The growth of data sources, data analytics capabilities, and the sheer massive quantity of data in the datasphere, have enabled an unparalleled era of opportunities for product personalization, operational efficiencies, improved consumer safety, new lines of revenue and so much more. However, as organizations collect and leverage data in new ways, efficient and intelligent management of that data and the infrastructure which supports it becomes ever more critical — in part because we’re all also at increased risk of data breaches and cybersecurity attacks.
According to a study by Experian and the Ponemon Institute, 59 percent of companies reported that they’d suffered a breach in 2018 — an increase from 56 percent in 2017. Not only are breaches becoming more common, but the methods for attacks are increasingly advanced.
New strategies are certainly part of the response, and security professionals are innovating daily both on the hardware and software fronts. However, in addition to new prevention methods, organizations should also evaluate whether they’re upholding cybersecurity basics, which go a long way toward preventing many of the most common types of breaches.
The cost of breaches grows
Data breaches cause significant damage — not just in terms of the cost of recovery, but in customer notification, legal fallout, and lost business. A report by IBM and Ponemon estimates that a breach cost $3.86 million on average or $144 per record.
The expenses begin mounting from the moment a breach is detected. Organizations need to mobilize a crisis response that usually includes a security audit and forensic and investigative activities. Then there’s the work of notifying affected customers and mitigation responses, such as a new account and password. There’s also the risk of customers defecting and even filing lawsuits.
The prospect of dealing with even a small breach is what keeps chief information security officers up at night. And lately it seems like no organization or industry is immune. Marriott Starwood Resorts, British Airways, Sing Health, Quora, Facebook, and GooglePlus have all reported data breaches in recent years. Those were just the tip of the iceberg. An especially large recent breach — an attack on Aadhar, which is the Indian government’s portal for storing residents’ information — put the data of more 1 billion individuals at risk. More recently, cyber criminals hacked into the Bulgaria’s tax revenue office and stole more than 5 million records. Last year, Equifax announced it would pay out $650 million to consumers, businesses and governments affected by a 2017 breach, which compromised the personal information of 147 million people.
There’s no turning back
Unfortunately, the pace of these breaches shows little sign of slowing, and tech innovations may actually increase them. For example, artificial intelligence (AI) is making it possible for cyber criminals to automate and then expand their hacking capabilities and reach. In fact, there’s already evidence of hackers using AI to quickly identify network vulnerabilities and launch attacks at an exponential scale.
The proliferation of devices and the Internet of Things (IoT) has also increased the threat landscape, providing additional entry points into networks for credentialed users and hackers to exploit. There are many publicly reported anecdotes of hackers finding their way into consumer IoT devices such as video baby monitors or smart refrigerators.
But the IoT extends well beyond in-home devices, with an increasing reach into the enterprise. Consider the potential for hackers to find a backdoor into a proprietary network via a printer, factory sensor, point-of-sale machine or even connected medical device. In fact, 26 percent of organizations reported that they’d experienced a device-related data breach in 2018.
Staying ahead of hackers
Attacks will continue. For cybersecurity innovators, the trick is getting in front of potential hacks and stopping them. Security experts are experimenting with new strategies in various realms including hardware, software, cloud-related and supply chain initiatives. The methods range from wildly technical to deceptively simple — and all show promise. Here are a few innovative examples:
- Field-level encryption. MongoDB, an open source database platform, provides a feature which operates much like end-to-end encryption by “scrambling the data as it moves across the internet, revealing it only to the send and recipient,” according to a report in Wired. While data encryption is a common practice, it’s usually done server-side — meaning that users with stolen credentials — or internal bad actors — can still access the information. With field-level encryption, users need specific keys to access parts of the data from their device, even after they’re logged into the system.
- Improved hardware security. In the hardware realm, many manufacturers are implementing device-based security measures to ward off breaches. For example, Seagate devices include not only Common Criteria-certified and self-encrypting drives and secure download and diagnostic features for firmware, but also instant secure erase. The latter allows administrators to change the encryption key on any device instantly. Across the industry, hardware security is also moving up the supply chain as manufacturers inspect components and demand third-party security certifications.
- AI at work for the good guys. Keeping up with OS updates and the latest patches is a herculean task in of itself. But security professionals also want to identify vulnerabilities before they are exploited. This is where AI applications may make a difference, offering the ability to scan for potential issues at a rate faster than any human. Technology also enables organizations to automate various security efforts, such as software patching, to ensure they get done regardless of whether a human initiates them.
The basics and beyond
The industry will continue to develop new methods to prevent breaches. However, the fact is that simply maintaining well-known security best practices is still one of the best ways to protect your organization’s data. Even so, less than half of companies report that they have an effective plan in place for preventing data loss and mitigating a breach.
Patching and updating software as soon as possible, and implementing strong credentials and multi-factor authentication are akin to locking your front door—easy, effective ways to ward off data thieves.
Breaches aren’t going away. But educating your organization on new prevention strategies and maintaining a solid foundation cybersecurity best practices can help keep breaches at bay and ensure you can quickly mitigate the damage if one does occur.
