67% of French organisations hit by one or more data breach incidents within last twelve months

September 11, 2009 · Filed Under Security Software, Software News 

Research from Ponemon Institute Reveals that only 9 Percent of Respondents have an Overall Encryption Plan or Strategy Applied Consistently across the Enterprise

PGP Corporation, a global leader in enterprise data protection, has announced the results of its inaugural annual study by The Ponemon Institute, identifying the steps French organisations are taking in order to safeguard their confidential data. The 2009 Annual Study: France Enterprise Encryption Trends study, which polled 414 IT security professionals at enterprises and public sector organisations, found that 67 percent of French organisations have been hit by at least one data breach incident within the last year, with 18 percent having been hit by more than five incidents. A massive 92 percent of the data breaches were never disclosed as there was no legal or regulatory requirement to do so. Despite the large number of data breach incidents, 71 percent responded that data protection was a ‘very important’ or ‘important’ part of their risk management strategy, with protecting sensitive or confidential information in motion (transfer) or at rest (storage) their top priority.

“It is very encouraging to see that 71 percent of respondents view data protection as a critical part of their overall risk management plan,” said Dr Larry Ponemon, Chairman and founder of The Ponemon Institute. “However, the low percentage of French organisations having an overall encryption strategy in place or using a platform approach to encryption suggests that there are still considerable improvements to be made. The focus for 2010 needs to be on applying a strategic approach to data security across the enterprise.”

The following provides an overview of the key findings of the 2009 France Encryption Trends report:

– Only 9 percent of organisations have an overall encryption plan or strategy that is applied consistently across the entire enterprise.  Forty-five percent have no encryption plan or strategy whatsoever while the remaining 46 percent adjust their encryption plan to fit different applications and data types, or use encryption for certain types of sensitive/confidential information such as social security numbers or credit card accounts.
– Encryption is primarily used to comply with privacy or data security regulations (65 percent) or to limit the brand and reputation damage linked to data breaches (43 percent). With regard to the regulations and regulatory bodies most influential in organisations’ decision to implement encryption, the French Data Protection Commission and French National Privacy Law come out on top with 66 percent and 62 percent respectively. International regulations such as Sarbanes Oxley have a very minor impact (4 percent).
– Eleven percent of organisations use a platform approach to managing encryption solutions across the enterprise. Eight-two percent of these organisations believe the encryption platform increases the effectiveness and efficiency of their IT security programme. Reduced operational costs, consistent policy enforcement across applications and integration with third-party encryption applications were specifically listed as the primary benefits.
– Fifty-six percent of respondents use encryption technology at some level and the remaining 44 percent are in the process of introducing it. Encryption is most widely used to protect data on databases, VPNs and file servers. Mainframe and USB flash drive encryption are the least deployed applications.
– Seventy-one percent of organisations have a fully executed or just launched implementation of data archive and e-discovery systems programme. The figure is just slightly lower for the implementation of network-based data leak detection and prevention technologies (70 percent). More than half of respondents (58 percent) have just launched or fully executed an endpoint device control technology.
– Sixty-seven percent of respondents revealed that they had been hit by at least one data breach in the past 12 months. Of the companies that experienced 2 to 5 or more than 5 data breach incidents, none of them had implemented a company-wide strategy governing the use of data encryption technologies.
– A majority of respondents (58 percent) believe the ability to install a management infrastructure once, and then add additional encryption applications as needed is ‘very important’ or ‘important’. Other important features include the automation of key encryption management activities (55 percent) and enforcement of encryption policy across all applications.
– Encryption solutions are seen as a security priority for 39 percent of respondents. 29 percent also indicate that key management for encryption solutions is earmarked amongst the security initiatives in the current budget and accounts for just over 21 percent of overall spending on encryption
– Forty-five percent of respondents consider loss or theft of confidential or sensitive data one of the major security threats of the next 12 to 24 months. Despite this, 68 percent do not encrypt sensitive or confidential information on mobile data-bearing devices such as PDAs and smartphones, only 4 percent use encryption on USB flash keys and 47 percent are ‘unsure’ or ‘not confident’ about their ability to protect confidential or sensitive information in motion.

“The Ponemon data demonstrates that compliance and fear of reputational or brand damage are driving French organizations to prioritize data protection,” commented Phillip Dunkelberger, president and CEO of PGP Corporation. “Encryption solutions, when coherently and consistently applied across the enterprise to confidential and sensitive information, can protect data at rest, in motion and in use.”

For more information or to receive a complete copy of this study, visit: www.encryptionreports.com

Tags: , , , , , , , , , , , , , , , , , ,

Comments

Leave a Reply