According to a study by the Ponemon Institute, thirty-one percent of surveyed people terminated their business relationships with a company that suffered a data breach.  If you are trusted with the sensitive information of other people, and happen to work for an organization that is not a monopoly or the government, this ought to be a wakeup call.  You need to protect data, not because it’s the law or because it’s the right thing to do—obviously, those are important considerations as well—but because, depending on your luck, about a third of your customer base is going to wave goodbye in the event of a data breach.  Plug that into your ROI or Value-at-Risk models to see if using data security products like full disk encryption from AlertBoot makes sense. (Hint: It does.)

Now, these respondents are not defecting from affected companies just because they happen to be victims of a data breach.  Rather, it’s a direct effect of not being offered “directions on the steps the consumer should take to protect their personal information.”  In other words, let your esteemed clients know what you’re doing to prevent similar future incidents; sign them up for credit monitoring; point out how they can get those free credit reports; etc.  Show them you care.  Show them that you actually do take this seriously.

The above actions may be considered by some as palliatives at best.  And it may be true.   But what’s important is ensuring that it doesn’t become considered palliatives by everyone.  You can’t promise to put efforts into implementing better data security and then not follow through because, when that second data breach hits, no one is going to believe you.

When it comes to data security, though, there’s a better approach to keeping your customers happy and feeling secure than showing that you care (to the tune of millions of dollars in a PR job to clean up a  mess that may or may not work): show them that you’ve already done something to protect their data.  In my experience, I can’t think of any companies that have been demonized for having a data breach—lost or stolen laptops, missing disks and USB drives, etc.—where the data in question was encrypted.

Yeah, the fact that a device with information was lost constitutes a data breach, regardless of whether someone will be able to get to the data or not.  Personally, I’d like to see that definition modified so that the loss of digital devices is not considered a data breach if data encryption was used.

Related Articles:

http://www.networkworld.com/news/2008/093008-how-to-minimize-the-impact.html

http://www.marketwire.com/press-release/Ponemon-Institute-844160.html