Study: 80% of Organizations Suffer Breaches, Most From the Inside

If you still think nameless, faceless bad hackers are the biggest threat, think again: Three quarters of all data breaches in the U.S. are at the hands of insiders at the organization -- most inadvertent, but some malicious -- according to a report that goes public tomorrow.

The Ponemon Institute study, which was commissioned by Compuware, also found that 75 percent of organizations in the U.S., U.K., France, and Germany have suffered data breaches caused by accidental internal lapses, while 26 percent say they have experienced breaches from malicious insiders.

And nearly 80 percent of U.S. respondents in the study have had at least one data breach as of the first half of this year, and 43 percent of them said they had experienced two or more breach incidents within the past two years. Around 34 percent didn't know how many breaches they had suffered during that period, according to the "2008 Study on the Uncertainty of Data Breach Detection in the U.S." The study looks at how organizations handle incident detection and response.

This is the latest in a series of reports demonstrating the growing problem of insiders either inadvertently, or purposefully, leaking or stealing data from their organizations. "This study shows that both personal and corporate information is flooding out of the organizations entrusted with its confidentiality," says Larry Ponemon, chairman and founder of the Ponemon Institute, which surveyed over 1,000 IT professionals in the U.S.

Over 43 percent say there is no one accountable for managing data breaches in their organization, and 23 percent say they are unsure who's in charge. "This obvious lack of accountability can have a negative affect not only on detecting data breaches but preventing them as well," the Ponemon report says.

Confidence that their organizations actually detecting breaches is low. Only 10 percent say they are very confident that the loss or theft of personal information from their organizations would be detected; 31 percent are not confident; and 18 percent were unsure.

Not surprisingly, mobile devices, including laptops, PDAs, and memory sticks are where most breaches originate (58 percent), while 50 percent come through the network, 41 percent from the mainframe, and 39 percent from paper documents. Nearly 20 percent of breaches come from backups.

A mere 1 percent of breaches are likely caused by outside attacks, the respondents said, and 42 percent from outsourced data.

Although 77 percent of the organizations say notifying victims rapidly is important, only 20 percent contacted breach victims within a few days of discovering the attack. Nearly 40 percent did so within a few weeks, 23 percent within a month, and 17 percent in over a month. Only 5 percent said they notify victims almost immediately after breach discovery.

— Kelly Jackson Higgins, Senior Editor, Dark Reading