Slashdot Mirror
Data Breach Study Spanning 500 Break-Ins Released
Dr. Jim Anderson writes "The good folks over at Verizon Business have released a report that summarizes what they've found after looking through 500 forensic investigations involving 230 million records, and analyzes hundreds of corporate breaches including three of the five largest ones ever reported. What did they find? How about (1) Nearly nine in 10 corporate data breaches could have been prevented had reasonable security measures been in place, (2) Fewer than 25 percent of attacks took advantage of a known or unknown vulnerability and (3) attacks from Asia, particularly in China and Vietnam, often involve application exploits leading to data compromise, while defacements frequently originate from the Middle East."
How the hell are we supposed to defend ourselves against the 75% of attacks that are immune to the laws of logic???
... took advantage of a known or unknown vulnerability? What the hell did the other 75% do??
Fewer than 25 percent of attacks took advantage of a known or unknown vulnerability
So, 75% of attacks didn't take advantage of a vulnerability at all?
Some Partners!!
Watch your backs guys.
PS. How can 39% rise 5 fold?
If I had an Ass, I'd call it Fanny Bottom, then I could slap my Ass; Fanny Bottom, on the Arse.
Here is a link to the actual report (PDF): http://www.verizonbusiness.com/resources/security/databreachreport.pdf
I quickly scanned the report and it appears to be quite detailed. Definitely required reading for any CxO!
But often I wonder how many companies connect everybody in the company to the internet when there is no real need? One place I worked maintained three separate networks; one for internet, one for work, one for very confidential work. The work network had access to e-mail (internet-based e-mail through a firewall through which only the mail-server could talk) while the confidential network had only internal e-mail. This may have been overkill, but breaches were more or less impossible. Running NT4 also made sure USB sticks weren't an issue, though I believe they managed to upgrade to XP a few years ago, but testing was extensive.
... those are features.
erosion of user crisco or 7ube. User. 'NoGw that intentions and
But did it run linux?
By Middle East, they mean almost exclusively from Israel, but they can't say that.
Someone claiming authority approaches the corporation, ask for all of their data; the corporation responds "Sure! Would you like a bag for that? Paper or plastic?"
http://yro.slashdot.org/article.pl?sid=07/05/08/1222239
Prisencolinensinainciusol. Ol Rait!
Shall I tag this 'badsummary', or do we have an 'oxymoron' tag we can use?
As well, nearly nine in 10 corporate assholes could have been prevented had reasonable security measures been in place at the time of conception.
Also dehandments and deheadments.
FATMOUSE + YOU = FATMOUSE
Clearly what they are referring to are quantum vulnerabilities. The exact nature of the vulnerability doesn't become clear until someone observes it.
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
Why doesn't it go over the names of the companies that were breached? I've had my identity stolen but I don't know where they got my information, as I'm kind of A-R about my SSN, and such. (Thank God the ID Thieves were incredibly stupid, and only opened a home telephone account - which means they could be found because of the address for the service . . .)
But I've also had other account information stolen, and I knew where it came from. I use a different email address for EVERY website I give any information to, specifically to determine if my information was given away, or stolen. (Catch-All Email on a private domain.)
I had signed up to eHarmony, but never gave them my CC#, or anything besides an email, and now this email address gets TONS of spam for V!@GRA and pr0n sites. So, I know their system was hacked. However, I never heard a word from them about the data breach or my account info being stolen.
Companies need to be made criminally liable for data breaches that could have been prevented, as well as be forced to reveal any and all breaches as soon as they know about them. But that's just not in the companies best interests, and their lobbyists let the Republicans know this. Real security might cost them a little more money, and hiding data breaches doesn't cost them much at all. So, there are no incentives to do any different.
Just because you're paranoid, it doesn't mean that they're not out to get you.
Legally speaking, what is "reasonable security?" FTC fined TJX for not having it, but I disagree. Verizon says 9 of 10 data breaches could have been avoided if reasonable security were present. That implies 9 in 10 breach victims were in violation of law. The study's outlook is that the solution to identity theft is locking down corporate data. But a security consultant/solution provider like this Verizon unit naturally sets a high bar for what is reasonable. And when Verizon evaluates whether reasonable security could have prevented a break-in, it does so with the benefit of hindsight. Yet the study goes on to say that in modern systems knowing where all your data reside is "an extremely complex challenge." In other words, the shere problem of keeping up with the location of data (so you can apply security) is very expensive, and mistakes by data-holders who act in good faith are easy. The reasonable measures expected by FTC and Verizon are extravagantly hard to implement in practice. Hence, the portion of incidents preventable by FTC/Verizon's reasonable procedures is much lower than 90%. We need to focus more attention on other solutions to identity theft. --Ben http://hack-igations.blogspot.com/2008/03/ftc-treats-tjx-unfairly.html
Benjamin Wright, Dallas, Texas, benjaminwright.us
Except for one thing: They used a very insecure Novell server for the NT workstations to log into. Needless to say, it was insanely easy to log in as "Unknown" due to Novell's ridiculous security holes.
From the people who can't distinguish the difference between 0.002 dollars and 0.002 cents, why am I not surprised?
Ruby Neural Evolution of Augmenting Topologies
did verizon count themselves? http://www.consumeraffairs.com/news04/2006/03/verizon_laptops.html
Another recent study also found that water is wet and another study found that most studies are a waste of money.
Disclaimer: The opinions and actions of the US Gov't are in no way representative of those held by this author or its ci
later sseN in
Though it wasn't our intention, it seems the reference to the % of attacks exploiting vulnerabilities has caused some confusion. It's true that 'vulnerability' can have a very broad definition (synonym for 'weakness') but we are referring specifically here to specific named/numbered (has a CVE or MS #) software vulnerabilities. The bulk of attacks across our caseload did not exploit such vulnerabilities - they exploited misconfigurations, omissions, poor security, etc. Hope that helps clear things up a bit.