There it is, a drop of water on your ceiling. Thinking it a small issue, you place a bucket to collect the drips. A few days later, the entire ceiling crashes down. If only you had taken time to fix that leak! The same is true with corporate data loss. As volumes increase, so, too, are the ways employees interact with company data. With new technologies, applications, cloud storage options, and the increase in remote workers, businesses must be more vigilant than ever in making sure data drips are methodically and purposefully halted before the dam bursts.

It is estimated that in 2015, trade secret theft cost U.S. companies between $180 and $540 billion.[1] This number is difficult to substantiate, however, because often the theft or loss goes unnoticed. To prevent these staggering losses, smart companies are pouring countless hours into developing and acquiring solutions to better protect sensitive information. A data-centric focus, with best practices such as aggressive network security monitoring and reinforced user access controls, is the new normal.

Often overlooked, however, are the seemingly insignificant events in the everyday; the drips that, if unmanaged, become a river of data from within. Indeed, such losses often come from unexpected sources: employees departing an organization who take data with them, and employees sending data outside the enterprise without a clear business purpose. Some of this is intentional and malicious, but much of the data loss is unintentional, and primarily due to cracks in institutional controls meant to identify and quash such actions. Policies and procedures are often neglected, antiquated or simply non-existent, creating vulnerability.

Let’s consider, for example, a company with a Bring Your Own Device (BYOD) environment. If proper security protocols are not in place, employees departing the company may unintentionally leave with corporate data on their devices. Another illustration would be an employee who, desiring to put in extra hours at home, simply emails sales quotes or confidential corporate documents to her personal email account. According to the 2017 Dell End-User Security Survey, 72 percent of professionals admitted to breaking security protocols this way, mostly to increase productivity.[2] These employees have no malicious intent, but the corporate dam has certainly sprung a leak.

On the other hand, some employees do have malicious or self-interested motives. The Dell Survey also noted that more than one in three departing employees admit to taking company data with them.[3] Perhaps most disconcertingly, 95% of respondents in a separate study said that data loss or theft was possible because the company either did not have policies in place to prevent this behavior, or the policies were ignored.[4]

Motives for data theft vary. Some feel a sense of ownership or entitlement to data they themselves create. For example, 85% of departing employees stated they did not believe it was wrong if they had personally generated it.[5] Certainly, revenge or a grievance against the company also ranks among reasons to remove proprietary information.

In many instances, an employee’s behavior is not examined until after his or her departure. Notwithstanding post-employment contract enforcement, which can be costly, an autopsy of post-departure behavior is one way to handle the problem of data theft. By this time, however, the dam has already cracked.

Thus, a proactive strategy should be adopted to prevent both malicious and unintentional data loss. The advent of analytics and artificial intelligence, used to monitor an employee’s interaction with corporate data, serves as an early warning system for high-risk behaviors. This shift in focus is gaining attention and adoption by forward-thinking, risk-averse companies.

Consider the following scenario. A salesperson leaves his company and takes confidential pricing sheets and client lists with him. Two weeks before he turns in notice, there is suspicious activity on the server as he downloads sensitive corporate data. This activity occurs more and more frequently during after-hours and weekends. Emails are sent to unidentified outside addresses and to a personal email account, many with attachments and without subject lines. Additionally, the volume of emails to current and former clients increases.

Unquestionably, such behavior should sound the alarm that the dam is about to break. By applying language-based human analytics, leveraging artificial intelligence, and implementing best practices, the data-loss cracks can be sealed before they occur. Certainly, forewarned is forearmed.

Prism leverages technology capable of indexing computers, network data and local email containers in place in real time. Rather than broadly collecting and processing large volumes of data, our methodologies — working in collaboration with clients — incorporate machine learning, sentiment analysis, and complex search parameters to target relevant data in place, thereby significantly reducing costs to its clients. Built around the corporation’s unique vocabulary and processes, these collaborative strategies ensure active and adaptive monitoring to identify potential high-risk behaviors. Without understanding these issues and taking measures to mitigate against them, the deluge of data loss could be significant.

[1] Business Software Alliance (BSA), “Seizing Opportunity through License Compliance,” BSA Global Software Survey, May 2016, http://globalstudy.bsa.org/2016/downloads/studies/BSA_GSS_US.pdf.

[2] Datasecurity.dell.com (2019). Dell End-User Security Survey. [online] Available at: https://datasecurity.dell.com/wp-content/uploads/2017/09/Dell-End-User-Security-Survey-2017.pdf.

[3] Ibid.

[4] Biscom. “Enterprise Data Protection | Share Files Securely.” Biscom, 23 Dec. 2015, www.biscom.com/employee-departure-creates-gaping-security-hole-says-new-data/.

[5] Biscom. “Enterprise Data Protection | Share Files Securely.” Biscom, 23 Dec. 2015, www.biscom.com/employee-departure-creates-gaping-security-hole-says-new-data/.