What is a Data Breach?
Data Breaches Defined
Anytime information that is not meant to be publicly available is accessed without permission, this is a data breach. There are many reasons why this might happen. Some are due to mistakes people make, such as not changing their passwords or downloading a document that contains viruses. Others are due to system flaws, like out-of-date software or lack of proper encryption. Regardless of how the data breach happens, attacks are costly.
According to a Hiscox study, the average cost to a business with fewer than 250 employees was $35,678. For a business with 250 to 1000 employees, that jumps to $397,612. The costs are a result of actual lost money or the loss of the company’s ability to do business. On top of that, there are extra wages as overtime work occurs, disaster recovery costs, possible public relations costs, if consumer confidence was damaged, and updates to any systems that might have contributed to the data breach.
Attacks happen because data is valuable. Sometimes its value is in the form of being better able to target people with advertising. Often having the right data makes it easier for criminals to steal money. And even more frightening, data could be stolen to gain access to critical infrastructure systems, causing mayhem throughout the world.
Danger Exists
Data Breach Examples
To get a sense of how wide-spread the danger is, consider the Marriott data breach in November 2018. Here hackers gained access to the guest registration system. They were able to gather passport, address, travel and other information from 500 million people who had stayed at the Starwood chain since 2014. This is one of the biggest data breaches on record. Time will tell if the hotel chain incurs fines from the newly implemented GDPR, but it is certainly possible, given that many of the records belonged to EU citizens.
While significant, this is not the only recent data breach. In December 2018, Facebook reported that over 6.8 million photos that had not been earmarked for public display were available for a period of time. In spring of 2018 Google reported that flaws in its Google+ platform left hundreds of thousands of user accounts unprotected. The list continues. It doesn’t matter how big your company is; it’s at risk.
Stay Safe
Protect Your Business from Data Breaches
Keeping hackers at bay may seem nearly futile. If Google can’t do it, how can your business? But there are certainly ways in which you can counter the efforts of cybercriminals.
To keep your customer and personal data safe, work with an expert to:
- Install notification and alarm systems
- Review and update system access controls
- Test access to the physical environment, as well as the proper functioning of emergency systems
- Evaluate vendors with whom you share data to ensure that they too have proper safety practices in place
- Apply all software patches immediately
- Enforce password updates. Where possible, consider biometric alternatives.
- Use encryption tools, firewalls and virus protection software
- Educate, educate, educate. Teach everyone to comply with all policies, avoid unsecured networks, understand possible scams and keep their mobile devices safe.
And, while it doesn’t necessarily protect your business from a data breach, one other preventative measure your business should take now is outlining incident response processes. Document who should be notified when an attack occurs, when and how this notification will happen and how you’ll track the steps you take to resolve the situation.
Respond Quickly
What If You Experience a Data Breach?
Speed is the key to minimizing the damage that can occur. So once you have your response processes documented, consider automating them. Incident response systems can help reduce the time it takes between an incident being discovered and action taking place by automating notifications and communication.
Once this process kicks off, remove the impacted device(s) from the network as quickly as possible to avoid additional damage. Examine what data the device has accessed, as well as what data is stored on it, to determine how it has been compromised and if the damage could have spread to other parts of the network. Next, as you try to recover the device, try to determine how the data breach happened in the first place to avoid recurrences.
Finally, be honest with your customers. Clearly communicate what happened and why. Help people understand if their data has been compromised and what they can do to protect themselves now.
Data breaches can be costly and time consuming, but they are a very real threat to today’s businesses. Be sure to take steps to prepare your business and reduce the impact, should an attack occur.
Respond to Data Breaches Faster.
Learn how OTRS service management software can help your team respond to data breaches more quickly.