Every business, every day, generates an incredible amount of data. The easiest and cheapest way to store all this information is to adopt the ‘landfill’ model of keeping everything and moving as much of it as possible to the cloud. But we find that many are doing this without even trying to keep track of what they have.
Our survey suggests that less than two in three businesses (65%) are taking steps to understand their data; they are largely in the dark about how much there is, what it does, and what harm it could cause if compromised. And if they don’t know these basics, how can they be sure they are looking after it properly?
More than one in three (36%) organisations do not assign a risk profile to their data. Considering what they stand to lose if their data is compromised, this is surprising. One explanation may be that, although the C-suite accepts that cyber security is a risk, leaders are still not doing enough to directly ‘sponsor’ mitigation efforts. Another is that the risk function has largely focused in the past on a limited number of insurable business risks. As a result, legacy risk teams are less experienced in predicting, managing and pricing non-physical threats such as data breaches. This needs to change.
More than three-quarters of businesses (78%) are building a baseline of cyber protection without putting in place specific measures to lock down their most precious data. At worst, this means they are implementing expensive firewalls that protect data of little value, while their most critical information assets – those which are necessary for the business to carry out its core function – are more exposed than they should be.
For most organisations, it would be practically impossible to assess and rank every spreadsheet, archived email or data file that is generated every day. It’s also a process that cannot be completely automated: understanding the risk and value of data requires human judgement.
Getting it right also takes imagination: being able to think like a cynical and opportunistic hacker and identifying data that would disrupt the business if compromised or compounded. Yet qualitative reasoning should also be counterweighted, as much as possible, by quantitative analysis. What would be the financial impact of a major breach? Would the impact always be the same? And what is the statistical likelihood of it happening?
Getting to grips with data is time-consuming and, to be successful, needs to become part of business as usual. This means creating enterprise-wide leaders of the activity as well as individual owners of data assets. Yet many employees, given responsibility for data on top of their day-to-day tasks, try to sidestep the extra work.
At worst, we see passive avoidance – where employees mark data as being lower risk than it is purely in order to get out of the ‘hassle’ of protecting it from hackers. To manage cyber risk effectively, businesses need to anticipate this reaction from employees and take steps to prevent it from happening.
First, data security should be treated as an enterprise-wide, consistently applied risk that is led by the C-suite and then implemented by employees at the operational level. Second, data understanding needs to be built into projects by design, with a multidisciplinary team seeking agreement on the biggest data-related threats to the business. Finally, all engagement – whether communications from the top or training – needs to take place on a ‘human’, non-technical level.
