Businesses Ignore Significant Cybersecurity Risks to Proprietary Data

Knowledge assets are critical to any business remaining functional and competitive, yet this data is routinely exposed to the risk of theft and overlooked in cybersecurity risk management. According to a new report from the Ponemon Institute and law firm Kilpatrick Townsend & Stockton, the organizations are increasingly ineffective at safeguarding data like trade secrets, product design, development or pricing, and other proprietary information.

As breach notification laws, regulatory requirements, and reputation considerations draw more focus to cybersecurity surrounding personal data of customers or personnel, businesses are leaving more risk on the table regarding their most valuable assets, and that risk has a notable price tag.

In the past year, the average cost of remediating these attacks was about $5.4 million, and half of respondents estimated the maximum cost would range over $250 million, with seven out of ten placing it over $100 million. What’s more, on average, respondents believe only 35% of the losses resulting from knowledge asset theft would be covered by their current insurance policies.

The primary drivers of these costs, respondents said, were (out of 100 points):

knowledge asset theft costs

Why are so many businesses failing to take action against the risks to knowledge assets?

knowledge asset data theft risk

Among the findings, the report noted:

  • Theft is rampant. Seventy-four percent of respondents say it is likely that their company failed to detect a data breach involving the loss or theft of knowledge assets, and 60% state it is likely one or more pieces of their company’s knowledge assets are now in the hands of a competitor.
  • Companies don’t know what they need to protect, or how to protect it. Only 31% of respondents say their company has a classification system that segments information assets based on value or priority to the organization. Merely 28% rate the ability of their companies to mitigate the loss or theft of knowledge assets by insiders and external attackers as effective. The great majority who rate their programs as not effective cite as the primary reasons a lack of in-house expertise (67%), lack of clear leadership (59%), and lack of collaboration between different job functions (56%).
  • Executives and boards aren’t focused on the issue and its resolution. A data breach involving knowledge assets would impact a company’s ability to continue as a going concern according to 59% of respondents, but 53% replied that senior management is more concerned about a data breach involving credit card information or Social Security numbers than the leakage of knowledge assets. Only 32% of respondents say their companies’ senior management understands the risk caused by unprotected knowledge assets, and 69% believe that senior management does not make the protection of knowledge assets a priority. The board of directors is often even more in the dark. Merely 23% of respondents say the board is made aware of all breaches involving the loss or theft of knowledge assets, and only 37% state that the board requires assurances that knowledge assets are managed and safeguarded appropriately.
  • Careless employees and unchecked cloud providers are key risk areas. The most likely root cause of a data breach involving knowledge assets is the careless employee, but employee access to knowledge assets is not often adequately controlled. Fifty percent of respondents replied that both privileged and ordinary users have access to the company’s knowledge assets. Likewise, 63% of respondents state that their company stores knowledge assets in the cloud, but only 33% say their companies carefully vet the cloud providers storing those assets.

Thanks in part to the lack of action currently, there is plenty businesses can easily do to improve.

“Companies face a serious challenge in the protection of their knowledge assets. The good news is there are steps to take to reduce the risk,” said Dr. Larry Ponemon, chairman and founder of the Ponemon Institute. “First of all, understand the knowledge assets critical to your company and ensure they are secured. Make sure the protection of knowledge assets, especially when sharing with third parties, is an integral part of your security strategy, including incident response plans. To address the employee negligence problem, ensure training programs specifically address employee negligence when handling sensitive and high value data.”

Financial Services IT Overconfident in Breach Detection Skills

Despite the doubling of data breaches in the banking, credit and financial sectors between 2014 and 2015, most IT professionals in financial services are overconfident in their abilities to detect and remediate data breaches. According to a new study by endpoint detection, security and compliance company Tripwire, 60% of these professionals either did not know or had only a general idea of how long it would take to isolate or remove an unauthorized device from the organization’s networks, but 87% said they could do so within minutes or hours.

When it comes to detecting suspicious and risky activity, confidence routinely exceeded capability. While 92% believe vulnerability scanning systems would generate an alert within minutes or hours if an unauthorized device was discovered on their network, for example, 77% said they automatically discover 80% or less of the devices on their networks. Three out of 10 do not detect all attempts to gain unauthorized access to files or network-accessible file shares. When it comes to patching vulnerabilities, 40% said that less than 80% of patches are successfully fixed in a typical cycle.

The confidence but lack of comprehension may reflect that many of the protections in place are motivated by compliance more than security, Tripwire asserts.

“Compliance and security are not the same thing,” said Tim Erlin, director of IT security and risk strategy for Tripwire. “While many of these best practices are mandated by compliance standards, they are often implemented in a ‘check-the-box’ fashion. Addressing compliance alone may keep the auditor at bay, but it can also leave gaps that can allow criminals to gain a foothold in an organization.”

Check out more of the study’s findings below:

financial services cyber risk management

Travelers Must Cover Inadvertent Data Disclosures, Court Rules

A recent Fourth Circuit case affirmed a Virginia district court ruling that insurer Travelers Indemnity Company of America had a duty to defend a class action brought against its insured, Portal Healthcare Solutions, LLC, under a cyber liability insurance policy providing coverage for the electronic publication of certain materials. Portal Healthcare provided “electronic storage and maintenance of certain medical records” as a service to its healthcare provider clients. The class action suit alleged that Portal Healthcare negligently failed to provide services when a wrong security setting on a web access portal was selected, allowing internet search engines to scoop up not only the login page as a search result, but also the underlying sub-pages containing medical records.

Travelers argued that it had neither a duty to defend nor indemnify under the 2012 and 2013 policies acquired by Portal Healthcare. The 2012 policy included a “Web Xtend Liability Endorsement” applicable to coverage for “Personal Injury, Advertising Injury and Web Site Injury Liability.” The 2013 Policy contained a Commercial General Liability Coverage Form applicable to “Personal and Advertising Injury Liability.” The applicable definitions included:

  • “Advertising injury” means injury, arising out of one or more of the following offenses: … electronic publication of material that … gives unreasonable publicity to a person’s private life
  • “Personal injury” means injury, other than “bodily injury,” arising out of one or more of the following offenses: … electronic publication of material that … gives unreasonable publicity to a person’s private life
  • “Web site injury” means injury, other than “personal injury” or “advertising injury” arising out of one or more of the following offenses: … electronic publication of material that … gives unreasonable publicity to a person’s private life …”

Travelers asserted that it owed a duty to defend Portal Healthcare only if the underlying class action complaint alleged “(1) injury arising out of the offense of “electronic publication of material that … gives unreasonable publicity to a person’s private life” (2012 Policy) or (2) injury caused by the offense of “electronic publication of material that … discloses information about a person’s private life” (2013 Policy).”

The Fourth Circuit, however, held that the Eastern District Court of Virginia correctly analyzed the matter under the “Eight Corners” rule, where the court must look first to the four corners of the contract (the insurance policy) and then the four corners of the complaint. The policy provided coverage for “publication” of electronic materials which either gave “unreasonable publicity” to or “disclosed” information about an individual’s private life.

Travelers argued that there could not be “publication” when the insured’s business was the protection of information and there was no evidence that a third party actually viewed the information. The District Court determined in the first instance that “publication” does not refer to intent (whether intentionally or unintentionally disclosed) so that argument was rejected. As to the second element, the court noted that publication occurs when placed “before the public,” without reference to whether the public actually reads the information.

Under the second requirement for coverage, Travelers maintained that “publicity” required a proactive step to “attract” interest, and “disclosure” requires a third party to actually view. The District Court held that publicity was unreasonable due to the nature of the sensitive information contained in the medical records and there was no requirement that the insured take overt action to attract attention to the information. As to the “disclosure” argument, the District Court held that disclosure occurred when the possibility of viewing by a third party happened, not when or if a third party actually viewed the information.

The District Court also addressed the fact that there was no express exclusion of the actual security failure involved and at a minimum the insurance carrier would have to defend (although it could still later argue it had no duty to indemnify) based on the law that such an ambiguity is decided in favor of the insured.

This makes it clear that it is critical to pay attention to the type of coverage purchased and to the fine print. It may also be helpful to have an insurance agent review the types of coverage you have, to look for gaps based on your business and possible risks, since each policy type includes those risks which are intentionally covered and others which are expressly excluded. Although the types of policies continue to expand to cover new technologies and new risks, depending on the carrier and the policy’s exclusion language, the coverage may not be what you think it is.

The 25 Worst Passwords of 2015

In another reminder that users are always the biggest security weakness, “123456” and “password” have once again been named the most commonly used bad passwords. In SplashData’s fifth annual “Worst Passwords List,” the company has compiled the most common weak, easily guessable passwords that leave users vulnerable to hacking and identity theft.

Pulling from more than 2 million leaked passwords revealed during the year, the list highlights just how vulnerable users are. Some new and longer passwords made the top 25, reflecting some effort by websites, system administrators and perhaps users themselves to try to force better security practices by requiring more characters. Unfortunately, these longer passwords are so simple that the extra characters mean little, particularly given how few passwords utilize both letters and numbers.

Some new bad passwords may seem a bit more complex, for example, “1234567890,” “1qaz2wsx” (first two columns of main keys on a standard keyboard), and “qwertyuiop” (top row of keys on a standard keyboard), but are easily guessableand clearly not quite as innovative as these users may have thought. It seems the excitement over Star Wars also had an impact: with common passwords “starwars,” “solo” and “princess,” the force of bad information security awakens.

Check out the infographic below for the top 25 worst passwords and some of SplashData’s top tips to build ones that stay off the list.

SplashData worst passwords of 2015