5 keys to a sound data security plan
A troubling record was set in 2023, according to IBM’s “Cost of a Data Breach” report.
The report studied 553 organizations impacted by data breaches that occurred between March 2022 and March 2023. It indicated that the cost of the breaches set an all-time high record, with the global average data breach cost reaching $4.45 million. This is a 2.3 percent increase from 2022 and a 15.3 percent increase from 2020.
How HR can prevent data breaches
The potential cost of a data breach can be daunting to HR professionals who are responsible for privacy and security of the personal information they manage. Preventing data breaches, however, has been boiled down to these five steps by the Federal Trade Commission.in its publication, “Protecting Personal Information: A Guide for Business:”
1. Take stock. Know what personal information you have in your files and on your computers. Inventory all computers, laptops, mobile devices, flash drives, disks, home computers, digital copiers, servers, and other equipment to find out where your company stores sensitive data. Also remember, your business receives personal information in a number of ways: through websites, from contractors, from call centers, and the like.
Also consider information saved on:
- Laptops,
- Employees’ home computers,
- Flash drives,
- Digital copiers, and
- Mobile devices
Different types of information present varying risks. Pay particular attention to how you keep personally identifying information, such as:
- Social Security numbers,
- Credit cards,
- Financial information, and
- Other sensitive data.
Personally identifying information, sometimes called PII data, is what thieves use most often to commit fraud or identity theft.
2. Scale down. Keep only what you need for your business. If there is no legitimate business need for sensitive personally identifying information, do not keep it. In fact, don’t even collect it. If you have a legitimate business need for the information, keep only what is necessary.
3. Lock it. Protect the information that you keep. How that is done depends on the type of information and how it is stored. The most effective data security plans deal with four key elements:
- Physical security,
- Electronic security,
- Employee training, and
- The security practices of contractors and service providers.
4. Pitch it. Properly dispose of what you no longer need. Leaving papers with personally identifying information in a dumpster facilitates fraud and exposes consumers to the risk of identity theft.
Effectively dispose of paper records by shredding, burning, or pulverizing them before discarding. Make shredders available throughout the workplace, including next to the photocopier.
When disposing of old computers and portable storage devices, use software usually called wipe utility programs to erase data. These programs are inexpensive and can provide better results by overwriting the entire hard drive so that the files are no longer recoverable. Deleting files using the keyboard or mouse commands usually isn’t sufficient because the files may continue to exist on the computer’s hard drive and could be retrieved easily.
Make sure employees who work from home follow the same procedures for disposing of sensitive documents and old computers and portable storage devices.
5. Plan ahead. Create a plan to respond to security incidents. Taking steps to protect data can go a long way toward preventing a security breach, but breaches can happen. To reduce the impact on your business should a breach occur:
- Have a plan in place to respond to security incidents. Designate a senior member of your staff to coordinate and implement the response plan.
- If a computer is compromised, disconnect it immediately from your network.
- Investigate security incidents immediately and take steps to close off existing vulnerabilities or threats to personal information.
- Consider whom to notify in the event of an incident, both inside and outside your organization. You may need to notify consumers, law enforcement, customers, credit bureaus, and other businesses that may be affected by the breach. In addition, many states and federal bank regulatory agencies have laws or guidelines addressing data breaches.
- Consult your attorney.
Key to remember: The risk of a data breach is daunting, but there are steps HR professionals can take to protect sensitive information and minimize that risk.