Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security IT

Data Breach Study Spanning 500 Break-Ins Released 71

Posted by samzenpus from the did-you-update-the-windows dept.
Dr. Jim Anderson writes "The good folks over at Verizon Business have released a report that summarizes what they've found after looking through 500 forensic investigations involving 230 million records, and analyzes hundreds of corporate breaches including three of the five largest ones ever reported. What did they find? How about (1) Nearly nine in 10 corporate data breaches could have been prevented had reasonable security measures been in place, (2) Fewer than 25 percent of attacks took advantage of a known or unknown vulnerability and (3) attacks from Asia, particularly in China and Vietnam, often involve application exploits leading to data compromise, while defacements frequently originate from the Middle East."
This discussion has been archived. No new comments can be posted.

Data Breach Study Spanning 500 Break-Ins Released More

Data Breach Study Spanning 500 Break-Ins Released

Comments Filter:

  • Aarrgghhh!!! (Score:5, Funny)

    by DoofusOfDeath ( 636671 ) on Thursday June 12, 2008 @07:00AM (#23762167)

    (2) Fewer than 25 percent of attacks took advantage of a known or unknown vulnerability and

    How the hell are we supposed to defend ourselves against the 75% of attacks that are immune to the laws of logic???

    • Re:Aarrgghhh!!! (Score:5, Informative)

      by ledow ( 319597 ) on Thursday June 12, 2008 @07:05AM (#23762213) Homepage
      Yeah, it's really not clearly worded, is it?

      I assume they mean "software/hardware vulnerability", and that the other 75% are people doing stupid things - "human vulnerabilities" or even "policy vulnerabilities". It's interesting in itself though that 75% of the attacks are due to, presumably, direct human error and nothing to do with the data being on computer.

      So when you're bank next releases your details, don't accept an explanation. Most probably, someone who works there did something incredibly stupid and deliberate, rather than they got hacked or outwitted.

    • Re: (Score:2, Funny)

      by Anonymous Coward
      No, no! What they are trying to say is that 75% took advantage of both a known and unknown vulnerability! You have to remember, the 'or' in this sentence was probably not written by a programmer.
      • Known or unknown by the attackee (or computer security experts for that matter) -- not the attacker who certainly knows about it.

        So it is logical, if taken in context.

    • Re: (Score:1)

      by mlush ( 620447 )

      (2) Fewer than 25 percent of attacks took advantage of a known or unknown vulnerability and

      How the hell are we supposed to defend ourselves against the 75% of attacks that are immune to the laws of logic???

      I took that to mean they did nothing clever and tried a directory attack on passwords.

      • Re:Aarrgghhh!!! (Score:5, Insightful)

        by Tanktalus ( 794810 ) on Thursday June 12, 2008 @09:47AM (#23764007) Journal

        Apparently, someone is trying to make Rumsfeld out to be an idiot. Though that he may be, IMO this quote is actually fairly insightful, if somewhat poorly worded. I've had a similar saying (is it a saying if I'm the only one saying it?): "There are three types of people in the world. Those who don't know what they're doing and know they don't; those who know what they're doing and know they do; and those who don't know what they're doing but think they do. It's the last group that screws everything up for the other two groups." The thing to realise is that everyone falls into all three categories for different aspects of our lives, and the challenge is to tell the difference for each situation to try to avoid being in the last group.

        In Rumsfeld's quote, "known knowns" are the areas where we are in the middle group: knowing what we're doing, and knowing that. "Known unknowns" are the areas where we don't know what we're doing and know we don't. And "unknown unknowns" are the last group: things we think we know, but don't. (Ok, that's not quite precisely what he's talking about, but it's analogous.) And that last group is the most dangerous one.

        • You aren't the only one saying it, but I've always seen it drawn as a graph:

          | Has a clue | Has no clue

          Is not arrogant | ideal | acceptable

          Is arrogant | acceptable | unacceptable

          (Sorry the graph isn't turning out very clear; /. stupid comment filter is mangling it....)

          The best person to hire or work with is the "not arrogant/has a clue person". You can work with a person who has a

        • I've had a similar saying (is it a saying if I'm the only one saying it?): "There are three types of people in the world. Those who don't know what they're doing and know they don't; those who know what they're doing and know they do; and those who don't know what they're doing but think they do. It's the last group that screws everything up for the other two groups."

          Yeah, it's weird that a 55-word saying never caught on.

    • Schroedinger's Vulnerability (Score:4, Funny)

      by Hoi Polloi ( 522990 ) on Thursday June 12, 2008 @09:14AM (#23763501) Journal
      Clearly what they are referring to are quantum vulnerabilities. The exact nature of the vulnerability doesn't become clear until someone observes it.

    • Re: (Score:2, Informative)

      by Anonymous Coward
      Actually what they are getting at is some one left the door open (an attack of a vulnerability wasn't needed). like putting the data on a share that they didn't realize was public.
  • Fewer than 25 percent of attacks took advantage of a known or unknown vulnerability

    So, 75% of attacks didn't take advantage of a vulnerability at all?
    • probably not, no

      lack of security (open systems / trivial, or written down passwords) doesn't immediately mean a problem with the software.
      Equally possible (if not more likely) for the problem to be with the user(s) use of the software

      • Re: (Score:2, Insightful)

        by bencoder ( 1197139 )
        Stupid users and administrators would still be considered a vulnerability, which is the problem with the wording. If a system has no vulnerabilities it is impossible to break into.

    • Re: (Score:3, Informative)

      by Datamonstar ( 845886 )
      No, that means that there were patches available but they were never applied, or the attacker might have used social engineering or some other means to trick the person into installing malware.

      • Re: (Score:3, Insightful)

        by fredklein ( 532096 )
        the attacker might have used social engineering ...which is a vulnerability. Lack of proper security measures and security training.

        • Re:um... (Score:4, Insightful)

          by BVis ( 267028 ) on Thursday June 12, 2008 @07:58AM (#23762605)
          In addition to the training, you need to make breaches of security a terminable offense, for everything from a deliberate theft of information, to writing down a password on a sticky note and putting it on your monitor. Without teeth, you cannot enforce a security policy, and a policy that isn't enforced isn't a policy.

      • No, that means that there were patches available but they were never applied...

        To me, that sounds like a known vulnerability. I think one of the posts above is probably a better answer to the question "what makes up the other 75%, if not a known or unknown vulnerability":

        Username: admin
        Password: password

        Leaving the system in a default state isn't a flaw in the software so it isn't a software vulnerability. It's a lazy/sloppy sys admin. Unfortunately, this leads to playing semantic games -- "what exactly is a vulnerability?"

  • Business Partners?? (Score:5, Funny)

    by Finallyjoined!!! ( 1158431 ) on Thursday June 12, 2008 @07:06AM (#23762219)

    Thirty-nine percent of breaches were attributed to business partners, a number that rose five-fold during the course of the period studied.

    Some Partners!!

    Watch your backs guys.

    PS. How can 39% rise 5 fold?

    • Re: (Score:3, Informative)

      by Red Flayer ( 890720 )

      PS. How can 39% rise 5 fold?
      It didn't.

      Here's an example to make some sense of it:

      Say there were 200 cases, 100 each over two years. During year 1, there were 13 cases due to business partners. During year two, there were 65 cases due to business partners.

      The percentage went up five-fold between year 1 and year 2, but the total percentage over the study is 39%.

  • Actual report (Score:5, Informative)

    by martyb ( 196687 ) on Thursday June 12, 2008 @07:11AM (#23762263)

    Here is a link to the actual report (PDF): http://www.verizonbusiness.com/resources/security/databreachreport.pdf [verizonbusiness.com]

    I quickly scanned the report and it appears to be quite detailed. Definitely required reading for any CxO!

    • Re:Actual report (Score:5, Insightful)

      by morgan_greywolf ( 835522 ) * on Thursday June 12, 2008 @07:15AM (#23762285) Homepage Journal

      Definitely required reading for any CxO!
      CxOs don't read things like this. Instead, they usually read advertisements that say BS things like "buy our product and you'll never have any security problems again!"

      That's why 9/10 attacks involved totally preventable breaches -- if reasonable security had been in place.

      • Re:Actual report (Score:4, Insightful)

        by BVis ( 267028 ) on Thursday June 12, 2008 @08:04AM (#23762661)
        Not to mention the fact that CxOs are frequently the biggest offenders when it comes to poor security practices. I've seen more than one CEO of a Fortune 500 company use the name of the company as their domain/email password, and refuse to change it on a regular basis like the rest of the users at the company. Trying to enforce a security policy with someone who can have you escorted off the premises on a moment's notice is pretty much impossible.

        The only way it works is to get the CEO/Chairman/Lord High Muckety-Muck to sign off on a policy that applies to EVERYONE, and then firing an executive for breach of policy as a demonstration of how serious the company takes security. (This assumes that a CxO breaches policy at some point, which is pretty much inevitable.) The attitude of "security policy is for little people" reminds me of Leona Helmsley's 'taxes are for little people' attitude.

  • Data transaction zones (Score:5, Interesting)

    by Pysslingen ( 544910 ) on Thursday June 12, 2008 @07:12AM (#23762267)
    But often I wonder how many companies connect everybody in the company to the internet when there is no real need? One place I worked maintained three separate networks; one for internet, one for work, one for very confidential work. The work network had access to e-mail (internet-based e-mail through a firewall through which only the mail-server could talk) while the confidential network had only internal e-mail. This may have been overkill, but breaches were more or less impossible. Running NT4 also made sure USB sticks weren't an issue, though I believe they managed to upgrade to XP a few years ago, but testing was extensive.

    • Re: (Score:2, Funny)

      by watookal ( 1085275 )

      "Running NT4 also made sure USB sticks weren't an issue, though I believe they managed to upgrade to XP a few years ago, but testing was extensive."

      The security dudes at my previous place of employment managed to devise a more portable solution to the USB stick problem: they simply glued shut the USB ports on all computers. No kidding.

      • Re: (Score:1, Informative)

        by sbenson ( 153852 )
        Set permissions on usbstor.sys

        save the glue.

        • Re: (Score:3, Informative)

          by deroby ( 568773 )
          Somehow doesn't always work. I can't explain it, but I do KNOW that it can be circumvented :

          Some time back I was a consultant at a (largish) bank. They too had 'locked out' USB devices that way. And hold & behold, it worked on any randomly available USB-stick, no external drives were mounted.

          Some days later I was 'confused' and tried to copy something using my (very) old 64Mb stick. Worked like a charm. Realizing that this was 'impossible', we tried with other USB sticks, but mine was the only one that

          • Re: (Score:1)

            by sbenson ( 153852 )
            usbstor.sys is and must be called to initiate the loading of the filesystem, a important step in the process.

            Proper permissions should stop this and has always in my networks.

            But, as I am a Linux guy, and we are talking windows.... Maybe it really only works sometimes.
            After all, who has read the windows code?

            "I believe everyone should create their own standards."

      • Re: (Score:1)

        by wev162 ( 721318 )
        Until someone pops open the case and attaches the drive to a USB header on the motherboard. Physical access means it's only a matter of time until a creative user finds a way to own a machine.
    • Now, that's reasonable security measures you're talking about. The study found that most places that got breached didn't do any of that.

      Also, working without Internet access can be a real pain. It obviously depends on what you are doing, but many things grind to a halt when there is no web access.

      Fortunately, there is WWW over SMTP. And seakernet. And ad-hoc networks.

      I guess if you try to lock down the place too much, you'll have a plethora of access vectors beyond your control in no time.

      Sometimes, better

    • Re: (Score:2)

      by ledow ( 319597 )
      It's not hard, but lots of place do it. I agree it's stupid not to.

      Schools, for instance, generally run a "curriculum" and an "admin" network - one for the kids, one for the staff. Joining both is seen as an extremely bad thing. But there's usually absolutely nothing stopping people from connecting to random websites from the admin (even in the finance offices etc.).

      Bring back the old days of text menus:

      1. Pay in
      2. Pay out
      3. Print

      Reduce the interface, reduce the capabilities, reduce the vulnerabilities.

  • Those aren't vulnerabilities... (Score:5, Funny)

    by gardyloo ( 512791 ) on Thursday June 12, 2008 @07:17AM (#23762303)
    ... those are features.

    • Re: (Score:1, Funny)

      by Anonymous Coward
      That was for the other 75%
  • Someone claiming authority approaches the corporation, ask for all of their data; the corporation responds "Sure! Would you like a bag for that? Paper or plastic?"
    http://yro.slashdot.org/article.pl?sid=07/05/08/1222239 [slashdot.org]

  • Indeed (Score:1, Troll)

    by inviolet ( 797804 )

    "The good folks over at Verizon Business...

    Shall I tag this 'badsummary', or do we have an 'oxymoron' tag we can use?

    "...have released a report that summarizes what they've found after looking through 500 forensic investigations involving 230 million records, and analyzes hundreds of corporate breaches including three of the five largest ones ever reported. What did they find? How about (1) Nearly nine in 10 corporate data breaches could have been prevented had reasonable security measures been in place,

    A

  • Why doesn't it go over the names of the companies that were breached? I've had my identity stolen but I don't know where they got my information, as I'm kind of A-R about my SSN, and such. (Thank God the ID Thieves were incredibly stupid, and only opened a home telephone account - which means they could be found because of the address for the service . . .)

    But I've also had other account information stolen, and I knew where it came from. I use a different email address for EVERY website I give any inf

    • Re: (Score:2)

      by flajann ( 658201 )
      I typically put the name of the company in as a part of the email address when I use my email address on the web. This way, I always know who the sellouts are -- as well as those with poor security. And it's always surprising who turns out to either be a sellout or barn door. You can never be sure which. I signed up for the Netscape Developer program a long time ago (remember Netscape?) and today I still get SPAM sent to "fred_netscape@..."

      I'm not really into passing laws against this sort of thing, becau

  • Legally speaking, what is "reasonable security?" FTC fined TJX for not having it, but I disagree [blogspot.com]. Verizon says 9 of 10 data breaches could have been avoided if reasonable security were present. That implies 9 in 10 breach victims were in violation of law. The study's outlook is that the solution to identity theft is locking down corporate data. But a security consultant/solution provider like this Verizon unit naturally sets a high bar for what is reasonable. And when Verizon evaluates whether reasona
  • From the people who can't distinguish the difference between 0.002 dollars and 0.002 cents, why am I not surprised?
  • Another recent study also found that water is wet and another study found that most studies are a waste of money.
  • Though it wasn't our intention, it seems the reference to the % of attacks exploiting vulnerabilities has caused some confusion. It's true that 'vulnerability' can have a very broad definition (synonym for 'weakness') but we are referring specifically here to specific named/numbered (has a CVE or MS #) software vulnerabilities. The bulk of attacks across our caseload did not exploit such vulnerabilities - they exploited misconfigurations, omissions, poor security, etc. Hope that helps clear things up a bit.

Slashdot Top Deals

"Being against torture ought to be sort of a multipartisan thing." -- Karl Lehenbauer, as amended by Jeff Daiell, a Libertarian

Close