Story image

ICO report reaction: UK data security incidents rocket 224%

20 Oct 2018

Following the recent release of the Informaition Commissioner's Office' data security incident trends report, Egress Software CEO Tony Pepper has some thoughts on the topic and what the startling numbers actually mean for the industry as a whole.

"After reviewing the short report, it comes as no real surprise that we have seen a pronounced uptick in the overall number of incident reports filed by organisations to the ICO," says Pepper.

"This increase is likely due to the new data breach notification requirements under GDPR, which require organisations to report incidents within 72 hours of becoming aware of them," Pepper says.

However, Pepper says while the numbers are certainly bad, they may not be as bad as at first glance.

"What must be taken into consideration is that whilst we have seen a 228% increase in reported data security incidents (from 957 in January to March 2018 to 3146 in April to June 2018), this does not necessarily mean that organisations are experiencing more breaches than before; it simply means that more are now being reported and forced into the light," Pepper says.

"Drilling further into the statistics, it is interesting to see that most data breach incidents are again down to people, processes and inadequate policies. The data reveals 3146 ‘security incidents’, which frequently involve internal actors making mistakes (including incorrect disclosure of data, which counted for 65%), as opposed to the 414 that are ‘cyber threats’ caused by malware, ransomware, brute force attacks and phishing. In terms of industry sectors, Healthcare, General Business and Education were the most affected. Where cyber threats were concerned, nearly 40% of these are attributed to phishing."

Other stats show the ICO to be nailing down hard on penalties - and there could be more to come.

"In terms of the monetary penalties we can see that the fines have doubled, rising to £1,030,000 in April to June of this year compared to £653,000 in the same period last year, and since 25th May to beginning of October this has gone up again to £1,425,000.  Interestingly, all these fines are still under the Data Protection Act, as to date no company has actually been fined under GDPR," says Pepper.

"At Egress, we believe that organisations should take a user-centric approach to data security, ensuring that every employee is as security savvy as they need to be. In the run up to GDPR, a survey we conducted sought to find out whether the data compliance mantra that has been drilled into the tech team had trickled down to the average worker. It revealed that 20% of employees were still using insecure channels to share company documents, including personal email, social media, cloud sharing and messaging apps. Moreover, 39% did not know if their company was doing enough to protect customer data in the light of recent data breaches and 1 in 5 did not know what kinds of personal information should be protected when sharing data via email."

Pepper says businesses need to clamp down on users, as that is where the sheer majority of breaches come from.

"Today, the user is the only constant within organisations and by taking a user-centric approach and equipping staff to handle personal data –through technology that supports and secures the work they do, as well as more training and awareness – companies will be better placed to close the gap in their compliance programme," Pepper says.

"It will be interesting to see how these statistics breakdown further when the full report becomes available."

APAC holds largest installed base of storage capacity
"The Global StorageSphere is large and diverse, encompassing many different storage technologies, and growing rapidly."
IBM opens up Watson to run on anything, anywhere
Big Blue has made Watson portable across any cloud with the goal to empower businesses to prevent vendor lock-in and start deploying AI wherever their data resides.
Dell EMC’s new and improved data management capabilities
The company has made updates to its All-Flash storage system and released the ClarityNow software for data management.
Four ways the technology landscape will change in 2019
Until now, organisations have only spoken about innovative technologies somewhat theoretically. This has left people without a solid understanding of how they will ultimately manifest in our work and personal lives.
DigiPlex launches new colo hall in Stockholm data centre
DigiPlex has announced that it has taken measures to satiate increasing customer demand.
Lenovo launches new IT infrastructure-as-a-service offering
Customers can now use and pay for data centre hardware and services - on-premise or at a customer-preferred location - without having to purchase the equipment.
Industry vet Jay Adelson appointed to Megaport board
"Jay is an industry luminary with a tremendous track record of seeing around corners and his appointment highlights our global focus as a company."
IDC: Growth in ICT spend driven by cloud infrastructure
Service providers account for a growing share of ICT spending, led by a surge of cloud infrastructure spending, according to IDC.