McAfee: Breaches Escalating Despite Better Education, Technology

Despite increases in security education and technology spending, breaches continue to soar, and on average IT pros have dealt with six breaches over the course of their professional lives.

That’s according to McAfee’s new report, Grand Theft Data II – The Drivers and Shifting State of Data Breaches. The company surveyed 700 IT security professionals from commercial and enterprise organizations globally to learn about their data breach experiences.

Despite improvements in combating cybercrime and threats, IT security professionals still struggle to fully secure their organizations and protect against breaches, with 61% claiming to have experienced a data breach at their current employer.

Adding to this challenge, data breaches are becoming more serious as cybercriminals continue to target intellectual property, putting the reputation of the company brand at risk and increasing financial liability.

McAfee’s Candace Worley

Candace Worley, vice president and chief technical strategist at McAfee, tells us data exfiltration is a risk whether you hold the data in your data center or your provider holds it in his/her data center.

“Whether you’re managing your security or you’ve outsourced it to someone else to manage, you’re ultimately the one that will be held accountable for a data breach,” she said. “That means that organizations that leverage service providers need to build into their contracts language that protects them as much as possible in the event of a data breach. For example, the ability to audit security controls, understand where their data is being stored (both primary and back-up versions), SLAs on remediation and liability in the event of a breach, [and so on].”

There is a big difference between what the law says and the court of public opinion, Worley said. The laws may be on your side depending on your geography, but if your service provider loses your data, your customers likely will still hold you responsible, she said.

The McAfee report highlights the following:

Organizations need to practice good digital hygiene, Worley said.

“The cloud has taught us that you can …

… patch the same day a patch becomes available and the world won’t come to an end,” she said. “Not patching may result in a breach that makes you wish it would come to an end. How many major breaches have we seen over the last 24 months that could have been avoided if applications and operating systems had been patched in a more timely manner?”

In addition, organizations need to educate their teams on what it means to implement security in the cloud, Worley said. Although the cloud “isn’t quite the Wild Wild West anymore, there is still a lot of learning to do when it comes to how to secure your data and applications across IaaS, PaaS, and SaaS,” she said.

“Third, one of the top data exfiltration methods called out in the report is USB drives,” she said. “How long have we had file and removable media encryption and DLP? You can password protect and encrypt data, ensuring that it is secure on a USB drive. You can implement DLP policies that prevent confidential data from being moved on the drive in the first place. There are very straightforward tools that address this threat that are not onerous for organizations to implement. They can be managed to limiting impact to user productivity while materially mitigating the risk of a breach.”