Many people are unaware of how vulnerable they are to data breaches. Anyone is at risk of experiencing a data breach from a single individual to corporations and governments. It is the person or organisation’s responsibility to protect their data. Since the introduction of GDPR, it is a legal liability for companies that carry fines up to €20 million or 4% of turnover.
Â
What is a Data Breach, and how do they occur?
A data breach can be defined as a security violation in which sensitive, protected, or confidential data is copied, transmitted, viewed, stolen, or used by an individual unauthorised to do so.
The compromisation of data can have adverse effects for both the party that has had their data breached but also the people or organisations who have had their data stolen/exposed.
Breaches will happen due to weakness in either the technology or user behaviour. Data breaches are not always from the outside of an organisation; it can come from inside.
Â
- An accidental data breach can occur when an unauthorised person views sensitive data. Even if the data is not shared, it would still be considered a breach of data because a person saw it with no authority to do so, and this could have many repercussions.
- A malicious insider data breach is when sensitive data is purposely accessed by an unauthorised individual and shared/exposed with intent to cause harm to the company/organisation.
- Another form of a data breach is when an unencrypted and unlocked device containing sensitive data is lost/stolen.
Most data breaches will come externally to the organisation and commonly by a cyberattack, which can happen by way of different methods;
- Phishing
- Brute force attack
- Malware
How to prevent data breaches?
Companies and organisations need to take the necessary steps to protect the data they hold. Protecting data of customers/clients is crucial for building trust between the company/ organisation and the customer/client. There are several practices to consider when looking to protect a company’s data from breach;
Â
Â
- Patching & updating software to help ensure any known vulnerabilities are repaired and secured.
- High-grade encryption on all devices to protect the sensitive data it contains should it be stolen or lost.
- Ensure all devices connected to the network/servers have adequate antivirus protection and business-grade VPN, including any “bring your own devices” employees have been allowed to use in any way to access company data.
- Use strong credentials and multi-factor authentication to protect data from being accessed by password guessing.
- Educating employees on the importance of data protection and potential vulnerabilities. Increasing awareness will help reduce the possibility of mistakes that can lead to data breaches. Also giving them the tools to recognise possible malicious behaviour in others.
- Using intruder detection on any systems that are accessible to the internet such a servers and email systems, to protect the data contained within them.
- Backing up to the cloud will eliminate the risk of sensitive data being stolen from backup drives and data backup tapes.
- Systems should be very regularly scanned and checked for vulnerabilities. Security can only be as strong as the weakest point in the system. So a regular risk assessment will minimise the risks of data breaches.
- Implement automated safeguards such as password checking and assess firewall configuration. Automated safeguards will aim to reduce human error, which accounts for most cases of data breaches.
By following these practices, organisations and individuals can significantly reduce the chance of a data breach and in turn protect your company and personal data.
Â
