|
|
|
|
| 
Practical Help
No matter how much effort companies put into preventing the loss of sensitive data, breaches still occur with alarming regularity. Companies need to respond to the potential exposure of personal and confidential information quickly and proactively to manage their regulatory obligations and to protect their brand reputations.
Data Breach Readiness: Seven Steps to Help Organizations Stay Prepared by Intersections Inc. is a guide for companies of all sizes and makes these recommendations for handling a breach.
- Assign responsibilities
- Choose a response
- Know regulatory, state and federal requirements
- Prepare to take care of your customers
- Implement a breach response operation
- Create a communications plan
- Test the plan.
ITAC Sentinel was developed by ITAC and Intersections to help companies prepare and respond to data breaches.
|
|
|
|
|
| Key Findings of the 2009 Report |
|
|
|
This year's key findings by the Verizon Business 2009 Data Breach Study support last year's conclusions and provide new insights. These include:
- Most data breaches investigated were caused by external sources. Seventy-four percent of breaches resulted from external sources, while 32 percent were linked to business partners. Only 20 percent were caused by insiders, a finding that may be contrary to certain widely held beliefs.
- Most breaches resulted from a combination of events rather than a single action. Sixty-four percent of breaches were attributed to hackers who used a combination of methods. In most successful breaches, the attacker exploited some mistake committed by the victim, hacked into the network, and installed malware on a system to collect data.
- In 69 percent of cases, the breach was discovered by third parties. The ability to detect a data breach when it occurs remains a huge stumbling block for most organizations. Whether the deficiency lies in technology or process, the result is the same. During the last five years, relatively few victims have discovered their own breaches.
- Nearly all records compromised in 2008 were from online assets. Despite widespread concern over desktops, mobile devices, portable media and the like, 99 percent of all breached records were compromised from servers and applications.
- Roughly 20 percent of 2008 cases involved more than one breach. Multiple distinct entities or locations were individually compromised as part of a single case, and remarkably, half of the breaches consisted of interrelated incidents often caused by the same individuals.
- Being PCI-compliant is critically important. A staggering 81 percent of affected organizations subject to the Payment Card Industry Data Security Standard (PCI-DSS) had been found non-compliant prior to being breached.
|
|
|
|
|
|
|
