Never Lose Trust: Protect Customer Data

Few things damage customer trust more than a breach of confidential information. Consider that in a survey of consumers, the Ponemon Institute found that 60 percent terminated or considered terminating business with companies that notified them that they had mishandled their private information. Data breaches also have a real impact on the bottom line: $182 for each lost customer record in direct costs, lost productivity, and lost customer opportunity, according to Ponemon.

Historically, businesses' approach to managing data security risks has been more reactive than proactive. "Most organizations have been plugging holes," says Rich Mogull, a research vice president at Gartner Research. But as the risks have escalated, attitudes and approaches have started to change. "Particularly with the new disclosure laws, there is real money involved," says Mounil Patel, vice president and research director at AberdeenGroup. "People are losing their jobs, and when CIOs are worried about losing their jobs, they are more proactive."

A proactive approach to data breach and customer privacy protection starts with encryption of mobile devices, but organizations are also turning to automated monitoring, data discovery and beefed-up authentication technologies to add an extra layer of security. Read on to learn what Sharp Healthcare and Zions' Bank are doing to put company executives and, more importantly, customers at ease.

The Problem of Portability

Breach Source Click to enlarge in another window

More than 90 percent of all breaches result from the loss of electronic information (versus about 9 percent for information in paper form), and the single biggest vulnerability is the loss of laptops and portable devices including removable hard drives and thumb drives (see "Breach Source," at left). A security policy that includes rules on storing data on mobile media as well as physical, device-level security mechanisms is important. However, when device loss does occur, PGP (pretty good privacy) public key encryption remains the strongest defense against data loss. Equally important, it gives a company an exemption against disclosure laws.

"Just encrypt the freaking laptops!" says Mogull. "If you have sensitive data, it's a no-brainer."

Click to enlarge in another window

The use of encryption is increasing (see "Use of Encryption by Data Type," at right). However, encryption is still complex, expensive to deploy and difficult to manage. Rather than practicing full-disk encryption, some organizations are adopting newer approaches in which a rights-management layer is added to the encryption process. As sensitive information is created or as it is accessed from core systems, it is automatically tagged as such, and only then is it encrypted and tracked.

"Where traditional approaches to encryption don't work well is where people have legitimate access to the data," says Patel of Aberdeen. "If users have to hit a button every time they create a spreadsheet, they will get irritated. We are still early in the adoption curve [of automated encryption] because it requires thinking to put together policies, but the trend [in usage] is definitely upward."

1 of 3