Unauthorized Data Sharing Puts Companies at Risk

Inappropriate data sharing continues to be a problem for companies, according to a survey from data discovery and auditing software vendor Netwrix. Although most companies have designated secure storage areas for their data, many find it leaking into insecure areas, its research found.

A quarter of companies have discovered data stored outside designated secure locations in the past year, according to the vendor's "2020 Data Risk & Security" report. It took them considerable time to discover the stray data, with 23% reporting that it lay undiscovered for weeks.

This data seems to make its way into insecure storage because employees don't follow data sharing policies, if they exist at all. According to the survey, 30% of systems administrators granted direct access to sensitive data based only on user requests. The results show up in audits and can lead to financial penalties. Of companies that experienced unauthorized data-sharing incidents, 54% ended up with non-compliance findings from audits.

Many companies don't keep tabs on user data access privileges, the survey found. He reported that a little over half of all organizations don't review these access privileges regularly.

This lack of visibility into access rights makes it hard to track data sharing. According to the survey, only half of all organizations are confident that employees are sharing data without the IT department's knowledge. Of those, 29% cannot track employee data sharing at all, making their claims difficult to prove.

The survey examined all stages of the data life cycle from creation through to disposal. It found poor practices at the data-creation stage that have direct implications for other stages such as data sharing. Nearly two-thirds of the survey respondents said that they couldn't confirm they only collect the minimum amount of customer data required. Of those, 34% are subject to the GDPR, which limits the amount of data they are allowed to collect. Companies that collect more customer data than they need to and fail to manage it properly later on compound their security risk.

The survey covered 1,045 IT professionals around the world, with the largest proportion (48%) coming from North America, followed by 26% from the EMEA region. Half the companies had 1,000 employees or fewer.