Note (October 2026): The University of Maryland “39 seconds” figure describes attacks on test computers, not attacks on sensitive data, and the IBM 95% figure dates from 2014; both are now described accurately alongside the 2026 Verizon breach data.
To enhance data security, combine people, technology and recovery: train staff and limit access to what each role needs, turn on multi-factor authentication, use long unique passwords stored in a password manager, encrypt devices (for example with BitLocker), install updates promptly, and keep tested 3-2-1 backups so a breach or ransomware attack does not mean permanent data loss.
Key Takeaways
- People are involved in most breaches: Verizon’s 2026 Data Breach Investigations Report found a human element in 62% of the breaches it analyzed.
- Software vulnerabilities were the most common way in (31% of breaches in the 2026 report), so prompt patching matters as much as passwords.
- Encryption makes stolen data unreadable; BitLocker is built into the Pro, Enterprise and Education editions of Windows.
- CISA recommends the 3-2-1 backup rule: three copies, two types of storage, one copy off-site.
- Strong passwords alone are not enough; add multi-factor authentication (MFA).
Data security means protecting digital information from unauthorized access, theft, corruption and loss. Because so many transactions now happen online, the internet holds a large share of sensitive data, from personal information to company assets.
Data that can be reached online can also be breached. A widely cited 2007 University of Maryland study led by Michel Cukier found that test computers with weak security and an internet connection were attacked roughly once every 39 seconds on average.
It is a popular belief that protecting data online means having to use strong passwords. However, because attackers use automated tools, phishing and unpatched software to break in, strong passwords alone are not enough. The measures below add layers of protection for an organization or a household.
Reduce Human Error
Although breaches happen online, the first line of defense is often people and their everyday habits. IBM’s 2014 Cyber Security Intelligence Index reported human error as a contributing factor in more than 95% of the security incidents it investigated, and Verizon’s 2026 Data Breach Investigations Report found a human element in 62% of the data breaches it analyzed. Human error here means an unintentional action, or a failure to act, such as clicking a phishing link, misconfiguring a system or reusing a weak password.
According to Triple Blind, internal data breaches – those that happen with the assistance of someone within an organization – include unauthorized access, careless disposal of sensitive data, and accidental sharing with an unauthorized party. Physical security errors can also happen when computers are left unattended.
Because people are involved in most breaches, it makes sense to prioritize mitigating it. One way to do so is to limit data access so that each user can reach only the data needed for their role (the principle of least privilege).
Another way to limit human error when it comes to handling data is to train your personnel on core security topics, particularly on data handling as well as the use of email, the internet, and social media.
Encrypt Data So Outsiders Cannot Read It
Because so much data is stored on connected devices and in the cloud, outsiders who get hold of a file or a lost laptop may be able to read it. One of the most effective ways to stop that is encryption.
Encryption scrambles readable data (plaintext) into ciphertext that cannot be read without the correct key. Encryption is also an expected safeguard under US rules: the HIPAA Security Rule lists encryption and decryption of electronic health information as an “addressable” implementation specification, and FERPA requires schools to use reasonable methods to protect student records, which today commonly include encryption.
For small businesses and personal users, strong encryption is already built into modern operating systems, including Windows and Linux. Microsoft BitLocker, for example, appeared in older releases such as Windows 7, Windows 8.1 and Windows 10; as of October 2026, Microsoft lists BitLocker support for the Pro, Enterprise and Education editions of Windows, and says a simpler “device encryption” feature, which turns on BitLocker automatically, is available on all Windows versions on qualifying hardware.
On a supported edition, you can enable it by opening File Explorer, right-clicking drive C, and choosing the “Turn on BitLocker” option. Save a copy of the recovery key somewhere other than the encrypted drive; without this key, you may not be able to access your data if BitLocker asks for recovery. Third-party encryption programs are another option. AxCrypt, from the Swedish company AxCrypt AB, encrypts individual files with AES-256 and reports more than 20 million downloads; VeraCrypt is a free, open-source disk-encryption tool forked from the discontinued TrueCrypt project (latest release 1.26.29, June 2026).
Back Up Data Regularly
One of the most common consequences of a data breach, or of ransomware, is the loss of important data. Data loss, in turn, can translate into losing time and money in recovering files and documents that are important to you or your business.
Small companies that suffer a major data loss can face severe financial difficulties. A frequently repeated statistic says that 70% of such companies go out of business within a year of a large data loss incident, but the original study behind it is rarely identified and the figure could not be independently confirmed, so treat it as a warning rather than a measured rate.
This is what makes back-up and recovery so important when it comes to data security. A backup refers to a digital copy of computer data which is taken and stored in a separate computer system.
This backup makes it easy for you to recover your data in case of a primary data failure such as accidental deletion, hardware or software failure, and malicious virus attacks.
There are several ways to back-up your data, such as a full back-up, an incremental back-up, a differential back-up, and a mirror back-up, among others. To effectively back-up your data, you first need to assess the amount of data you have and how capable your network is.
Whether you adopt one of these measures or all of them, the most important principle in data security is to act before an incident rather than after it.
Data breaches can have severe financial consequences, so always keeping your data secure also means that you keep your livelihood safe from human error or malicious attacks.
What Does the Latest Breach Data Show?
Verizon’s 2026 Data Breach Investigations Report (DBIR), one of the largest annual breach studies, analyzed more than 31,000 security incidents and over 22,000 confirmed breaches across 145 countries, according to coverage of the report by The National CIO Review. The headline findings help set priorities:
| Finding (Verizon DBIR 2026) | Figure | What it means for you |
|---|---|---|
| Breaches involving a human element | 62% | Training and access limits still matter most |
| Breaches involving ransomware | 48% | Offline, tested backups are essential |
| Breaches that started with a software vulnerability | 31% | Install updates and patches quickly |
| Growth in third-party involvement | 60% year over year | Check how vendors and partners handle your data |
Verizon says software vulnerabilities have now overtaken stolen passwords as the top way attackers get in, which is why patching sits alongside passwords in the steps below.
Turn On Multi-Factor Authentication
Multi-factor authentication (MFA) adds a second step, such as a code from an authenticator app or a text message, when someone signs in. According to the US Cybersecurity and Infrastructure Security Agency (CISA), even if someone steals your password, they cannot meet that second step to get into the account. Turn MFA on first for email, banking, cloud storage and admin accounts, because those unlock everything else.
How Strong Should a Password Be?
CISA recommends passwords that are at least 16 characters long, use a mix of upper- and lowercase letters, numbers and symbols (or a passphrase of five to seven unrelated words), and are used for only one account. A password manager makes this practical: it generates and stores unique passwords so users remember only one master password. You can create one with the secure password generator and then check whether your passwords have been compromised.
Keep Software and Devices Updated
Because 31% of breaches in the 2026 DBIR began with a software vulnerability, delayed updates are a direct risk. Turn on automatic updates for operating systems, browsers and apps, replace devices that no longer receive security updates, and keep an inventory of the software your organization runs so nothing is forgotten.
What Is the 3-2-1 Backup Rule?
The 3-2-1 backup rule, recommended by CISA for small and medium businesses, means keeping three copies of important files, on two different types of storage media (such as a hard drive and the cloud), with one copy stored off-site. CISA also advises automating backups, encrypting and physically securing them, keeping offline copies, and testing that both full and partial restores actually work.
| Backup type | What it copies | Trade-off |
|---|---|---|
| Full | Everything, every time | Simplest to restore; uses the most storage and time |
| Incremental | Changes since the last backup of any kind | Fast and small; restoring needs the full backup plus every increment |
| Differential | Changes since the last full backup | Larger than incremental; restoring needs only the full backup plus the latest differential |
| Mirror | An exact, live copy of the source | Always current, but deletions and ransomware damage are copied too |
For software options, see this overview of backup software for Windows PCs and why it helps to back up and recover data in the cloud.
Data Security Checklist
- Give each user access only to the data their role needs, and remove access when people leave.
- Train staff to spot phishing and to report mistakes quickly.
- Turn on MFA for every account that supports it.
- Use long, unique passwords stored in a password manager.
- Encrypt laptops, phones and removable drives, and store recovery keys safely.
- Install security updates promptly.
- Follow the 3-2-1 backup rule and test restores.
- Review what data vendors and partners hold and how they protect it.
- Shred paper records and wipe old devices before disposal.
If something has already gone wrong, this guide on what to do if you are a victim of cybercrime covers the first steps, and this overview of common types of ransomware explains the threat that backups defend against.
Frequently Asked Questions
What is the best way to enhance data security?
The best approach to data security is layered: limit access, train people, use MFA and long unique passwords, encrypt devices, patch promptly and keep tested backups. No single measure is enough, because attackers use phishing, stolen credentials and software flaws.
What percentage of data breaches are caused by human error?
Verizon’s 2026 Data Breach Investigations Report found a human element in 62% of the breaches it analyzed. The often-quoted 95% figure comes from IBM’s 2014 Cyber Security Intelligence Index and refers to security incidents in which human error was a contributing factor.
Is BitLocker free?
BitLocker is included in the Pro, Enterprise and Education editions of Windows rather than sold separately. Microsoft says device encryption, a simpler automatic form of BitLocker, is available on all Windows versions on hardware that meets its requirements.
Is encryption required by law?
Encryption is not a blanket requirement under HIPAA or FERPA. The HIPAA Security Rule lists encryption as an “addressable” specification, and FERPA requires reasonable methods to protect student records. Organizations should check the specific rules that apply to them.
How often should data be backed up?
Back up data at least as often as you could afford to lose it, and automate the schedule so it does not depend on memory. CISA recommends automated, regular backups under the 3-2-1 rule, with restores tested regularly.
Justwebworld has published guides since 2012. How we write and update articles Report an error
