Counting the cost of data loss - could your company afford it?
The recent high profile data breach at ACS:Law, where customers' personal details were published online allegedly after a hacker gained access, via its website, to the internal network, once again emphasises the need for businesses to be proactive when it comes to information security.
Accused of not taking the correct measures to secure the data, ACS:Law could face a fine from the Information Commissioner's Office (ICO) of up to a maximum of £500,000.
Since the breach, ACS:Law has been subject to much scrutiny over how the data was so easily obtained. Questions have been asked regarding the adequacy of encryption, the firewall, the training of staff and why the information was public facing.
The Financial Services Authority (FSA), which regulates any firm or individual that carries out financial services activity, also has the power to impose fines for security breaches resulting in the loss of data.
Recently, the FSA fined the UK arm of Zurich Insurance £2.27m for losing the personal details of 46,000 customers. Other institutions also fined for information security failures include Norwich Union (£1.26m), Nationwide (£980,000) and HSBC (£3m).
A survey released by PricewaterhouseCoopers LLC back in April revealed that 90 per cent of large organisations and 74 per cent of small ones had suffered a malicious security breach via the Internet in the previous year.
Additionally, NTA Monitor's Annual Security Report 2010 shows that of the top ten most commonly occurring high risk flaws (defined as those that allow unauthorised external users to obtain system access), the financial sector was found to be vulnerable to six of these.
With research showing that companies handling sensitive customer information - particularly in the financial services sector - are still not implementing secure measures to reduce data breaches, how can firms protect themselves?
The very minimum is to build perimeter safeguards to prevent Internet-based data security compromises. There are many FSA rules and regulations that businesses in the financial services sector must abide by. Regular security testing should become an established feature of best practice, audit and risk management procedures. This allows organisations to demonstrate that due care and diligence has been taken.
And remember it is not just the threat of financial penalties that should be considered. The damage in bad PR and loss of faith can be considerable, resulting in the need for extra investment in marketing and resources to counteract the impact of the negative publicity that comes with a security breach.
So ask yourself - could you prove your company had robust information security measures in place, if you had to? Could you afford not to?
This article features in the current issue of our newsletter From the Perimeter. Sign up to From the Perimeter for the latest industry insight and comment.
This article was first released on: 10th November 2010