Data loss prevention is often ineffective. Researchers from security firm Zscaler warn that organizations’ data policies are violated an average of 10,000 times a day.
Most data breaches start with data loss. A single email can be disastrous for an organization. Unencrypted messages and public links to cloud environments allow cybercriminals to infiltrate infrastructure.
Many organizations try to prevent data loss with data policies. Systems are configured to block applications and employees from sharing sensitive information. Fine-tuning policy is a challenging task. As employees need to share data to be able to function, setting too many restrictions can cause drops in productivity. As a result, employees inadvertently seek ways to circumvent policies.
According to researchers from security firm Zscaler, organizations’ data policies are violated an average of 10,000 times a day. The researchers state that most companies struggle to balance security and productivity. Employees often bypass policies to optimize efficiency over security.
Data policies
The study is based on data from ThreatLabz, Zscaler’s research arm. Researchers recorded six billion data policy violations between November 2021 and July 2022. Common violations include emails to untrusted partners, uploading business files to personal Google Drives and sending sensitive information via Slack.
84 percent of all breaches involved personal data, including names and social security numbers. 10 percent involved financial data and credit card info.
In addition to data policy violations, Zscaler warns of a lack of data policies. 36 percent of all data in cloud applications was shared with public links. This means the data is available to anyone that can access the link. Cybercriminals can gain access to links in numerous ways.
The problem is avoidable by enforcing a single policy. Most cloud applications support private links, which restrict data access to one or more specified recipients. The option is ignored too often.
Ransomware
According to Zscaler, cybercriminals are increasingly exploiting data policy violations. The researchers state that data theft occurs in more than half of all ransomware attacks nowadays. In addition to encryption, cybercriminals attempt to steal data for resale or blackmail purposes. In the case of the latter, the attacker uses personal data to pressure the victim into paying a ransom.
Zscaler conducted the study to gain insight into the challenges and risks of data policies. The organization uses the insight to further develop its security software. Among other things, Zscaler’s products help organizations align data policies with security and productivity.
Tip: Zscaler acquires ShiftRight to expand cloud security platform
8 hours ago
