Best practices to help prevent online data breaches

The Online Trust Alliance (OTA) recommended a series of best practices to help prevent online data breaches and other exploits.

Leveraging preliminary year-end data from the Open Security Foundation and the Privacy Rights Clearinghouse, the OTA estimated in its guide that over 740 million records were exposed in 2013, making it the worst year in terms of data breaches recorded to date.

And yet, after analyzing approximately 500 breaches over the past year, the OTA determined that 89 percent of all breach incidents were avoidable had basic security controls and best practices been enforced.

“Businesses and organizations have a responsibility to protect consumer privacy and prevent data breaches from aggressive cyberthieves,” said Washington State Attorney General Bob Ferguson. “Consumers deserve to know who they can trust. The Online Trust Alliance arms organizations with critical information to reduce cyber risk and protect consumers.”

The annual guide is being published in advance of Data Privacy Day, Jan. 28, which the OTA commemorates by holding town hall forums and workshops led by cybersecurity and privacy luminaries in New York, San Francisco and Seattle. These events come on the heels of several high-profile data breaches victimizing Target Corporation, Neiman Marcus and Adobe—a disturbing trend that undermines online trust and underscores the need to implement best practices.

“Data breaches are nothing new and have been around for quite some time; however, what we are seeing is a significant increase in incidents that not only harm consumers, but businesses as well, leading to a breakdown in consumer trust,” said Tim Rohrbaugh, OTA Board Member.

“Having a rigid, black and white approach to security controls and monitoring and being unprepared for an incident will cost businesses more in the end. These town halls are a great venue for business leaders in all sectors to come together and share best practices in improving security controls, customer data management, and data breach incident reporting,” Rohrbaugh added.

According to the guide, best practices can only be achieved when companies are no longer complacent with meeting minimum compliance standards for data protection. Rather, they must meet the far loftier data privacy expectations of their own customers, by adopting a comprehensive data stewardship strategy that safeguards data across its entire lifecycle, from collection to deletion.

Such efforts go hand in hand with developing an effective Data Incident Plan (DIP), a playbook that can be deployed on a moment’s notice, delineating what steps must be taken when a breach happens. Businesses must be able to quickly assess the nature and scope of an incident, contain it, mitigate the damage and notify all interested parties, including law enforcement and affected customers.

“Consumers and businesses are both victims of rapidly escalating hacking attacks, and as stewards of consumer data it’s incumbent on businesses to adopt best practices to help protect consumers from harm,” said Craig Spiezle, executive director and president of the Online Trust Alliance. “Those companies that fail to do so need to be held accountable, by consumers, regulators and stockholders.

Indeed, the ramifications of a data breach can be far-reaching and long-term, creating a sort of “business shock,” explains the guide. Consequences include a damaged brand, decreased sales, loss of third-party partnerships and contractual penalties imposed by customers, partners or service providers.

Ultimately, the guide urges all businesses to accept two fundamental premises: One, the consumer data they are collecting invariably contains some form of personally identifiable information. And two, at some point they will inevitably experience data loss. When that happens, it’s best to be prepared.

OTA’s 2014 Data Protection & Breach Readiness Guide is available here.