Nearly 80 Percent Of Businesses Have Lost Data In Past Year

Seventy-seven percent of organizations have experienced data loss in the last year, according to a study published today.

The survey of 2,400 IT and security administrators, "Understanding Security Complexity in 21st Century IT Environments," was conducted by Ponemon Institute and sponsored by Check Point Software. It indicates that customer information (52 percent) is the most common type of sensitive information compromised in data leaks, followed by intellectual property (33 percent), employee information (31 percent), and corporate plans (16 percent).

The most frequently cited cause for data loss was lost or stolen equipment, followed by network attacks, insecure mobile devices, Web 2.0 and file-sharing applications, and accidentally sending emails to the wrong recipient.

"The survey says that 77 percent of organizations have experienced these types of losses, but I suspect the other 23 percent have had losses and don't know it, or they were not being entirely truthful in their answers," says Larry Ponemon, chairman and founder of Ponemon Institute. "This is the type of thing that happens to almost every company."

Companies often aren't sure where sensitive data resides, and are still frequently frustrated by the loss of data on portable devices, such as laptops and memory sticks, Ponemon observes.

However, Ponemon's research also indicates a slight uptick in the frequency of data compromise by malicious company insiders who are looking to make money by selling sensitive data or are taking out their anger on their own organizations.

"In some cases, we also see outsiders and insiders working together to extract sensitive data from the company," Ponemon says.

Organizations that use data leak protection technology tend to experience less damage from internal leaks, Ponemon says. "If there is a combination of good tools and good judgment in using the tools, there is a positive correlation in the results," he says.

"We understand that data security and compliance are often at the top of the CISO's list. However, if you look at the drivers for data loss, the majority of incidents are unintentional," said Oded Gonda, vice president of network security products at Check Point. "In order to move data loss from detection to prevention, businesses should consider integrating more user awareness and establish the appropriate processes to gain more visibility and control of information assets."

Have a comment on this story? Please click "Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.