 per record compromised. With a very real impact, data breaches cost an average of $6.3 million.