How to keep your organization free of data breaches

Here, you can read about the 3 best practices to prevent data breaches when emailing.

This will allow you to assess whether your current solution meets the needs of your organization and whether you meet the legal standards.

Sharing information and files is easier than ever before. You can do this via email, social media, chats, you name it. It sounds ideal, right? However, information is not always shared in a safe way.

The easier something is, the faster a mistake can happen. And even a small mistake can lead to a data breach with enormous financial, legal, and reputational consequences.

To guarantee privacy, there are laws and regulations on how to handle privacy-sensitive data, like the GDPR, HIPAA, CCPA, NTA 7516, and Wvggz.

Despite those rules, mistakes are still made. Rush, time pressure, or just a moment when you are not paying 100% attention. Those factors may seem difficult or impossible to avoid, but with the right tools you can prevent even those seemingly unavoidable mistakes.

Here's the thing: human error causes 74% of data breaches

€4,24M

average total cost of a data breach

74%

of all data breaches were caused by human error, IBM research says

Standard Email

is the most commonly used medium to communicate, but that also makes it very sensitive to data breaches.
woman-laptop-working (1)

Best practices

Data breaches happen in every sector. It is logical that those sectors that report the most data breaches are those where a lot of privacy-sensitive data is used. Due to the high sensitivity of the data, most data breaches occur in government and healthcare.

But no matter what sector you work in, every organization must exchange privacy-sensitive data in the right way. The three pillars below play a central role in the proper exchange of personal data.

User-friendliness

A user-friendly system ensures the least resistance from your users. The easier the solution is, the higher the chance that people will use it.

Awareness

The vast majority of data breaches are caused by human error. By making it clear to the people in your organization why security is necessary, you create understanding. And that understanding also helps with the acceptance and ultimate use of the solution.

Control over your data

If you can't keep control over the exchange of your data, there is a good chance that data may end up in the wrong hands.

01. User-friendliness

How your employees use a system is important in preventing data breaches. If a system is not used properly, it can even backfire because a false sense of security is created. You can compare it to how you secure your home. For example, you can buy the best locks, maybe with a high-end security system, but if you don't use them, it's easy for even a bad burglar to get in.

Your home, full of personal belongings and countless memories with your family.

You have the BEST security to protect what you value the most.

But then, in the rush, someone forgets to turn on the security system. OR, someone thinks security is too much of a hassle or too complicated. And they're only 10 minutes away anyway...

Oh no... someone broke into your house. Despite your expensive security system and your good locks.

The fact that user-friendliness is important applies to all systems that an organization uses. Not only should the system have the best security features, but it should also be user-friendly. Every system used within an organization should be a valuable addition to the work process and it should not disrupt work processes.
 
Secure emailing / exchanging data securely becomes easy for everyone in an organization if virtually nothing changes for the users themselves. Then, the chances that sensitive information will be sent securely in the right way increase. That means no unnecessary extra steps or other hassles that slow down the familiar working method. 

There are several ways to increase user-friendliness. 
Some important functionalities that could help are:

Easy integration

Can you easily integrate the secure email solution to your existing email client, for example, Outlook?

Single Sign-on (SSO)

How often do you have to
log in into the systems you use every day?

Plug-and-Play

Is the system easy to use, even after updates? Will it remain this way?

Easy management

Can the administrator easily adjust users and settings from an Admin Portal?

Any device

Does the solution work on all the devices that your employees use (for example: laptops, and mobile phones)?

02. Awareness

Nobody is sharp 100% of their time: fatigue, high work pressure, personal circumstances, or just a bad day. All circumstances under which, even the most cyber-aware employees, can make a mistake. It can happen, but that one mistake can be the cause of a data breach with considerable financial, personal, and image damage for those involved.

woman working happy
  • You want to send Johanna from Finance important documents from a few major customers of your organization just before the weekend.
  • You compose an email and send the message to Johanna.
  • Done, weekend! 
  • Until you see Johanna's reply on Monday morning. She wonders why she got that email and attachments.
  • Then you see to your great delight that you have not emailed your colleague Johanna, but the florist Johanna with whom you occasionally place orders.
  • Oops! A data breach ...

It is important to reduce the chance of making mistakes. This can be done by working with smart systems that recognize sensitive information and that also respond to awareness. If you make employees more aware of the processing of sensitive information, you reduce the risk of errors.

An email solution that works with integrated awareness reduces the chance of errors.
This can be done by paying attention to these features:

Recognize sensitive information

Is there an automatic recognition and notification of sensitive information to raise awareness?

Right use of the BCC or CC field

Do you get a notification when recipients have been added to the CC or BCC of an email?

Multi-factor authentication

Can you set how messages are protected, based on the privacy sensitivity of the content?

Check on files

Will the files be sent immediately or can you first check whether the attached files are the correct ones?

Check on recipients 

Is there a check on recipients, to make sure data won’t fall into the wrong hands?

03. Control

Finally, there is a third important pillar: control over all data that is processed within your organization. It can be difficult to keep an overview of all information that is shared by email in an organization. Sharing the wrong data with the wrong person can therefore go wrong faster than you think because you cannot be in many places at the same time. 
It is also important to always be able to block emails or attachments already sent. With the right intervention at the right time, a data breach can even be prevented!

laptop-flowers
  • We get Johanna the florist again.
  • Suppose you realized immediately after sending that email that you had made a mistake.
  • It is not possible to change this with standard email: sent means sent.
  • With the right email solution, you can take measures to prevent the mistake from having bigger consequences.
  • Files and emails can then be blocked afterward. With a read receipt, you can even prevent a data breach if you revoke access before the email has been opened!

It is important for every organization to maintain as much control as possible
over your data before, during, and after sending it. This can be done as follows:

Admin settings

As an administrator, is there the possibility to adjust settings to the preferences of the organization?

Retention policy & max. number of downloads

Can you set how long your sent files remain available and how often they can be downloaded?

Blocking
email domains

Can you exclude email domains to prevent information from being sent to them?

Tracking sent emails

Can you view your sent email and see if anyone has received it, opened it, and downloaded the attachments?

Blocking sent emails

Was information sent incorrectly? Can you still block attachments, recipients and/or the entire message?

Extra tips

Getting the three pillars from this white paper in order is a good start. But there is so much more that can be done to prevent data breaches. We have five additional tips for you:

Encryption and back-up

It is important to properly protect all your sensitive data. With zero-knowledge end-to-end encryption, you disable access from unauthorized persons : only the authorized person can access the data with the correct key. In addition, also ensure the correct data storage which is in line with the GDPR, HIPAA, CCPA, etc. 

Avoid public networks

Want to work on the network of that nice coffee shop or the guest network of a customer? Rather not. Public networks are not secure and logging into such a network could mean that unauthorized persons gain access to your device. Use your own internet connection with the hotspot on your mobile. That is not only safe, but often also faster!

Pay attention to software installation

Installing software can involve security risks. Leave the installation of software to the administrator within the organization.

Provide and attend trainings

Since most data breaches are caused by human errors, it is good to provide trainings. Keep your employees aware and educate them on secure email behavior.

Choose the right email solution

Email remains one of the most popular means of communication for business communication. By encrypting your e-mail correctly, you can prevent privacy-sensitive data from being shared with the wrong people.

encryption

Discover how easy secure communication can be

Free Consultation
  • Comply with regulations like the GDPR, HIPAA, CCPA
  • User-friendliness comes first so security is actually used;
  • Raise awareness and make your own people your best protection against data breaches;
  • Fully integrate email security into your work process, your email environment, and devices;
  • Keep control of your data. Track and block your email, recipient(s), and/or attachment(s) if necessary.