Top 6 Causes of Data Breach and How to Plan Against Them

The news is full of high-profile data breach incidents: Target, Coca Cola, AT&T, Snowden. A wide range of data breach incidents that cost these organizations millions and made them media targets. And data breach is a pervasive issue; in 2011, $48 billion was lost due to data breaches in the US alone (our security breaches infographic breaks down these breaches by industry and cause). There is a lot to learn from each high-profile data breach story, but given the variety of situations, choosing the right practices and tools to prevent data breach can seem like a stab in the dark.

A good place to start, though, is recent research from Forrester that reveals the top 6 common ways that data breach occurs, which account for the majority of incidents. Inadvertent misuse by insiders and loss/theft of corporate assets top the list, showing that often, it’s not malicious activity that results in breach.

So what actionable learnings can organizations take away with them? Here are some best practices to address these top causes of breach:

• Inadvertent misuse by insider: Establish and maintain control across your entire mobile environment with customizable policies. Enable or restrict data access and sharing for employees based on their job role and needs. With a solution that intelligently controls data access through file classification and rule-based permissions, you can ensure that even if data is inadvertently shared with the wrong person, it will not be exposed.
• Loss/theft of a corporate asset: Protect data on devices with encryption, and leverage a solution that provides the ability to remotely wipe data from a lost or stolen device, whether it’s a laptop, smartphone, or tablet.
• Phishing: Educate your users on phishing tactics with annual training about how to recognize phishing scams. Implementing an intelligent firewall that will detect and stop phishing emails can be a way to prevent phishing scams from reaching users.
• Abuse by malicious insider: Maintain visibility into how users are accessing and sharing data with detailed audit trails that show a file’s chain of custody. Combine this with the ability to revoke access to all data or just specific files and folders for complete control of data access and sharing.
• External attack targeting business partner/third-party supplier’s servers or users: To ensure that your business partner and suppliers maintain the same level of security as you do, establish a clear set of policies. Having an agreement in place with certification standards and predefined requirements will help ensure your data is protected when it resides with third parties.
• Loss/theft of a business partner asset: Manage data access for 3rd party vendors and business partners. Grant access to only relevant files and folders. Allowing view-only or automatic link expiration by user identity will help ensure appropriate access.

By addressing these six scenarios, you can proactively guard against data breach and learn from the hard lessons of the past.

For more actionable how-tos to protect corporate data on laptops and mobile devices from breach and loss, check out our Survival Guide for Data in the Wild.