Slashdot Mirror
Data Breach Study Spanning 500 Break-Ins Released
Dr. Jim Anderson writes "The good folks over at Verizon Business have released a report that summarizes what they've found after looking through 500 forensic investigations involving 230 million records, and analyzes hundreds of corporate breaches including three of the five largest ones ever reported. What did they find? How about (1) Nearly nine in 10 corporate data breaches could have been prevented had reasonable security measures been in place, (2) Fewer than 25 percent of attacks took advantage of a known or unknown vulnerability and (3) attacks from Asia, particularly in China and Vietnam, often involve application exploits leading to data compromise, while defacements frequently originate from the Middle East."
How the hell are we supposed to defend ourselves against the 75% of attacks that are immune to the laws of logic???
... took advantage of a known or unknown vulnerability? What the hell did the other 75% do??
Fewer than 25 percent of attacks took advantage of a known or unknown vulnerability
So, 75% of attacks didn't take advantage of a vulnerability at all?
Some Partners!!
Watch your backs guys.
PS. How can 39% rise 5 fold?
If I had an Ass, I'd call it Fanny Bottom, then I could slap my Ass; Fanny Bottom, on the Arse.
Here is a link to the actual report (PDF): http://www.verizonbusiness.com/resources/security/databreachreport.pdf
I quickly scanned the report and it appears to be quite detailed. Definitely required reading for any CxO!
But often I wonder how many companies connect everybody in the company to the internet when there is no real need? One place I worked maintained three separate networks; one for internet, one for work, one for very confidential work. The work network had access to e-mail (internet-based e-mail through a firewall through which only the mail-server could talk) while the confidential network had only internal e-mail. This may have been overkill, but breaches were more or less impossible. Running NT4 also made sure USB sticks weren't an issue, though I believe they managed to upgrade to XP a few years ago, but testing was extensive.
... those are features.
Someone claiming authority approaches the corporation, ask for all of their data; the corporation responds "Sure! Would you like a bag for that? Paper or plastic?"
http://yro.slashdot.org/article.pl?sid=07/05/08/1222239
Prisencolinensinainciusol. Ol Rait!
Well yes, but there's also an important reason for the -1 mod: the GP has no factual basis for laying the blame on Israel.
In fact, I've seen far more attacks coming from Pakistan, Egypt and Yemen (?!) than Israel. But yes, people are racially biased... whether it's pro-racism or anti-racism, very few people have the discipline to be right down the middle.
I think what a lot of people neglect to do is to filter access by country. If you're operating a U.S. bank, why in the world would you want Vietnamese and Chinese IPs visiting your site or hammering your firewall ? Do you have an admin over there, SSHing in ? No ? Then block it!
It's usually quite simple to come up with a geographically aware security strategy. Figure out which areas need access to each resource, and shut out the rest. Web access isn't spared, either. If you don't offer services outside your country, I strongly suggest serving up a different, nerfed site to those people - something with no sign-up forms or dynamic content of any kind. That way, they can still read up about who you are and what you do (again, goddamned travelers surfing abroad), but since you don't do business with that nation, you don't expose your site's soft underbelly to people who have no business being there in the first place. There's always the phone or postal mail for those folks.
-Billco, Fnarg.com
Shall I tag this 'badsummary', or do we have an 'oxymoron' tag we can use?
As well, nearly nine in 10 corporate assholes could have been prevented had reasonable security measures been in place at the time of conception.
Also dehandments and deheadments.
FATMOUSE + YOU = FATMOUSE
Unfortunately Zone-H is down at present, but when it's up I invite you to check for yourself.
One swallow does not a fellatrix make
As a U.S. bank are you really going to tell your customers, "By the way, if you ever need to access your account while on vacation outside the country, you're out of luck?"
Web access isn't spared, either. If you don't offer services outside your country, I strongly suggest serving up a different, nerfed site to those people - something with no sign-up forms or dynamic content of any kind.Most of your customers assume that World Wide Web means just that: world wide. If I were a business owner, I'd certainly think twice before potentially driving away customers by telling them, in essence, "I can't trust you because you're not from the same country I am."
We all know what to do, but we don't know how to get re-elected once we have done it
Clearly what they are referring to are quantum vulnerabilities. The exact nature of the vulnerability doesn't become clear until someone observes it.
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
Why doesn't it go over the names of the companies that were breached? I've had my identity stolen but I don't know where they got my information, as I'm kind of A-R about my SSN, and such. (Thank God the ID Thieves were incredibly stupid, and only opened a home telephone account - which means they could be found because of the address for the service . . .)
But I've also had other account information stolen, and I knew where it came from. I use a different email address for EVERY website I give any information to, specifically to determine if my information was given away, or stolen. (Catch-All Email on a private domain.)
I had signed up to eHarmony, but never gave them my CC#, or anything besides an email, and now this email address gets TONS of spam for V!@GRA and pr0n sites. So, I know their system was hacked. However, I never heard a word from them about the data breach or my account info being stolen.
Companies need to be made criminally liable for data breaches that could have been prevented, as well as be forced to reveal any and all breaches as soon as they know about them. But that's just not in the companies best interests, and their lobbyists let the Republicans know this. Real security might cost them a little more money, and hiding data breaches doesn't cost them much at all. So, there are no incentives to do any different.
Just because you're paranoid, it doesn't mean that they're not out to get you.
Legally speaking, what is "reasonable security?" FTC fined TJX for not having it, but I disagree. Verizon says 9 of 10 data breaches could have been avoided if reasonable security were present. That implies 9 in 10 breach victims were in violation of law. The study's outlook is that the solution to identity theft is locking down corporate data. But a security consultant/solution provider like this Verizon unit naturally sets a high bar for what is reasonable. And when Verizon evaluates whether reasonable security could have prevented a break-in, it does so with the benefit of hindsight. Yet the study goes on to say that in modern systems knowing where all your data reside is "an extremely complex challenge." In other words, the shere problem of keeping up with the location of data (so you can apply security) is very expensive, and mistakes by data-holders who act in good faith are easy. The reasonable measures expected by FTC and Verizon are extravagantly hard to implement in practice. Hence, the portion of incidents preventable by FTC/Verizon's reasonable procedures is much lower than 90%. We need to focus more attention on other solutions to identity theft. --Ben http://hack-igations.blogspot.com/2008/03/ftc-treats-tjx-unfairly.html
Benjamin Wright, Dallas, Texas, benjaminwright.us
Except for one thing: They used a very insecure Novell server for the NT workstations to log into. Needless to say, it was insanely easy to log in as "Unknown" due to Novell's ridiculous security holes.
From the people who can't distinguish the difference between 0.002 dollars and 0.002 cents, why am I not surprised?
Ruby Neural Evolution of Augmenting Topologies
did verizon count themselves? http://www.consumeraffairs.com/news04/2006/03/verizon_laptops.html
The full text from the grandparent post: If you're operating a U.S. bank, why in the world would you want Vietnamese and Chinese IPs visiting your site or hammering your firewall ? Do you have an admin over there, SSHing in ?
If you are a bank, do you have your users signing in via SSH???
No, you probably don't want to block access to HTTPS (you ARE using HTTPS, right?) or SMTP from Vietnam or China (I would add Korea to this list based on the SSH and spam mails I've seen from Korean networks), and yes, I am aware that this implies that it would be possible to brute force your customers' passwords if you don't do something sensible like lock out their accounts after x invalid password attempts.
MCSE? No, sir...I don't do Windows. Yes, I am an idealist. What's your point?
Another recent study also found that water is wet and another study found that most studies are a waste of money.
Disclaimer: The opinions and actions of the US Gov't are in no way representative of those held by this author or its ci
I was speaking to the following quote (perhaps I should have been more clear in my original post):
Web access isn't spared, either. If you don't offer services outside your country, I strongly suggest serving up a different, nerfed site to those people - something with no sign-up forms or dynamic content of any kind.If your customers are overseas and they get the nerfed version of your site that doesn't allow for logins on any sort of interaction they'll certainly take their business to someone who does allow that sort of thing.
We all know what to do, but we don't know how to get re-elected once we have done it
Ah...sorry. My mistake.
MCSE? No, sir...I don't do Windows. Yes, I am an idealist. What's your point?
Though it wasn't our intention, it seems the reference to the % of attacks exploiting vulnerabilities has caused some confusion. It's true that 'vulnerability' can have a very broad definition (synonym for 'weakness') but we are referring specifically here to specific named/numbered (has a CVE or MS #) software vulnerabilities. The bulk of attacks across our caseload did not exploit such vulnerabilities - they exploited misconfigurations, omissions, poor security, etc. Hope that helps clear things up a bit.
There's still phone banking... it's not like you'd be entirely locked out of your account.
-Billco, Fnarg.com