The study examined the differences in perceptions about the consequences of a data security breach between those companies that experienced a breach and those that have not. The average cost of a data breach was almost $900K, which is almost three times more than what unaffected companies estimated. This lack of awareness about the costs and consequences of a data breach can negatively affect an SMB’s ability to be prepared for a cyber security attack. Although participants stated that the priority for their IT security spending was to meet compliance requirements and implement a data breach response plan, the reality is most companies didn’t have policies in place to deal with a breach of data. In addition, respondents expressed that their biggest frustration in implementing a data security plan was dealing with employee negligence and felt it was unrealistic to expect an organization of their size to be totally secure from a cyber attack. In response, The Ponemon Institute has the following recommendations to improve the current state of cyber readiness for SMBs:
- Like bigger sized organizations, make it a priority to implement formal data protection and security programs to detect cyber security risks.
- Conduct risk assessments and monitoring to identify data breach risks. Establish security objectives and set actionable metrics to be able to measure that your company is meeting security goals.
- Ensure that employees’ mobile devices are properly protected with anti-virus/anti-malware protections and encryption technologies. Identify your sensitive and confidential information that needs security and protection at all times.
- Educate workers through training and awareness programs on the importance of following proper security procedures. Make the business case for investing in cyber security.
As with many things, it’s not the size that counts, it’s the content that is important. And no matter how large or small the business, the importance of protecting that content should always be the first priority in every company’s cyber security plan.
Original article from Experian 22nd Feb 2013