InsidePrivacy.com recently published a "survey of data security surveys" that came to troubling conclusions—that data security weaknesses remain incredibly common across industries, despite being easily avoidable. The article does a good job explaining the challenges (and frustrations) for IT security professionals in today's workplaces. Information security protocols change constantly to keep pace with evolving technology and tech hackers. As a result, IT professionals already feel as though they work reactively rather than preventatively. How do we get ahead of the game?
Start with employee education
IT security auditors and consultants cannot preach employee education enough. According to the article, 39% of data breaches result from careless employees. It's a given that most companies require new employees to sign policy acknowledgements regarding IT security policies, but does that mean the employees actually read and understand the exact policies? Consider offering annual training that all employees are required to attend—and make it practical and participatory. Allow the non-IT employees to ask questions, any questions, about the technical stuff, and give examples of real-life scenarios that the various departments in your firm might encounter. If an annual in-person session is not feasible, use online education tools to provide employee training (in the form of a PowerPoint or interactive web session). Incorporate a brief quiz at the end to verify employees have read the materials and understand the policies.
Address mobile technology, including your employee's own devices
With the fast and furious development of mobile technology, you should create, update, and enforce your firm's mobile device security policies often and always. Though the InsidePrivacy.com article says that 23% of companies do not have a mobile device security policy to protect data, our experience suggests that number is much higher. As you start to write your policy, remember that a policy is only as good as what it is in it. The majority of the policies our Information Assurance Group has seen relating to mobile devices are inadequate to meet the sophisticated needs of most companies.
To protect against risks, you need to know your risks
Risk assessments are king in the world of IT security, but an alarming rate of companies, 46%, have not implemented risk assessment activities. As experts in internal controls, our first question to a company without an active risk assessment program would be: "How did you develop your controls without a risk assessment?" A risk assessment forms the foundation of controls development. Without identifying what could go wrong, how do you determine if the current controls in place mitigate those risks?
Be vigilant about public accountability
Why does data security matter? The answers are so obvious that firms often neglect to spell them out for their employees. Beyond protecting the integrity of the firm's business and client information, there is a trend in publicly held companies toward CEO and board involvement in security policies; accordingly, shareholders and even the SEC are holding firms accountable. For any firm, the risk to its reputation can have much longer-lasting effects than any single data breach.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
