In Depth

National Survey on the Detection and Prevention of Data Breaches

While many security professionals are confident about their ability to detect the occurrence of a large data breach, they are less than confident about their ability to prevent one.

By Larry Ponemon

October 23, 2006 — CSO —

According to the results of our recent national survey of information security professionals, data breaches continue to threaten organizations ability to safeguard personal information. We believe our survey on information security professionals experiences in detecting and preventing the leakage of sensitive or confidential information to unauthorized parties outside the organization enables us to learn from those who are in the trenches in the battle to protect confidential or sensitive data about people and their families.

Sponsored by PortAuthority Technologies, this independently conducted national survey by Ponemon Institute queried a representative sample of 853 respondents (see Sample section below for details) employed in corporate IT functions within U.S.-based organizations. Our survey focused on the following four issues:

How do information security practitioners respond to data breaches?

What technologies, practices and procedures are employed by organizations to detect and prevent data breaches?

What are the issues, challenges and possible impediments to effectively detecting and preventing data breaches?

How do organizations attempt to enforce compliance with their data-protection policies?

Our findings provide some interesting insights into the current perspectives and practices of organizations concerning the prevention and detection of security breaches.

Most Salient Findings

The following summary discusses what we believe to be the most salient findings from our research: organizations ability to detect and prevent small versus large breaches, the idea that certain data is considered more important to safeguard, and organizations choice of technology to prevent and detect a security breach and obstacles to achieving compliance with data-protection policies.

Are Organizations Effective in Preventing and Detecting Breaches?

More than 59 percent of respondents believe their company is effective at detecting breaches, and 39 percent state that content filtering is a primary technology used to detect and classify data breaches. Only 37 percent believe their company is effective at preventing breaches.

How do respondents view their organizations ability to detect and properly classify a data breach? Figure 1 shows the approximate probability distribution for two classes of data breaches: large (10,000 or more customer records) and small (100 or fewer customer records). This graph is based on self-reported probabilities from respondents in terms of their belief that their company would detect a large or small breach. On average, the probability of detecting a large data breach is 68 percent, and the probability of detecting a small data breach is 51 percent.

The above pattern of findings suggests that respondents are uncertain about the companys ability to discover leakage of confidential information. Specifically, for a large breach involving more than 10,000 customer records, only 43 percent believe their company would detect this event at or above 80 percent of the time (or a 20 percent rate of detection failure). Seventy-six percent of respondents believe their organization would correctly detect a large breach at or above 60 percent of the time (or a 40 percent rate of detection failure).