Mitigating the Risk

Criminals today are well-versed in using technology to accomplish their goals and are often able to commit crimes with minimal physical risk of detection or intervention. If you are breached, some simple steps can make your data less appealing.

"While simple encryption is not foolproof, it works much like locking your car," says Newmeyer. "The car thief wants to take the car that he can easily steal and sell. If you make your car harder to steal, they are likely to find another one that is more accessible."

Also, good governance plays a major role in risk management. Ulsch says companies need to create an environment of controls. You need integration of security standards, privacy requirements and information governance, as well as risk management to deploy an integrated framework for managing risk over critical information.

These five initiatives cannot occur with any degree of success or regularity without executive awareness, mainly because managing your risk costs money, Ulsch notes. "Until the audit and risk committees of the board of directors, and until CEOs, CFOs and so forth buy into the notion that these are secrets worth protecting, then we will continue to have these problems. The solution is contingent upon executive awareness and the desire and ability to do something about data protection in a meaningful way."

What It Means for Business

For many businesses, it still boils down to cost and not "unquantifiable" reputational harm. Many of the costs of the breaches have been borne by the credit card companies up to now, but that's beginning to change. And as it does, companies will see an impact on their bottom line.

"At present, the credit card companies are liable for much of the fraud taking place," says Newmeyer. "Recent court cases, however, are starting to shift some of the burden to businesses themselves."

Newmeyer recommends several steps businesses can take:

• Be vigilant about security policies and practices to safeguard the information.

• Quickly admit to breaches; bad news doesn't get better with time.

• Establish relationships with law enforcement, including public-private partnerships such as the Secret Service's Electronic Crimes Task Forces.

• Ask your IT services provider, or internal staff, when they last performed a security assessment of the enterprise.

Adds Newmeyer, "Look at security not as a cost center but as a vital element in your business that is necessary to develop and protect your relationship with your customers."