IT pros believe data breach harm assessment is more valuable than victim notification, study says

The study was published as the EU proposed 24-hour data breach disclosure deadlines

IT professionals believe that assessing the potential harm caused by data breaches is more useful to mitigating the effects of such incidents than notifying affected individuals, according to a survey published on the day the European Union's proposed a 24-hour deadline for data breach disclosures.

Entitled "Aftermath of a Data Breach," the study was sponsored by information services company Experian and was conducted by the Ponemon Institute, which surveyed 584 experienced IT professionals working for companies that suffered a data breach involving consumer records during the past 24 months.

The questions asked by the Ponemon Institute tried to establish the circumstances leading to the data breach, the company's response and the incident's impact on the affected organization's data protection practices.

One of the study's most interesting conclusions was that while notifying victims and regulators are the most common steps taken by companies in the aftermath of a data breach, IT professionals don't view them as the most important actions for reducing the negative consequences of such incidents.

Only 6 percent of survey participants said that victim notification is helpful for reducing the impact of a breach, a significant change of opinion compared to 2007 when 54 percent of IT professionals chose it as an important mitigation step.

Retaining outside legal counsel, carefully assessing the harm to victims and hiring forensic experts to investigate the breach were viewed as the most valuable actions a company can take in the aftermath of a breach by approximately half of respondents.

By comparison, contracting computer forensic experts was considered important by only 5 percent of survey participants in 2007. This suggests that IT professionals today are much more interested in learning how a breach happened before taking action.

Legislators in both the U.S. and the European Union are pushing for legislation that would require companies to alert victims about data breaches in a more timely and uniform manner.

The European Commission proposed significant changes to the E.U.'s data protection laws Wednesday that include a 24-hour deadline for companies to report data breaches. While the proposal was largely welcomed by consumer protection groups, it attracted criticism from the U.S. Department of Commerce and business associations, which described the deadline as too short.

The Aftermath of a Data Breach survey also revealed that, despite making improvements to their data breach response practices, companies still have a long way to go as far as prevention is concerned. Only half of respondents believed that their companies made the best possible effort to protect customer and consumer information in advance of a data breach.

Negligent staff, disgruntled employees and third-party contractors remain the primary source of data breaches. Despite the large wave of cyberattacks that targeted companies last year, only 7 percent of respondents named such attacks as the cause for a data breach in their organization.

According to the study, companies continue to avoid offering free credit monitoring or identity protection services to data breach victims, and when such services do get offered, they rarely exceed periods of one year.

Nearly half of respondents said that their companies suffered data breaches that involved log-in credentials and credit card or bank payment information. Sixty percent of them said that the data was not encrypted, while 16 percent were unsure.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?