Who Foots the Bill For A Data Breach? 

Data breach is almost inevitable - which means it is vital that companies and their Managed Services Providers (MSPs) understand exactly who is responsible and who bears the financial brunt.

But recent research reveals that both companies and MSPs are disturbingly unclear about their legal and financial obligations. Contracts are ambiguous and the risks of legal wrangling severe. The truth is that when a breach occurs and data is exposed, neither party wins.

Rather than playing the blame game, the priority must be to protect the data to ensure that even when an attacker breaks through, there is nothing to see and nothing to gain.

Financial Burden

Cyber security has become a board level issue in recent years – not least since the introduction of ever more punitive fines and personal responsibility for the protection of sensitive data. Yet recent research undertaken by Sapio Research on behalf of Certes Networks confirms that far too many businesses are simply handing over responsibility to an IT Service Provider (ITSP) or Managed Services Provider (MSP) - and expecting the provider to pick up the financial cost should a data breach occur. 

Companies employing third party organisations to deliver security policies expect ITSPs to cover 48% of the costs in the event of a data breach. Astonishingly, 73% of ITSPs also consider themselves responsible for paying fines and damages and believe they should pay 51% of the costs.

Whether these expectations can be met as and when a breach occurs remains a legal minefield. More critically, for senior managers personally liable for security and information protection compliance, does this abdication of responsibility to a third party stand up to regulatory scrutiny? 

Endemic Misperception

How does a reliance on an MSP or ITSP support the zero-trust approach to separating policy responsibility from system administration? Any security posture needs to be defined from a business standpoint to reflect the sensitivity of specific data sets. But if the onus is placed on the MSP, the entire security posture is both defined and delivered by a network security team. Contractual agreements will be meaningless if a regulator comes down hard on this clear lack of Separation of Duties.

Furthermore, the legal standpoint is that the data owner is responsible and liable for any data breach - so any company with the misperception that the MSP or ITSP will foot the bill is likely to be in for a very nasty surprise.

This perception indicates that far too many companies are not considering the true implications of data security at the right level. 

Are the data protection and compliance officers, as well as senior managers, now personally liable for protecting sensitive company, customer and partner data involved in these decisions? If so, do they really believe that asking the network security team to appoint an MSP to provide an SD WAN is really an adequate approach to data protection and compliance? 

Demanding Safeguards

It is naïve to expect a network security infrastructure expert to understand the full implication of financial and reputation loss associated with a data breach. It is not in their remit. They are responsible for the performance of the infrastructure – not the value or assurance of corporate data.

Companies need to take ownership of their data - and that means demanding the MSP or ITSP provides another level of data protection. An MSP that wraps security around the data, rather than relying on the network infrastructure, can provide business leaders with the essential assurance that data is protected and compliant. 

Adopting Layer 4, policy-based encryption ensures the data payload is protected for its entire journey - and because only the payload data is encrypted while header data remains in the clear, means minimal disruption to network services or applications. With encryption policies based on the sensitivity of corporate data, the business can achieve a clear separation between policy setting and systems management.  A win for both data officers and network security teams.

Conclusion

This research raises a very concerning issue for both companies and ITSPs/ MSPs. Whoever ends up footing the bill – and the chances are that a lengthy court case could ensue - no one wins. Any data breach will incur not only immediate financial costs but long-term business consequences that could be devastating for both parties.

So why risk it? If a company takes a different approach and demands that additional data protection layer, there is no longer any issue of blame or cost.

The company is no longer relying on a third party to safeguard its data, but instead taking ownership itself. By encrypting data, in a way that doesn’t affect business operations, it is safeguarded across whatever infrastructure the MSP or ITSP is providing.

Simon Pamplin is CTO at Certes Networks

Cyber Security - How Confident (Complacent?) Are You?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Five Application Security Predictions For 2023
Coming Your Way - The Top Cyber Crimes In 2023 »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

Zayo

Zayo

Zayo is a leading global bandwidth infrastructure services provider for high-performance connectivity, secure colocation and flexible cloud services.

Applicure Technologies

Applicure Technologies

Applicure Technologies develops the leading multi-platform web application security software products to protect web sites and web applications from external and internal attacks.

Aves Netsec

Aves Netsec

Aves is a deceptive security system for enterprises who want to capture, observe and mitigate bad actors in their internal network.

Lacework

Lacework

Lacework brings speed, scale, and automation to cloud security and allows security and DevOps teams to collaborate on keeping data and applications safe.

Tessian

Tessian

Tessian (formerly CheckRecipient) is a next-generation email security platform that helps enterprises counteract human error and significantly reduce the risk of data loss.

macmon secure

macmon secure

macmon secure develops network security software, focussing on Network Access Control.

CRYPTTECH

CRYPTTECH

CRYPTTECH specializes in Information Security and Intelligence, Risk Evaluation and Vulnerability Recognition against Cyber-Attacks and APTs.

PeckShield

PeckShield

PeckShield is a blockchain security company which aims to elevate the security, privacy, and usability of entire blockchain ecosystem by offering top-notch, industry-leading services and products.

OpSec Security

OpSec Security

OpSec Online is the only brand protection solution that spans all channels so your brands are protected no matter what digital venue the criminals target.

GuardDog.ai

GuardDog.ai

guardDog.ai has developed a cloud-based software service with a companion device that work together to simplify network security.

Pristine InfoSolutions

Pristine InfoSolutions

Pristine InfoSolutions is a global IT services and Information Security Company focused on delivering smart, next-generation business solutions.

Kobalt.io

Kobalt.io

Kobalt are bringing the monitoring capabilities of enterprise-class security teams to smaller organizations.

Mirai Security

Mirai Security

Mirai Security are a cyber security company that specializes in Governance, Risk Management and Compliance, Cloud Security and Application Security.

Zanutix Consulting

Zanutix Consulting

Zanutix specialize in a wide range of services including Network Design and Implementation, Data Management, Cloud Solutions, Software Development and Cybersecurity.

DOT Europe

DOT Europe

DOT Europe is a consensus based organisation which brings a diverse membership together to agree on their collective stance on EU tech policy.

Anjolen

Anjolen

Anjolen provides expertise in cybersecurity, compliance and cyber forensic services.