Report Says Organizations Are Not Ready for Global Security Risks and Regulations

An Experian Data Breach Resolution and Ponemon Institute industry study says that while companies generally are aware of and intimidated by global privacy and data security regulations, they fail to properly understand and address necessary organizational changes to comply.

The study, Data Protection Risks & Regulations in the Global Economy, asked more than 550 IT security and compliance professionals, involved with their companies' global privacy and data security regulations, to weigh in on the top global security risks, as well as how prepared they feel their companies are to respond to a global data breach.

The study found that more than half (51 percent) of companies surveyed had experienced a global data breach, with nearly 56 percent experiencing more than one breach in the past five years. Yet, despite these major security intrusions, 32 percent of respondents noted that their respective companies still don't have a response plan in place.

Unfortunately, only 30 percent of respondents said their respective C-suite executives are fully aware of the state of their companies' compliance with global regulations. Moreover, only 38 percent of respondents agreed senior leadership views compliance with global privacy and data protection regulations as a top priority.

"Despite increasing reports of the damage caused by global data breaches, the study emphasizes that the increasing risk of, as well as the experience of going through, a global data breach isn't enough to lead CIOs and CSOs to prioritize compliance measures in line with what is expected in the GDPR," said Michael Bruemmer, vice president, Experian Data Breach Resolution. "More emphasis is required from companies, especially those with a multinational footprint, to get ahead of impending global regulations and risks. They can start by conducting risk assessments and investing in new technologies, such as encryption, as well as considering appointing a data protection officer to oversee compliance."

Additional findings from the study:

The GDPR notification requirements will be difficult to implement

Only 9 percent of respondents reported their organization is ready to comply with the European Union's GDPR.
Despite acknowledging the challenges and negative effects of noncompliance with the GDPR, many respondents (59 percent) said their companies don't understand how to comply.
Surprisingly, 34 percent said they're preparing for compliance by closing overseas operations in countries with a high noncompliance rate. This indicates they may not fully understand the GDPR, as it doesn't require companies to have physical operations in the European Union to be impacted.

Companies aren't adequately prepared to respond to a global data breach

Almost half (49 percent) of respondents stated their existing security solutions are outdated and inadequate to comply with global regulations. In addition, only 40 percent of respondents said their organization has the right security technologies to adequately protect information assets and IT infrastructure in all overseas locations.
Only 35 percent said their organizations could manage cultural differences or expectations around privacy and data security across all regions of the world.
Thirty-nine percent believe their organization has the right policies and procedures in place to protect information assets and critical infrastructure in all overseas locations.

Companies fail to prioritize global regulations and remain skeptical about benefits

Only 38 percent of respondents agreed that senior leadership views compliance with global privacy and data protection regulations as a top priority.
Eighty-nine percent of respondents believe the GDPR will have a significant impact on their data protection practices, yet only 41 percent believe global regulations will strengthen their organization's privacy and data protection practices.
Seventy percent don't believe or are unsure the more stringent notification requirements in the GDPR will benefit the victims of a data breach.

http://www.experian.com/data-breach/2017-data-protection-risks-regulations.html.

In today's rapidly evolving security landscape, organizations face an ever-growing array of disruptive events, security threats and risks. Traditional reactive approaches to security intelligence often leave businesses vulnerable and ill-prepared to anticipate and mitigate emerging threats that could impact the safety of their people, facilities or operations.

ON DEMAND: Apple Mac computer use is growing in the corporate space. Having the solutions and the knowledge base to respond to events that include Mac computers is just as important as their Windows counterparts.