"We find this statistic to be astounding," the study says and offers two likely explanations: "Firstly, and perhaps most obviously, criminals do not want to be discovered. They have great financial incentive to retain access to corporate systems for as long as possible and will go to great lengths to ensure their activities remain under the radar. Secondly, and perhaps most importantly, organizations simply are not watching."
Verizon recommends aligning policy with actual business processes, focusing on essentials to avoid becoming low-hanging fruit for hackers, making sure security controls extend to partners, creating a data retention plan to understand what data is where, actually monitoring network event logs, creating an incident response plan, and conducting mock incident testing.
According to the Identity Theft Resource Center, there were 446 data breaches publicly reported in 2007, 312 in 2006 and 158 in 2005. Verizon's report says that the more than 500 cases its investigators looked at include about one-third of the publicly disclosed data breaches in 2005 and a quarter of the publicly disclosed data breaches in 2006 and in 2007.
But according to Sartin, the publicly reported breaches are "just the tip of iceberg." He said that less than 5% of the more than 500 cases covered in the Verizon study involved some form of disclosure.
Though states have been passing data breach disclosure laws, he said that there are actually fewer data breaches being disclosed now than in the past. The reason, he said, is that each state has a different take on disclosure requirements and other countries often have no disclosure rules.
"Until there is a real consensus-based focus on how to do this right, you're going to see more and more companies find unique ways to sidestep their legal obligations," Sartin said.