The annual Data Breach Investigations Report produced by Verizon has once again garnered the attention of business and technology professionals in helping all understand the reasons for and bottom line impact of information security breaches. This year is no exception. For the just released 2010 DBIR, Verizon collaborated with the United States Secret Service (USSS), one of the world’s premier law enforcement agencies who regularly investigates cyber security crimes. Together these two organizations have produced a document that every business leader and senior executive must read now.
Based on the Verizon survey information from working with industry and additional data provided by the USSS, the 2010 DBIR showed a more accurate insight into insider threats facing organizations. While most data breaches still originate from criminal entities (organized crime) or individuals external to an organization, the facts are clear – insider threats are real and are increasing.
According to the 2010 DBIR’s question Who Is Behind Data Breaches?
70% resulted from external agents (-9%)
48% were caused by insiders (+26%)
11% implicated business partners (-23%)
27% involved multiple parties (-12%)
The increases or decreases for these categories were based on 2009 DBIR data. The 2010 DBIR provides several recommendations for organizations to implement to mitigate these risks—however, I will address three (3) of those recommendations:
Eliminate unnecessary data; keep tabs on what’s left
Today organizations are compelled by regulatory mandates to retain data on their customers, business partners, and operations for a long length of time. However, I have found that many organizations do not have formal data clean up policies and procedures to ensure they are only keeping data records that are vital to their business operations.
As a consultant and advisor to executives and organizations, I’ve seen forgotten data being the most vulnerable for misuse often resulting in catastrophic security breaches for organizations. Knowing what business information to protect and what data to safely dispose of are two critical steps to the success of information security management efforts within every organization.
Ensure essential controls are met
As a result of financial and mismanagement scandals; today business organizations have very strict financial controls. In the technology performance of organizations, implementing strict controls is perceived as a roadblock to operational efficiencies and productivity. A large part of this perception is driven by senior management within organizations. If you are a member of senior management, lead by example. Don’t ask your employees to follow strict controls (IT, financial, and operational) that you are not willing to follow yourself. Effective control adoption begins at the top of every organization.
Audit user accounts and monitor privileged activity
One area of technology adoption where organizations continuously fail to review is active monitoring of user accounts and user activity. Perhaps it is in the trusting nature of personal relations, organizations only conduct active monitoring when inappropriate usage is suspected. No one wants to live in a police state fearing big brother is watching. However, organizations must do more to actively monitor the activities of their trusted employees. All employees in organizations, including senior management should be subject to monitoring of their activities and privileged activities within information systems to ensure transparency and accountability for all actions.
Enduring Idea: The 2010 DBIR provides key insights that business executive and technology professionals should consider in evaluating their information security and data protection priorities. Remember information security and privacy of the information entrusted to an organization is the responsibility of all employees including senior management and every staff member.
To read more about the 2010 DBIR, please visit Verzion’s Security Blog at:
http://securityblog.verizonbusiness.com/2010/07/28/2010-dbir-released/
To download a copy of the 2010 DBIR, please click here.
Jaime Chanaga is founder and CEO of