The European Union’s General Data Protection Regulation (GDPR) goes into effect this May, and lawmakers in the U.S. are proposing stricter data breach legislation. With the pressure on to better protect data and improve notification procedures in the event of a data breach, Tripwire surveyed 406 cybersecurity professionals to see how prepared organizations are feeling.
Findings from the study revealed that just over three quarters (77 percent) of companies subject to GDPR could meet the 72-hour notification window, with the 24 percent claiming they could notify customers of a data breach within 24 hours. In addition, when asked how prepared their organization was to notify customers in the event of a data breach, less than a fifth (18 percent) said that they were fully prepared with a process in place. The majority (73 percent) said they were ‘somewhat prepared’ and would have to figure things out ‘on the fly’.
“When it comes to cybersecurity, it’s short-sighted to figure things out on the fly,’” said Tim Erlin, vice president of product management and strategy at Tripwire. “The majority of data breaches and security incidents can be avoided by following basic security steps and implementing tried and tested foundational controls. With GDPR coming into effect this year, running a business without a fully baked plan is really asking for trouble.”
When asked to characterize their company’s capabilities for knowing where its customer data is stored versus for protecting customer data, respondents were more confident in knowing where the data is. Over a third (35 percent) said their knowledge where the customer data is stored is ‘excellent’ by comparison to just over a fifth (21 percent) saying the same for their ability to protect customer data.
Other findings from the study revealed that most don’t feel they are (Read more...)
This is a Security Bloggers Network syndicated blog post authored by Ray Lapena. Read the original post at: The State of Security