Tippett says IT departments need a process -- automated or manual -- to make sure that server passwords are not shared among multiple systems, are changed regularly and are kept secure. He says it's as simple as keeping the current server passwords written down on cards that are kept in a lockbox controlled by one person.

3. Failing to find SQL coding errors.

The most common hacking attack -- representing 79% of all compromised records -- is against an SQL database that is connected to a Web server. The way that hackers get into these systems is to enter an SQL command in a Web-based form. If the form is coded properly, it shouldn't accept SQL commands. But sometimes developers accidentally create what are called SQL injection errors.   

Tippett says the easiest way to prevent these errors is to run an application firewall in "learn" mode so that it can watch how users enter data into a field and then put the application firewall in "operate" mode so that SQL commands can't be injected into a field. The SQL coding problem is widespread. "If a company tests 100 servers, they will probably find a SQL injection problem on 90 of them," Tippett says.

Often, companies fix only the SQL injection errors on their critical servers, forgetting that most hackers get into their networks through non-critical systems. Tippett suggests that network managers segment their networks using access control lists to restrict servers from talking to nonessential devices. This would prevent a hacker from gaining widespread access to data through an inevitable SQL coding error.

4. Misconfiguring your access control lists.

Segmenting your network using access control lists is the simplest way to make sure that systems communicate only with the systems that they should. For example, if you allow business partners to access two servers on your network through your VPN, you should use the access control lists to make sure that these business partners only have access to these two servers. Then if a hacker comes into your network through the opening for business partners, the hacker can only get into the data on these two servers.

"Often a bad guy coming into the network through the VPN has access to everything," Tippett says. Indeed, having properly configured access control lists would have protected 66% of the records that were compromised last year, according to the Verizon report. The reason CIOs don't take this simple step is that it involves using your routers as firewalls, and many network managers don't want to do that.