Long ago, when businesses kept sensitive information locked away in file cabinets and safes, it was relatively cheap and easy to store valuable data and control who had access to it.

Today, enterprises invest millions in security, storage, and compliance technologies — all in the name of increasing visibility into where vital electronic information lives and how it is being defended.

Despite those efforts, most experts and customers admit that in most companies the process of tracking down every piece of valuable company data — and applying the appropriate tools to shield information from unwanted access or misuse — remains in its beginning stages.

In many companies it's clear that they are doing the bare minimum to try and meet regulatory demands for data protection

Kevin Mandia - chief executive, Mandiant

The heart of the matter is visibility. Enterprises feel uncertain whether today's technologies are providing an accurate sense of where things stand or are merely creating a false sense of security.

Seeing blind spots

When forensic experts called in by businesses to investigate external data breaches and insider threats tell their stories, the traumatic events that lead to brand-trashing headlines and regulatory punishment are most often based in the business's lack of knowledge of where its sensitive data is.

Enterprises are improving their ability to safeguard the stockpiles of sensitive information they know about, admit investigators, but many remain blind to additional stores of important data or the flawed processes they use to transmit information electronically. Both problems leave them vulnerable to leaks and attacks.

"In almost every case we've investigated where companies have experienced a serious data breach, the reality is that the companies didn't know they had the information where it was stolen from until it's too late and the data has been taken," says Bryan Sartin, US vice president of investigative response at Cybertrust, a provider of managed security services that lists risk assessment among its specialties.

"We end up telling companies where they store their sensitive data after doing forensics when they've already had a breach," Sartin says. "In some cases it's clear that companies are only doing the bare minimum in terms of protection before one of these incidents, but the truth is that even with companies that are employing a lot of sound technologies and process they're still missing a lot of the important data repositories."

Making the job of such professionals even more difficult, Sartin says that clever hackers are already using anti-forensics techniques to hide their footprints and make it harder for investigators to trace ongoing data theft schemes.

Other security breach experts agree that businesses seem overwhelmed by the task of hunting down and protecting valued information.

"It's not that good companies aren't making an effort in this area; it just seems that they can't seem to find a way to locate the information and manage it in a way that allows them to do business and guard the data from every conceivable threat," says Kevin Mandia, chief executive of US-based security service provider Mandiant.

"Even worse, in many companies it's clear that they are doing the bare minimum to try and meet regulatory demands for data protection, or simply to prove that they're doing enough to avoid having to report a breach publicly when it happens," he says.

The perils of self-diagnosis

In a recent survey, analysts at the US Enterprise Strategy Group (ESG) found that one third of the 102 large companies they interviewed admitted a loss of sensitive data in the previous year, with another 11 percent uncertain whether or not their data stores had been violated.

In a nod to the challenge of engaging security processes that go beyond protecting networks from outside attacks, 58 percent of the IT workers surveyed by ESG say they believe that the most significant threat to their sensitive information comes from insiders, through both malicious and careless activity.

"The good news is that we are finding that people are recognizing the problem around identifying, protecting, and classifying confidential data and intellectual property, and are willing to dedicate more money to those efforts, but the bad news is that this is still very much a manual process," says Jon Oltsik, the ESG analyst who authored the report (which was sponsored by data protection technology vendor Reconnex).

"Many companies clearly believe they are doing a good job, but the evidence of breaches and holes in their processes leads you to believe that there are many inaccurate delusions out there," Oltsik says.

"When you dig a little deeper and show them what type of data is stored on people's desktops and on file servers, most companies are surprised at the size of the problem," says the analyst. "The common thread in these companies is a lack of cooperation between different business constituencies. It is not just an IT problem, or a legal problem, or a business problem; and unless people view it as a corporate-wide problem, their situation isn't going to improve."

IT consultants who are helping enterprises solve these problems concede that even the best companies are struggling to comprehend the scale of the data security issue.

As the volumes of information being maintained by large companies continue to grow exponentially — in some case driven by compliance regulations such as the Sarbanes-Oxley Act and HIPAA — businesses are challenged to stay abreast of the issue and gain true visibility into their operations.

"In general we find that companies have applied a lot of great technologies and feel that they are secure, but there's a general problem of not having enough of a budget to invest in even more tools that can be used to dig down further and gain better visibility into their operations," says Steve Suther, a senior information risk strategist at US-based IT consultancy Getronics Business Solutions.

Before joining Getronics, Suther served as director of information security management at credit card giant American Express. Data security was a "huge problem" for Amex during his decade there, Suther says, as the company tried to protect itself and its customers while dealing with millions of service providers and merchants who processed its information and accessed its records.

Policing business partners is a monster challenge on its own. "One of the hardest areas to enforce your own information risk management programs, no matter how sound, is with third parties; even when companies can effectively map out all their internal business processes and identify who controls what," Suther says. "It's still very difficult to get information about processes employed by third parties that may be touching the data."