data breach cybersecurity

Canadian companies currently see risk and compliance automation tools as an effective way to protect their data, but respondents to a recent survey say their interest may shift as Canadian and international regulations place a greater emphasis on data breach responses.

“The Cyber Resilience of Canadian Organizations” survey collected the responses of 407 Canadian companies from September 2018 to October 2018. The survey was conducted by information technology analysts International Data Corporation Canada and Scalar, an IT solutions provider.

Risk and compliance automation tools were deemed the most important security tool by 17 percent of respondents, according to the report. Slightly fewer companies (14 percent) expect to consider risk and compliance automation tools to improve the effectiveness of their company in three years.

Almost half (46 percent) of respondents said they were most interested in adding breach response and forensics tools in three years, while only 13 percent said it's an effective cybersecurity tool used in 2018.

That growing concern with breach response and forensics tools seems warranted, as many respondents reported their company must comply with various Canadian and international data protection laws, some of which can dish out hefty monetary penalties.

Indeed, 71 percent of respondents said their companies must comply with Canada's Digital Privacy Act and Personal Information Protection and Electronic Documents Act (PIPEDA). The PIPEDA includes recording any breach and requiring organizations that face a breach of “real risk of significant harm to individuals” to notify affected individuals and Canada's privacy commissioner, which went into effect Nov. 1.

The General Data Protection Regulation was also selected by 64 percent of respondents as a law their company must comply with. The GDPR includes a mandatory notification when a data breach is likely to “result in a risk for the rights and freedoms of individuals” 72 hours after a company is made aware of the breach. The data privacy regulation also includes new requirements of organizations to “implement appropriate technical and organizational measures … in order to meet the requirements of this regulation and protect the rights of data subjects” and other key measures that could result in a minimal penalty of 2 percent of their annual revenue.

The survey also found more companies are moving to the cloud, with 62 percent using the cloud and on-premise software. However, only 7 percent update their public cloud software immediately when a patch is available. Meanwhile, 23 percent of respondents said they updated on-premise software updates as soon as a patch is released.

The survey noted organizations are likely placing data stored on the cloud at risk when they wait to install an update, although 51 percent of respondents said they installed updates to cloud software within a week.