A data breach can be defined as a confirmed incident, where a cyber criminal has been able to gain unauthorised access to a system and retrieve sensitive or confidential data.
It is the digital equivalent of someone breaking into a safe or a filing cabinet and taking the private documents contained within.
Under the GDPR (General Data Protection Regulation), organisations are required to notify any party that may be affected by the data breach and there can often be hefty fines to pay. It is therefore important that you check with your IT Team or your Cloud Solutions Provider, to assess whether you have sufficient systems in place to prevent the possibility of data breaches.
How and why does it occur? In order for a data breach to occur, a cyber-criminal will often go through the following process during a breach operation:
Research: Investigation will be undertaken to try and identify any potential weaknesses in the target system.
Attack: The cyber-criminal makes initial contact by way of a Social or Network attack. A Social Attack will involve an attempt to deceive or trick employees into unknowingly providing access to their network. A Network attack however, is a direct attack via exploitation of system, or application weaknesses, in order to infiltrate the network.
Extraction: Once access to the system has been acquired, the cyber-criminal can view and extract confidential data as required. It is at this point, where the attack is considered successful.
Main causes of a data breach:
- Poor or Outdated Standards This can include weak passwords, unpatched systems, and human error i.e. storing un-encrypted data on USB sticks that anyone potentially can have access to.
- Third-Party Dependencies If you have a Cloud Solution, your Cloud Solutions Provider will in most cases, have systems already in place to take the stress and worry away from having to deal with the setup and configuration of your Network Security. You should however always discuss with them if you are not sure or have any concerns.
- Phishing attacks These will most commonly occur via email and will attempt to gain control or access following a user interaction of some sort. More detailed info on phishing attacks can be found in a Cloudsis blog article here.
What can you do? Check with your IT provider or your Cloud solutions provider what security protocols they currently have in place.
Have you covered the basics? Fundamental factors such as having secure passwords and back up procedures that involve keeping your backed up data in a separate location should be considered. Remember, you don’t want to make it easy for cyber criminals.
Sufficient training should be given to all employees of the organisation, so that they are aware of their responsibilities concerning safeguarding data and reducing the risk of any potential threats.
Above all, awareness is key, and you must take the appropriate steps to protect your data.