Protecting Your Most Valuable Asset: Organisational Reputation
Protecting sensitive information has quickly become a top priority for organisations of all sizes. Whether it is an important design, financial data or customer details, organisations recognise that keeping information confidential is critical to retaining their competitive edge. Unfortunately, as the recent number of high profile data breaches demonstrates, those in both the public and private sector remain in the dark about how best to protect the data they hold and continue to make basic mistakes. These mistakes are often widely publicised by the media, resulting in significant long-term damage to an organisation’s most prized asset – its reputation.
If organisations are to protect this valuable asset, they need to ensure that measures and policies are put in place to protect the sensitive information they hold. These safeguards, however, should not be restrictive or hinder productivity. Striking this balance can be challenging but those which combine education with enforced security policies will find they reap the benefits in the longer term.
One of the most significant threats currently facing organisations comes from their own employees who leak sensitive information. In the majority of cases, members of staff who are unaware of the risks associated with their actions inadvertently leak this information. In November 2007, Her Majesty’s Revenue & Customs (HMRC) admitted to losing the details of 25 million individuals – a blunder which affected 7.25 million UK families. The details were lost after a junior official in HMRC sent unencrypted discs to the national Audit Office in the post. The incident, which was widely reported as the most serious data breach to hit the UK, severely undermined public confidence in the government’s ability to protect the identity of UK citizens.
The private sector has also faced a number of significant data breaches. In the US, Whole Foods recently undermined its competitive advantage after plans to take market share from low-cost leader Wal-Mart were revealed in a PDF document. In the document, words intended to be inaccessible were electronically shaded black but made visible after the content was simply copied into different programme. The incident caused extensive damage to Whole Food’s reputation as the breach was extensively publicised in the media.
If organisations are to prevent such negative publicity, it is crucial that employees are made aware of the risks and dangers associated with their actions. This can only be achieved through an ongoing programme of education; draconian policies communicated from the top down will not be effective. Instead, organisations need to involve employees at all stages when developing security policies and continually update them about the latest security threats. In addition, businesses should use technology that alerts users to any ‘risky actions’ they are about to take, such as copying sensitive information onto a disc. The technology should then permit user-based remediation to help employees take appropriate steps to decrease the risk of their actions. Educating employees in this way will increase their vigilance and ensure those who have the potential to cause most damage protect data.
Not all threats, however, can be solved through a programme of education. Employees, for instance, will always lose laptops in airport lounges, misplace USB pens in offices and leave mobile phones behind in taxi cabs. Mobile devices such as laptops will also continue to be stolen by thieves. Last year, Nationwide was fined almost £1m by the UK’s Financial Services Authority (FSA) after a laptop containing sensitive customer data was stolen from an employee. Unfortunately, incidents of this nature look set to increase in frequency in the future as sales of mobile devices increase and flexible working initiatives become more popular, further increasing the risk to sensitive information.
While businesses are unable to prevent these incidents from occurring, action can be taken to limit the extent of the damage caused when they do. Encryption, for example, can help organisations to protect sensitive information stored on mobile devices. Yet despite such benefits, many UK organisations continue to rely on simplistic security measures such as password protection. Unfortunately, as the large numbers of high profile cases continue to demonstrate, this basic measure is often insufficient. If organisations are to effectively safeguard their data, implementing additional measures such as full disc encryption must become a top priority.
In fact, UK companies should learn from their US counterparts who encrypt due to disclosure laws. Californian legislation states that if a company loses unencrypted data, they must inform all customers of the breach. This legislation has been introduced to protect consumers and encourage better security practice, and could be introduced in the UK in the not too distance future.
Measures also need to be put in place to ensure data is protected when employees leave a company as departing members of staff often unwittingly or knowingly take sensitive information with them. This information can include sales projections, financial results and contact lists which are easily saved onto devices such as USB pens and MP3 players. In April 2007, two former Ferrari F1 engineers were convicted of industrial espionage after stealing trade secrets from the company on removable storage devices. These data breaches are particularly damaging when an employee leaves to join a competitor, as they are likely to share the data with their new employer.
If businesses are to successfully tackle this threat, proven technologies need to be implemented to ensure everything from e-mails and documents to mobile phones and PDAs are managed in a controlled and flexible way. Simply blocking devices or implementing stringent policies is not an option for today’s mobile workforce. Successful solutions will be those that provide appropriate users with control so they can make informed decisions when sharing data, while mitigating serious risks.
Implementing such solutions may become a requirement much sooner than many organisations realise. Recent high profile data breaches in both the public and private sectors have resulted in mounting pressure on the government to introduce radical changes to data law. Richard Thomas, the Information Commissioner, who is currently advocating the introduction of US-style reporting laws that require organisations to publicly disclose data breaches, is leading much of this pressure. MPs are also considering changes to data protection laws that would make chief executives directly responsible for keeping the public’s personal information safe and make the improper use of data a criminal offence. The public and media, who now expect organisations to put safeguards in place to protect their personal details, are backing these legislative changes.
In today’s increasingly regulatory and media-aware society, organisations can no longer afford to ignore the risks associated with data leakage. Now is the time to educate employees, roll out encryption and invest in new content protection technologies to enforce security policies. Those who adopt this combined approach will find they are most successful in striking a balance between productivity and protection of the data they hold. Those who fail to take this action risk causing significant and long-term damage to their reputation.