Organized crime has been known as a group responsible for trading in stolen, personally identifiable information. The recent 2010 Verizon Data Breach Investigations Report (PDF link) reports that organized criminals were responsible for 85% of all data breaches caused by external agents. As a whole, data breaches caused by external agents comprise 70% of all data breaches, and 98% of all record compromised. Statistics, analysis and recommendations pepper the 66-page report.
The Verizon Report also noted that 98% of all breaches came from servers, 85% of attacks were considered highly difficult, 61% of data breaches were actually discovered by third parties, 86% of parties with compromised systems had evidence in their log files that a breach had occurred, 96% of breaches were avoidable through simple or intermediate steps of fixes, and 79% of parties with compromised systems that were subject to PCI-DSS had not achieved compliance.
Hacking, while making up on 40% of all breaches, accounted for 94% of all records compromised. The chart below, taken from the Verizon Report, shows the breakdown of the various categories of Hacking.
.jpg)
Source: 2010 Verizon Data Breach Investigations Report
Verizon’s press release provides a brief summary of the Verizon Report, but a full read is recommended for those persons in charge of protecting networks containing personally identifiable information.
Key Findings of the 2010 Report
This year’s key findings both reinforce prior conclusions and offer new insights. These include:
• Most data breaches investigated were caused by external sources. Sixty-nine percent of breaches resulted from these sources, while only 11 percent were linked to business partners. Forty-nine percent were caused by insiders, which is an increase over previous report findings, primarily due in part to an expanded dataset and the types of cases studied by the Secret Service.
• Many breaches involved privilege misuse. Forty-eight percent of breaches were attributed to users who, for malicious purposes, abused their right to access corporate information. An additional 40 percent of breaches were the result of hacking, while 28 percent were due to social tactics and 14 percent to physical attacks.
• Commonalities continue across breaches. As in previous years, nearly all data was breached from servers and online applications. Eight-five percent of the breaches were not considered highly difficult, and 87 percent of victims had evidence of the breach in their log files, yet missed it.
• Meeting PCI-DSS compliance still critically important. Seventy-nine percent of victims subject to the PCI-DSS standard hadn’t achieved compliance prior to the breach.
Recommendations for Enterprises
The 2010 study once again shows that simple actions, when done diligently and continually, can reap big benefits. These actions include:
• Restrict and monitor privileged users. The data from the Secret Service showed that there were more insider breaches than ever before. Insiders, especially highly privileged ones, can be difficult to control. The best strategies are to trust but verify by using pre-employment screening; limit user privileges; and employ separation of duties. Privileged use should be logged and messages detailing activity generated to management.
• Watch for ‘Minor’ Policy Violations. The study finds a correlation between seemingly minor policy violations and more serious abuse. This suggests that organizations should be wary of and adequately respond to all violations of an organization’s policies. Based on case data, the presence of illegal content on user systems or other inappropriate behavior is a reasonable indicator of a future breach. Actively searching for such indicators may prove even more effective.
• Implement Measures to Thwart Stolen Credentials. Keeping credential-capturing malware off systems is priority No. 1. Consider two-factor authentication where appropriate. If possible, implement time-of-use rules, IP blacklisting and restricting administrative connections.
• Monitor and Filter & Outbound Traffic. At some point during the sequence of events in many breaches, something (data, communications, connections) goes out externally via an organization’s network that, if prevented, could break the chain and stop the breach. By monitoring, understanding and controlling outbound traffic, an organization can greatly increase its chances of mitigating malicious activity.
• Change Your Approach to Event Monitoring and Log Analysis. Almost all victims have evidence of the breach in their logs. It doesn’t take much to figure out that something is amiss and make needed changes. Organizations should make time to review more thoroughly batch-processed data and analysis of logs. Make sure there are enough people, adequate tools and sufficient processes in place to recognize and respond to anomalies.
• Share Incident Information. An organization’s ability to fully protect itself is based on the information available to do so. Verizon believes the availability and sharing of information are crucial in the fight against cybercrime. We commend all those organizations that take part in this effort, through such data-sharing programs as the Verizon VERIS Framework.
Sources: Verizon Press Release
2010 Verizon Data Breach Investigations Report