Today, virtually all businesses collect and store personal information about customers, employees and others. The frequency of data breaches – the theft, loss or mistaken release of private information – is on the rise.
Data breaches aren’t just a big business problem; small and mid-sized businesses with fewer data security resources are particularly vulnerable. In fact, more than half have been hacked and nearly three-quarters report they can’t restore all their data.
Additionally, the majority of states have enacted breach notification laws that require businesses to notify those affected by a data breach. This process can cost $50 to $100 per record or more, not to mention the damage caused to a business’ reputation and customer relationships. As a result, it’s important for businesses of every size to take steps to prevent a data breach. Here’s how:
- Only keep what you need: Inventory the type and quantity of information in your files and on your computers. Reduce the volume of information you collect and retain only what is necessary. Don’t collect or keep information you don’t absolutely need. Minimize the number of places you store personal private data. Know what you keep and where you keep it.
- Safeguard data: Lock physical records containing private information in a secure location. Restrict access to that information to only those employees who must have access. Conduct employee background checks. Never give temporary workers or vendors access to personal information on employees or customers.
- Destroy before disposal: Cross-cut shred paper files with private information you no longer need before disposal. Destroy disks, CDs/DVDs and other portable media before disposal. Deleting files or reformatting hard drives does not erase your data. Instead, use software designed to permanently wipe the hard drive or physically destroy the drive itself. Also, be cognizant of photocopy machines, as many of these scan a document before copying. Change the setting to clear data after each use.
- Update procedures: Do not use Social Security numbers as employee ID numbers or client account numbers; develop another ID system. Make sure that your procedures comply with any applicable state or Federal laws. Also, make sure that they align with any applicable industry required standards, such those that may be required by the Payment Card Industry (PCI) Data Security Standard.
- Educate/ train employees: Establish a written policy about privacy and data security, and communicate it to all employees. Require employees to put away files, log off their computers and lock their offices/filing cabinets at the end of the day. Educate employees about what types of information are sensitive or confidential and what their responsibilities are to protect that data.
- Control computer usage: Restrict employee usage of computers to business use. Do not permit employees to use file sharing peer-to-peer websites or software applications, block access to inappropriate websites and prohibit use of unapproved software on company computers.
- Secure computers: Implement password protection and “time out” functions (requires re-login after period of inactivity) for all computers. Train employees to never leave laptops or PDAs unattended. Restrict tele-commuting to company owned computers. Require the use of strong passwords that must be changed on a regular basis. Don’t store personal information on a computer connected to the Internet unless it is essential for conducting business.
- Keep security software up-to-date: Keep security patches for your computers up-to-date. Use firewall, anti-virus and anti-spyware software; update virus/spyware definitions daily. Check your software vendors’ websites for any updates concerning vulnerabilities and associated patches.
- Encrypt data transmission: Mandate encryption of all data. This includes data at “rest” and “in motion.” Also consider encrypting email within your company if personal information is transmitted. Avoid using Wi-Fi networks; they may permit interception of data.
- Manage use of portable media: Portable media such as DVDs, CDs, and USB “flash drives,” are more susceptible to loss or theft. This can also include smartphones, MP3 players, and other personal electronic devices with a hard drive that “sync” with a computer. Allow only encrypted data to be downloaded to portable storage devices.
If your business’s data is breached, you could incur substantial costs to respond and provide personal services such as credit checks for those affected. Do you have insurance to cover this? Most standard commercial property and liability insurance will not help pay for these expenses, but data breach insurance can.
Because data has become so critical today, many business owners are adding this specialty insurance along with their basic property, liability, fire and theft coverages. Data breach insurance not only pays for the costs to respond, but provides risk management services for customers.
To learn more about the data breach exposure faced by small business, check out USA Today’s Cyber Truth blog featuring HSB’s Eric Cernak.
© 2015 The Hartford Steam Boiler Inspection and Insurance Company. All rights reserved. This article is for informational purposes only and does not modify or invalidate any of the provisions, exclusions, terms or conditions of the applicable policy and endorsements. For specific terms and conditions, please refer to the applicable coverage form.