When it comes to data security breaches, the general public doesn’t need to know

When it comes to data security breaches, 78 percent of US IT decision-makers feel that companies do not need to inform the general public; this according to a recent survey by content security specialists Clearswift. While respondents felt the general public did not need to know (78%), they did indicate that affected customers and partners should be informed (95%) while less than half of them felt that industry regulators (42%) or even the police (35%) should be notified.

Of the U.S. organizations polled, 19 percent had suffered a data loss in the last 12-18 months, and of those, 50 percent had experienced more than one. Despite the fact that more than 89 percent of those surveyed said that data loss/data breach was a very important or critical issue to their organizations, the research indicated that they are still not locking down the transfer of sensitive information appropriately. E-mail is the most popular method of transferring confidential data (over 70% allow staff to transfer confidential data via e-mail), and yet over a quarter of businesses (26%) admit to losing data via e-mail.

To counter the threat, 88 percent have security measures in place to prevent data breaches or data losses from happening. But 28% don’t have e-mail content filtering solutions in place, 24% don’t have Web content filtering in place and 24% don’t have encryption solutions in place. Moreover, 23% don’t have a policy on DLP and 10% didn’t even know if they had one.

While the threat of data loss or breach continues to increase, there are still organizations that have not invested in data security. Respondents indicated the following as the top three reasons why:

• 21 percent feel that data loss prevention is not a security threat,
• 37 percent do not have the budget to invest in data loss prevention solutions, and
• 16 percent trust their employees to follow the corporate policy.

When asked about the possible impact of data breach notification legislation, 49 percent of respondents that do not currently adhere to data breach notification legislation envision their annual IT spend increasing by at least 10 percent. In comparison, only one in five (20%) respondents who currently adhere to data breach notification legislation said they have seen no change in their IT spending since the legislation’s introduction. Additionally, half (50%) of IT managers expect any new data breach notification legislation to damage the reputation of their organization, while only 32 percent of respondents adhering to this legislation claimed to have suffered damage to their reputation. Only 11 percent felt that data breach notification legislation would positively impact their business while 31 percent of those currently adhering to legislation indicated

All the above figures, unless otherwise stated, are from Clearswift. Total sample size was 3,340 US IT decision-makers. Fieldwork was undertaken between March 10 and April 10, 2008. The survey was completed online.