Email data loss is an occupational hazard – so how can organisations mitigate the risk?

This article was contributed by Egress CEO Tony Pepper.

In the average working day, a vast amount of data flows through an organisation from relatively innocuous updates between colleagues to highly sensitive customer data. The preferred medium for many employees when communicating this data is, of course, email, but this has contributed towards a growing security challenge for IT leaders – email data loss. Our recent 2021 Data Loss Prevention Report revealed the true scale of the problem, with 83% of IT leaders reporting that they have experienced an email data breach within the last year.

What’s behind these incidents? Email data loss can be caused by a variety of factors – from intentional exfiltration to simple human error – but every incident has one thing in common: people’s behaviour. Take a misdirected email. An employee types an email to a colleague, which contains sensitive client data. They then type the first few letters of that colleague’s email address into the ‘To’ field, press enter, and Outlook’s autocomplete function takes care of the rest. However, autocomplete is only taking its best guess at who they actually want to send that email to; it does it based on the frequency of communication with recipients, not based on the content of the email or attachments. So routinely, the first suggested address will be incorrect, normally someone with a similar name or email address, and our tired or busy employee simply doesn’t spot the difference and the email will be sent to the wrong recipient. Incidents like this are part of the reason why, in our recent research, 95% of IT leaders said that they believe that client and company data is at risk on email.

And the problem is only getting worse. The pandemic has transformed the way we work. One of the biggest changes has been in the way we communicate with colleagues and clients, and our increased reliance on digital channels, including some new business favourites, such as Microsoft Teams. However, our research found that remote employees are turning to email more than any other mechanism. In fact, an overwhelming 85% of remote employees say they are sending more emails since the start of the pandemic. For employees, email is a tool that makes them feel productive and helps them to share both ideas and data easily. However, there’s always a risk attached. When you increase the volume of emails being sent, you naturally increase the likelihood that email data loss incidents will occur.

But it’s not just email volumes that are increasing this risk. Since email data breaches are driven by people’s behaviours, we also need to consider any factors that affect employees and increase the likelihood of mistakes. Human error is exacerbated by distractions, and our research found that 60% of remote employees are working in environments where interruptions are commonplace, such as shared communal areas. So, it’s little wonder one-fifth (19%) of IT leaders point to employees being distracted in the home working environment as a primary cause of data loss.

Furthermore, 39% of remote employees reported feeling stressed, and 34% are a lot more fatigued – both factors which increase the risk that they might inadvertently cause an incident, either because they are rushing to get to the next task or too tired to spot a mistake.

As a result of all these factors, 59% of IT leaders have experienced an increase in email data loss linked to the pandemic.

This problem won’t go away as the pandemic subsides. The last year has shown that many employees can carry out their jobs from home, and many want to continue to do so in some capacity. The heightened risk brought about by remote working is here to stay. IT leaders agree – our research revealed that 68% believe that a future remote and flexible workforce will make it harder to prevent email data breaches.

Many IT leaders have tried to implement solutions to mitigate the risk of email data loss, but many are still relying on traditional Data Loss Prevention (DLP) tools that simply aren’t up to the task. Legacy DLP tools typically rely on a rules-based approach to prevent email data loss, which means they often get in the way of employee productivity by prompting users unnecessarily. In fact, 37% of IT leaders said that they’ve had to change the rules and reduce security just to make them more useable for employees, while 41% noted that they require a high level of administrative overhead to maintain. Worse still, traditional DLP tools provide limited protection. Our research found that 42% of IT leaders said that half of data loss wouldn’t be detected by the tools they have in place.

So, what can businesses do to protect their data in this new world of increased risk? The answer lies with advanced DLP, which utilises contextual machine learning to deeply understand user behaviour and recognise when an employee behaves ‘abnormally’, putting data at risk. Advanced DLP tools protect the human layer because they are able to identify and correct our mistakes, protecting employees from data loss without having a negative impact on their productivity.

For example, an advanced DLP tool can understand which recipients a user typically includes together when sharing specific content in an email. If that user were to include the usual three recipients, but mistype the name of the fourth, an advanced DLP tool could recognise this as abnormal and prompt the user to make them aware of the risk. By implementing advanced technology, businesses can ensure that they are protecting their people – their human layer – in the face of increased risk, and secure the information flowing through their organisation each and every day.