Allow me to take you back to 1936, the year it became mandatory for each municipality in the Netherlands to keep a record of the demographics of their inhabitants. This was done with the most advanced data storage and processing system available at that time: by using punched Hollerith cards. After three years, each Dutch citizen’s personal information was stored, including a section called ‘heritage’, where your ethnic origin was entered. The year 1940 began. The civil registry, including all machines used to read and process its data, quickly fell into the hands of the Gestapo. Their mission became a whole lot easier to carry out, and I assume I do not have to expand further on the horrors that followed.

This might have been one of the first data breaches in history, or at least a hard lesson on what can happen if sensitive data falls into the wrong hands. Today, governments and businesses rely even more on data. What measures can be taken to prevent data breaches from happening? While media might focus on sensational hacking stories, most data breaches are made possible from the inside. Employee mistakes account for a big portion of why data breaches are happening. A secure company culture must therefore be developed.

One of the most important measures that can be taken is simple: employee training. Your employees should be aware of the dangers and the effects it can have on your organization. Teaching them the consequences will make them more aware of their behavior. Techniques such as controlled phishing campaigns could be used to make sure you know which employees might need further guidance and even which employees could event help out each other regarding cyber safety. One training per year will not be sufficient, it is important that their knowledge is regularly tested and refreshed.

Prevention is only one part of the puzzle. Each and everyone within your organization should know how to act when a data breach were to happen. Make sure your employees know who to notify, and evenly important: make sure they feel secure and comfortable reporting any missteps they might have made.

Perhaps the most effective strategy: think like the attacker. Although in 1939 no one could have even began to imagine what was waiting to happen, imagining there was someone out there would want to do harm with the data that they hard stored, could have saved a lot of lives.