Reputation damage and brand integrity: Top reasons for protecting data

Vormetric announced the results of the European Edition of the 2016 Vormetric Data Threat Report. It focuses on responses from IT security leaders in European organisations, which detail IT security spending plans, perceptions of threats to data, rates of data breach failures and data security stances.

“For U.K.-based organisations, protecting reputation and brand integrity was the top reason for securing sensitive information at 50 percent,” said Garrett Bekker, senior analyst, information security, at 451 Research. “But IT security spending plans tell another story, with compliance the top priority at 48 percent, while reputation and brand protection spending dropped to 45 percent. Clearly, organisations are having trouble prioritising their budgets to best ensure the safety of customers and the viability of their business.”

Key findings

• 89 percent of U.K. organisations feel somewhat or more vulnerable than they have been in the past to both internal and external threats to sensitive data, with 23 percent feeling ‘very or extremely’ vulnerable
• When asked to pick the three most important reasons for securing sensitive data, the top answers were ‘reputation and brand protection’, given by 50 percent of U.K. organisations, ‘compliance requirements’, given by 47 percent and ‘implementing best security practices,’ given by 41 percent
• IT security spending plans contrasted with this, with compliance requirements the top priority at 48 percent while reputation and brand protection dropped to second at 45 percent
• 46 percent of U.K. organisations have experienced a data breach at some stage, with nearly one in five (19 percent) being breached in the last 12 months
• 42 percent of U.K. respondents planning to adopt Internet of Things technologies say protecting sensitive data generated by an IoT device is their biggest security concern
• Planned IT security spending by U.K. organisations for the next 12 months is highest for ‘network defences’ (42 percent), ‘analysis and correlation tools’ (39 percent) and ‘endpoint and mobile defences’ (38 percent).

Compliance continues to act as a security driver

Although there is a growing appreciation that the impact a data breach has on a brand’s reputation cannot be underestimated, U.K. organisations continue to strongly associate compliance with security, despite data breaches continuing to affect organisations that have been certified as compliant.

“Compliance does not ensure security,” continues Bekker. “As we learned from data theft incidents at companies that had reportedly met compliance mandates (such as TalkTalk, Morrison’s and others), being compliant doesn’t necessarily mean you won’t be breached and have your sensitive data stolen. U.K. organisations don’t seem to fully appreciate this, with almost half (47 percent) rating compliance as a top reason for protecting data, and with compliance the topmost IT security spending priority (48 percent).”

Organisations are spending ineffectively to prevent data breaches

With nearly one in five U.K. organisations experiencing a breach in the last 12 months, it is unsurprising that many are planning increased security spending over the coming year. However, most are planning investments in tools like network and endpoint defences which have been proven to be largely ineffective against current threats to company data.

“Enterprises and public sector organisations are under increasing scrutiny from stakeholders and the public where it comes to safeguarding confidential and sensitive information,” said Louise Bulman, VP of EMEA for Vormetric. “It’s therefore surprising and concerning that companies are continuing to over-rely on tools that consistently fail against modern, multi‐layered attacks. Technology that concentrates fundamentally on controlling access to data is a far more affective approach, and one which can bring about additional benefits by enabling technologies like cloud, big data and IoT which may otherwise have been deemed too risky.”