Companies hiding data breaches

gallery

A survey released late yesterday has found that less than half (40 per cent) of organisations affected by data breaches actually bother to tell customers what’s happened.

Half failed to inform the police or authorities, according to the alarming research findings unveiled by consultancy firm Logica and the e-media group, who surveyed 300 public and private sector organisations.

More than half (57 per cent) of these companies also said they had “no idea” or understanding of the impact of a security breach on their business. And nearly the same percentage believed security was the responsibility of the IT department.

But only 30 per cent of those questioned educated staff in IT security and information handling procedures on a regular basis, while less than a third employ a specific security incident response team.

And, although 63 per cent held personal data subject to European (EU) data handling regulations, only a quarter comply with the ISO27001/2 security standard for storing personal data.

The survey certainly gives weight to other research released yesterday that suggested Brits want data breaches criminalised because of high levels of mistrust over companies handle their data.

But it also strengthens yesterday’s call from the Information Commissioner’s office that Brits should also exercise their Data Protection rights and proactively manage the personal held on them.

Tim Best, director of enterprise security solutions at Logica, said the survey showed up the inadequate security policies and protocols that UK organisations have in place.

But he went further, adding: “It is time to take action – it should be mandatory for all organisations to report significant breaches of confidential personal information to the Information Commissioner or their regulatory body. Only through mandatory reporting will the scale of the problem be understood, which will lead to the correct solutions being applied.”

Best also said security should not be the sole responsibility of the IT department. “It is a boardroom issue and the focus must be to protect the trust that clients have in an organisation,” he said.

Email to a friend

Print this page