Survey: Almost 20 Percent Of Companies Have Suffered Data Loss In Last 18 Months
When it comes to data security breaches, 78 percent of U.S. IT decision-makers feel that companies do not need to inform the general public, according to a recent survey by Clearswift.
While respondents felt the general public did not need to know (78 percent), they did indicate that affected customers and partners should be informed (95 percent) while less than half of them felt that industry regulators (42 percent) or even the police (35 percent) should be notified.
Of the U.S. organizations polled, 19 percent had suffered a data loss in the last 12-18 months, and of those, 50 percent had experienced more than one. Despite the fact that more than 89 percent of those surveyed said that data loss/data breach was a very important or critical issue to their organizations, the research indicated that they are still not locking down the transfer of sensitive information appropriately. E-mail is the most popular method of transferring confidential data (more than 70 percent allow staff to transfer confidential data via e-mail), and yet over a quarter of businesses (26 percent) admit to losing data via e-mail.
To counter the threat, 88 percent have security measures in place to prevent data breaches or data losses from happening. But 28 percent don’t have e-mail content filtering solutions in place, 24 percent don’t have Web content filtering in place and 24 percent don’t have encryption solutions in place. Moreover, 23 percent don’t have a policy on DLP and 10 percent didn’t even know if they had one.
“The survey shows that US businesses consider DLP as very important, but that much still needs to be done to address the issues. With unclear policies and laws that are not thorough or well publicized there is a long way to go before companies really reach the point where data loss protection is truly addressed,” said Mike Lisi, general manager, Americas for Clearswift. “The majority of the IT decision makers that we surveyed have both policies and security measures in place to prevent data beaches. While the majority are prepared, our research shows that when faced with the prospect of having to air some dirty laundry in public, companies are not always confident they will emerge in a positive light, and feel that potential legislation enforcing disclosure could be expensive and create significantly more work for the IT department.”
While the threat of data loss or breach continues to increase, there are still organizations that have not invested in data security. Respondents indicated the following as the top three reasons why:
- 21 percent feel that data loss prevention is not a security threat.
- 37 percent do not have the budget to invest in data loss prevention solutions.
- 16 percent trust their employees to follow the corporate policy.
When asked about the possible impact of data breach notification legislation, 49 percent of respondents that do not currently adhere to data breach notification legislation envision their annual IT spend increasing by at least 10 percent. In comparison, only one in five (20 percent) respondents who currently adhere to data breach notification legislation said they have seen no change in their IT spending since the legislation's introduction.
Additionally 50 percent of IT managers expect any new data breach notification legislation to damage the reputation of their organization, while only 32 percent of respondents adhering to this legislation claimed to have suffered damage to their reputation. Only 11 percent felt that data breach notification legislation would positively impact their business while 31 percent of those currently adhering to legislation indicated the legislation has had neither a positive or negative impact.
“The exposure of confidential information is now the single greatest threat to enterprise network security, according to IDC's latest Security Survey,” said Brian Burke, program director at IDC. “However, the survey also showed that only 34 percent of organizations are currently budgeting for DLP solutions. The top barriers for DLP investment are lack of budget and the belief that solutions are too complex to manage.”