Data loss is increasing across industries, and traditional efforts to stop it are ineffective, according to a new McAffee Labs security report.
In particular, the report dubs healthcare providers and manufacturers with outdated systems and vulnerable medical devices “sitting ducks.”
The report includes an analysis of recent ransomware attacks against healthcare organizations, concluding that while most didn’t pay to meet hackers' demands, some did, to the tune of around $100,000. It concludes that despite the fact that these attacks were fairly unsophisticated, the healthcare provider victims were easy targets.
Among the points in the report:
- The time between breaches and when they are discovered is growing. In fact, data is often sold before the theft comes to light, the authors note. Eighty percent of breaches are discovered by outside entities, while only 10 percent are found by internal IT teams, the report says.
- The type of data stolen is changing. Credit card numbers continue to decline in value, while the market is growing for personal, health and intellectual property information, according to the authors. The thefts include documents, PDFs or other plain text, while systems that alert solely for structured data, such as Social Security or credit card numbers, are ineffective.
- Healthcare and manufacturing are industries at significant risk, while industries with huge amounts of payment card information have the most mature data-loss-prevention systems and practices.
Recommendations for improving data-loss prevention include:
- Identifying and classifying sensitive information and mapping where it resides.
- Employing technology on the network and endpoints to provide visibility into how data flows.
- Employing security awareness training to reduce the likelihood of data breaches.
- Establishing policies such as blocking unapproved transfers of sensitive data.
- Empowering the owners of data, who understand it best, to help triage data loss.