Who Foots the Bill For A Data Breach? 

Data breach is almost inevitable - which means it is vital that companies and their Managed Services Providers (MSPs) understand exactly who is responsible and who bears the financial brunt.

But recent research reveals that both companies and MSPs are disturbingly unclear about their legal and financial obligations. Contracts are ambiguous and the risks of legal wrangling severe. The truth is that when a breach occurs and data is exposed, neither party wins.

Rather than playing the blame game, the priority must be to protect the data to ensure that even when an attacker breaks through, there is nothing to see and nothing to gain.

Financial Burden

Cyber security has become a board level issue in recent years – not least since the introduction of ever more punitive fines and personal responsibility for the protection of sensitive data. Yet recent research undertaken by Sapio Research on behalf of Certes Networks confirms that far too many businesses are simply handing over responsibility to an IT Service Provider (ITSP) or Managed Services Provider (MSP) - and expecting the provider to pick up the financial cost should a data breach occur. 

Companies employing third party organisations to deliver security policies expect ITSPs to cover 48% of the costs in the event of a data breach. Astonishingly, 73% of ITSPs also consider themselves responsible for paying fines and damages and believe they should pay 51% of the costs.

Whether these expectations can be met as and when a breach occurs remains a legal minefield. More critically, for senior managers personally liable for security and information protection compliance, does this abdication of responsibility to a third party stand up to regulatory scrutiny? 

Endemic Misperception

How does a reliance on an MSP or ITSP support the zero-trust approach to separating policy responsibility from system administration? Any security posture needs to be defined from a business standpoint to reflect the sensitivity of specific data sets. But if the onus is placed on the MSP, the entire security posture is both defined and delivered by a network security team. Contractual agreements will be meaningless if a regulator comes down hard on this clear lack of Separation of Duties.

Furthermore, the legal standpoint is that the data owner is responsible and liable for any data breach - so any company with the misperception that the MSP or ITSP will foot the bill is likely to be in for a very nasty surprise.

This perception indicates that far too many companies are not considering the true implications of data security at the right level. 

Are the data protection and compliance officers, as well as senior managers, now personally liable for protecting sensitive company, customer and partner data involved in these decisions? If so, do they really believe that asking the network security team to appoint an MSP to provide an SD WAN is really an adequate approach to data protection and compliance? 

Demanding Safeguards

It is naïve to expect a network security infrastructure expert to understand the full implication of financial and reputation loss associated with a data breach. It is not in their remit. They are responsible for the performance of the infrastructure – not the value or assurance of corporate data.

Companies need to take ownership of their data - and that means demanding the MSP or ITSP provides another level of data protection. An MSP that wraps security around the data, rather than relying on the network infrastructure, can provide business leaders with the essential assurance that data is protected and compliant. 

Adopting Layer 4, policy-based encryption ensures the data payload is protected for its entire journey - and because only the payload data is encrypted while header data remains in the clear, means minimal disruption to network services or applications. With encryption policies based on the sensitivity of corporate data, the business can achieve a clear separation between policy setting and systems management.  A win for both data officers and network security teams.

Conclusion

This research raises a very concerning issue for both companies and ITSPs/ MSPs. Whoever ends up footing the bill – and the chances are that a lengthy court case could ensue - no one wins. Any data breach will incur not only immediate financial costs but long-term business consequences that could be devastating for both parties.

So why risk it? If a company takes a different approach and demands that additional data protection layer, there is no longer any issue of blame or cost.

The company is no longer relying on a third party to safeguard its data, but instead taking ownership itself. By encrypting data, in a way that doesn’t affect business operations, it is safeguarded across whatever infrastructure the MSP or ITSP is providing.

Simon Pamplin is CTO at Certes Networks

Cyber Security - How Confident (Complacent?) Are You?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Five Application Security Predictions For 2023
Coming Your Way - The Top Cyber Crimes In 2023 »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Renaissance

Renaissance

Renaissance is Ireland's premier value added distributor of IT security solutions and a leading independent provider of business continuity consultancy.

LexisNexis Risk Solutions

LexisNexis Risk Solutions

LexisNexis Risk Solutions provides technology solutions for Anti-Money Laundering, Fraud Mitigation, Anti-Bribery and Corruption, Identity Management, Tracing and Investigation.

The Media Trust

The Media Trust

The Media Trust continuously scans websites, ad tags and mobile apps and alerts on anomalies affecting websites and visitors.

Cryptsoft

Cryptsoft

Cryptsoft provides key management and security software development toolkits based around open standards such as OASIS KMIP and PKCS#11.

sayTEC

sayTEC

sayTEC's mission is to develop and deliver next-generation products and services in encrypted data and voice transmission.

SecureAppbox

SecureAppbox

SecureAppbox provide solutions that protects the communication of sensitive data as well as advice on data security and compliance with GDPR.

HardSecure

HardSecure

Hardsecure supports organizations to face security threats through the adoption of cybersecurity capabilities that guarantee 360º monitoring, visibility, mitigation, and blocking.

Internet 2.0

Internet 2.0

Internet 2.0 is a Cyber Security technology company with a core focus on developing affordable but sophisticated cyber security solutions.

State Service of Special Communications & Information Protection of Ukraine (SSSCIP)

State Service of Special Communications & Information Protection of Ukraine (SSSCIP)

State Service of Special Communications and Information Protection is the technical security and intelligence service of Ukraine, under the control of the President of Ukraine.

MorganFranklin Consulting

MorganFranklin Consulting

MorganFranklin Consulting is a management advisory firm that works with businesses and government to address complex and transformational technology and business objectives including cybersecurity.

Centre for Cyber Security Research and Innovation (CSRI) - Deakin University

Centre for Cyber Security Research and Innovation (CSRI) - Deakin University

CSRI solves the cyber security threats of tomorrow, today. We work with industry and government leaders on innovative research that has real-world impact.

RNTrust

RNTrust

RNTrust provide solutions to meet today’s digital challenges utilizing digital technologies and services to make you more secured in digitally connected environment.

Babble

Babble

Babble is a Unified Comms, Contact Centre and Cyber Solutions provider. We believe in making next-generation technology simple to use, deploy and manage.

Telesystem

Telesystem

Telesystem empowers businesses across the USA with a range of innovative network, communication and collaboration solutions.

Cryptr

Cryptr

Cryptr provides plug and play authentication to manage all your authentication strategies in one place with just a few lines of code.

Versent

Versent

Versent is an Australian-born technology company, focused on architecting, building & operating cloud native applications, data streams, platforms, and services.