[ad_1]
New report from Tessian and the Ponemon Institute reveals that email has become the riskiest channel for data security in today’s organizations
SAN FRANCISCO – May 18, 2022 – New research from email security company Tessian and the Ponemon Institute reveals that nearly 60% of organizations experienced data loss or exfiltration caused by an employee mistake on email in the last 12 months. Email was revealed as the riskiest channel for data loss in organizations, as stated by 65% of IT security practitioners. This was closely followed by cloud file-sharing services (62%) and instant messaging platforms (57%).
The Ponemon Institute surveyed 614 IT security practitioners to also reveal that:
- Employee negligence, because of not following policies, is the leading cause of data loss incidents (40%)
- Over a quarter (27%) of data loss incidents are caused by malicious insiders
- It takes up to three days for security and risk management teams to detect and remediate a data loss and exfiltration incident caused by a malicious insider on email
- Almost one in four (23%) organizations experience up to 30 security incidents involving employees’ use of email every month (for example, email was sent to an unintended recipient)
The most common types of confidential and sensitive information lost or intentionally stolen include: customer information (61%); intellectual property (56%); and consumer information (47%). User-created data (sensitive email content, text files, M&A documents), regulated data (credit card data, Social Security numbers, national ID numbers, employee data), and intellectual property were identified as the three types of data that are most difficult to protect from data loss.
The top two consequences for data loss incidents were revealed as non-compliance with data protection regulations (57%) and damage to an organization’s reputation (52%). Furthermore, a previous study from Tessian found that almost one-third (29%) of businesses lost a client or customer because of an employee sending an email to the wrong person.
Lack of visibility creates data loss challenges
Organizations cannot protect what they can’t see. A lack of visibility of sensitive data that employees transferred from the network to personal email was cited as the most common barrier (54%) to preventing data loss. Further, over half of respondents (52%) report being unable to identify legitimate data loss incidents and standard employee data handling behaviors.
As a result, it takes security teams 72 hours, on average, to detect and remediate a data loss and exfiltration incident caused by a malicious insider on email, and almost 48 hours to detect and remediate an incident caused by a negligent employee.
Greater education required for employees
The majority of organizations (73%) are concerned that employees do not understand the sensitivity or confidentiality of data they share through email. In addition, marketing and public relations departments are most likely to put data at risk when using email (61%), closely followed by production/manufacturing (58%) and operations (57%).
Despite these risks, organizations do not have adequate training in place. While 61% have security awareness training, only about half of IT security leaders say their programs properly address the sensitivity and confidentiality of the data that employees can access on email.
“This study showcases the severity of data loss on email and the implications it has for modern enterprises,” said Larry Ponemon, chairman and founder of Ponemon Institute. “Our findings prove the lack of visibility organizations have into sensitive data, how risky employee behavior can be on email and why enterprises should view data loss prevention as a top business priority.”
Tessian Chief Information Security Officer Josh Yavor said, “Most security awareness training programs focus on inbound threats, yet fail to adequately address the handling of sensitive data internally. But data loss – whether accidental or intentional – is a major threat and should be treated as a top priority.
“To create awareness and mitigate data loss incidents, organizations need to be proactive in delivering effective data loss prevention training while also gaining greater visibility into how employees handle company data. Security awareness training that directly addresses common types of data loss – including what’s okay to share with personal accounts and what’s not okay to take with you when you leave a company – and a culture that builds trust and confidence among employees will improve security behaviors and limit the amount of data that flows out of the organization.”
-ENDS-
About the Research
In March 2022, Tessian commissioned the Ponemon Institute in to survey 614 IT and IT security professionals in the United States, who are involved in the use of technologies that address the risks created by employees’ errors or negligent email practices and familiar with their organizations’ DLP solutions used to mitigate the loss or exfiltration of sensitive data.
About Tessian
Tessian is committed to securing the human layer in the enterprise, by protecting all the digital interactions people need to get their jobs done – starting with email. Tessian is a leading cloud email security platform that intelligently protects organizations against advanced threats and data loss on email, while coaching people about security threats in-the-moment. Using machine learning and behavioral data science, Tessian automatically stops threats that evade legacy Secure Email Gateways, including advanced phishing attacks, business email compromise, accidental data loss and insider threats. Tessian’s intelligent approach not only strengthens email security but also builds smarter security cultures in the modern enterprise. The company is backed by legendary investors such as March Capital, Sequoia, Accel and Balderton, and has been recognized as one of Fast Company’s Most Innovative Companies for 2022.
Press Contacts
Laura Brooks, PR Director at Tessian
[email protected]
[ad_2]
Source link