We hear about data loss statistics in the news media from time to time when large breaches occur, often in big multi-national companies or government departments. It’s rare for the news media to report the smaller data breaches as they are less exciting, yet this is where much of America’s data loss is occurring. Internal breaches where employees either accidentally lose data, or do so with malicious intent, happen on a daily basis. These statistics are to help give you an idea of how engrained and widespread the problem is for companies of all sizes:
43% of data breaches are internal
This is an alarming statistic and an often overlooked one. A common misconception is that loss of data occurs mainly from malicious cyber-attackers. While external breaches still count for over half of all data breaches, and are certainly on the rise, internal data breaches are also increasing and account for almost half of all data breaches.
If we were to break that number down even further, half of these breaches were done by accident, and half were intentional on behalf of the employees.
So, what does this mean for employers?
The problem is two-fold so it must be approached in the same way. Firstly, a process-driven approach can significantly lessen the number of breaches that occur by accident. A good data loss protection strategy that is effectively communicated to employees will help to protect companies, regardless of their size.
Secondly, it’s important for employees to consider if there are any environmental factors that may cause an employee to release data intentionally. If there is a high incentive for them to release specific information, such as financial reward or other gain, look at how well that data is protected and whether it is able to be accessed only by employees who need to.
Also look at your company culture and assess whether there is any emotional incentive. Disgruntled employees who perceive, rightly or wrongly, that they have not been well looked after, are often overlooked for the high risk that they present to companies. Sometimes, there’s absolutely nothing an employer can do to stop their employee feeling a certain way, hence the importance of a good data loss protection strategy. However, in many cases, these employees would present no risk at all if companies had sufficient processes and schemes in place that made the employee feel valued.
60-70% of all data breaches can warrant public disclosure
This statistic is the most harmful to the reputation of your company. It comes from an Intel study done in 2015 and is even more relevant now as internal data breaches are on the rise. Broken down, the study found that, specifically, 70% of incidents in smaller commercial organisations, SMEs or SMBs, warranted either public disclosure or had a negative financial impact.
So often, the focus around data breach is on infiltration, or attack from the outside and how to prevent it. However, as studies have shown, many breaches actually come from the inside of small to medium businesses. It’s important for employers and small business owners to take notice of these statistics and consider how they could affect their own companies. Our advice is to be mindful of the data that is in your company’s possession and look at ways to prevent it from being released internally through good company culture and an effective data loss protection strategy.