With Recession Come New Data Loss Worries

Article ImageThis year, when Proofpoint, Inc., an email security and data loss provider, conducted its annual study on outbound email and data loss prevention issues, it had an additional question in mind, says Keith Crosley, director of market development for Proofpoint: Is the recession creating an increased risk? By the time "Outbound Email and Data Loss Prevention in Today's Enterprise, 2009" was released in July, Proofpoint had found the connection it was looking for.

"The answer was a resounding ‘yes.' Economic concerns are creating more risks for enterprises," he says. Sensitive and embarrassing information, along with customer information,
is finding its way outside the firewall.

"We found that 20% of companies found a risk or leak associated with an employee leaving the company because people take confidential information with them," says Crosley. The study shows that 42% of respondents surveyed said that growing numbers of layoffs have indeed put the companies at a greater risk. Crosley adds, "We're seeing more data loss events than ever before."

A number of factors contribute to the increase in data loss. Not only are employees leaving companies and taking confidential information with them, but budget constraints are limiting the ability to protect confidential data. According to the study, half of the companies said that budget constrictions hindered the ability to protect sensitive data. John Blossom, president of Shore Communications, Inc., says, "Layoffs due to the economic downturn have certainly played a role in data losses at companies, to some degree due to retribution, but to a greater extent, due to people wanting to maintain their personal networks in search of new employment."

The popularity of social networking sites such as Facebook and Twitter is forcing companies to take notice. According to Crosley, 17% of companies have investigated an information leak to a social networking site. As a result, employees are beginning to lose their jobs due to violations of company policy. Proofpoint found that one in 10 companies investigated the exposure of confidential or private information via short messaging services such as Twitter or text messaging in the past year; only 13% of companies said that they didn't investigate these services at all. "That's really interesting because Twitter is ... only 2 years old, and it was really later last year that it achieved mainstream visibility, but you still have a lot of concern about that kind of service," says Crosley. Email, by comparison, has led 43% of companies to investigate a leak sometime in the past year. This leads to more precautions: One-third of companies hire employees exclusively to read emails.

Blossom sees data loss through social media as a necessary evil. "People who are able to maintain relationships with professionals outside of their organizations effectively via social media are a powerful plus to those organizations. Good policies for using social media are necessary in the work environment, but those policies should encourage constructive use as much as possible," he says. "Data loss through social media is, in effect, like a store managing shoplifting. You don't want it to get out of control, but beyond a certain point it's simply a cost of doing business. ..."

Acceptable use policies for companies are, according to Crosley, almost universal; only 6% of companies do not have them in effect yet. "The issue here is that if you don't have a formal policy ... how do you define that an employee has done something wrong?" When it comes to acceptable use policies specifically for email, 94% of companies have them in effect. Social networking policies though, are not yet that widespread. "I think if those policies were more broadly adopted we would have seen more firings in the past 12 months," he says.

Blossom believes that the strict policies are, in the long run, not as important as cultivating an environment in which people both internalize guidelines and expect their peers to do so. "‘Thou shalt not' ultimatums are not as important as saying, ‘When you do this, these are the consequences of having acted as a publisher,'" he says.

With new technologies come more risks. According to Blossom, "One organization's data loss is another's collaboration...There is no one right answer for economic growth, but [the] Content Nation, that global mass of millions of people who are aware of their influence on the world, is rapidly becoming the engine of economic growth through global collaborations to build value in marketplaces."