Employees & Email Are a Data Security Disaster Waiting to Happen

Businesses are being inundated with threats to their data security as cybercriminals hunt for new stores of data to peddle in the booming dark web data markets. With cybercrime numbers rising daily, it may seem like bad actors are the biggest threat to data security a company will encounter. But that’s not the case. A company’s daily most significant threat to data security is actually a lot closer to home: its employees. Human actions lead to most data security incidents, but companies can mitigate the risk of a data exposure nightmare without breaking the bank.

• What Challenges Do IT Teams Face When Contending with Data Loss Through Email?

The leading case of a security breach will always be human beings. Nearly 60% of organizations in a recent Ponemon Institute study said they had experienced data loss or exfiltration incidents caused by an employee data handling mistake using email in the last 12 months. Other channels leading to data loss because of employee mistakes include cloud file-sharing services (62%) and instant messaging platforms (57%). Drilling deeper, almost one-quarter of businesses studied said they experience a daily security incident caused by employee email handling.

Having a practiced incident response plan is essential because this kind of data loss can be a challenge for IT teams to find. Discovering an email-related data security incident is slow. It takes security teams an average of about three days to detect and remediate a data loss and exfiltration incident caused by a malicious insider via email and almost 48 hours to detect and remediate an email-related data security incident caused by a negligent employee. What makes preventing this kind of data loss so challenging? A lack of visibility of sensitive data that employees transferred from the network to personal email is the most common barrier (54%) to preventing data loss.

• What Are Some of the Reasons Why Employees Mishandle Data?

Getting employees on board with security policy compliance and getting them to practice intelligent data handling behaviour can be a challenge. Many employees don’t know the importance of their behaviour in maintaining security, let alone the importance of maintaining strong security around data. Employee failure to follow security policies is the culprit in an estimated 40% of data losses. That’s often the consequence of poor or little employee security awareness training. An estimated 45% of a HIPAA Journal survey respondents said they don’t need to worry about cybersecurity safeguards because they don’t work in the IT department. That’s not just a data security problem, and it’s a gateway to a cybersecurity disaster.

When considering data security risks, watching for malicious insiders as a source of data loss is essential. A little over one-quarter of the data loss in this study could be attributed to malicious insiders. A company’s proprietary data, like customer records, formulas, blueprints, source code, playbooks, budgets, job bids, and other corporate secrets, can do much damage in the wrong hands. It can also sell for a lot of money on the dark web. It takes security teams up to three days to discover and stop a malicious insider data theft incident that involves email. The more privileged the employee, the longer it can take (and the more damage they can do).

Employees who have recently left an organization or been terminated constitute a significant data security threat, and they’re highly likely to send themselves data via email on their way out. About 45% of employees download, save or send work-related files before leaving. This happens most frequently in the tech, financial services, business consulting, and management sectors. They’ll take everything from client lists to trade secrets. Employees are most likely to steal data like intellectual property within 90 days of their resignation, with 70% of insider intellectual property thefts occurring in that window.

Despite these risks, organizations do not have adequate training in place. While 61% of organizations say that they conduct security awareness training, only about half of them have programs that educate employees about the sensitivity and confidentiality of the company’s data. Failure to invest in security awareness training is a significant barrier to security and compliance success. It’s overwhelmingly apparent that security and compliance awareness training works – and companies that engage in regular security awareness training have 70% fewer security incidents.

Source: ID Agent