Orthus, a leading provider of innovative and independent information security services and solutions, publishes the results from monitoring over 100,000 hours of user activity. This activity is captured through the delivery of the unique Data Leakage Audit Service.

The results are based on the survey of 12 months research. Findings show that there is no an organization that does not suffer from multiple instances of data leakage. Some organizations damage because of information leakage that does not work to advantage to business.

The analysis of 100,000 hours of user activity underlines exactly who, where, when and how critical information assets are removed from the infrastructure and demonstrated that the real problem – and the solution – is all about the user.

Key results from the survey are:
Corporate data leakage was most likely to occur through mobile devices with 68% of all events identified linked to mobile rather than fixed desktop systems.
Information Technology and Customer Services Departments had the highest incidence of data leakage.
Most incidents of data leakage occur during the extended working day (7-7 Monday to Friday).
The applications most favored by users to remove sensitive data were identified as web mail, instant messaging (IM) and social networking web sites.
The top 4 data leakage vectors were identified as mobile devices, web mail, removable media and corporate email.
All data leakage incidents identified could have been prevented. Existing corporate security policies were not implemented, monitored or enforced.

The software itself records suspicious actions and identifies whether information is sent or copied to an unauthorized device or whether it is uploaded or transferred through an unauthorized application.

Managing Director of Orthus, Richard Hollis said: “Companies continue to try and protect information by protecting the architecture deploying devices to protect devices. They neglect the protection of data”.

“Until organizations accept that the majority of losses are associated with authorized users and implement the necessary controls where they are effective – between the user and the information itself – these losses will continue”.