Slashdot Mirror
Data Breach Study Spanning 500 Break-Ins Released
Dr. Jim Anderson writes "The good folks over at Verizon Business have released a report that summarizes what they've found after looking through 500 forensic investigations involving 230 million records, and analyzes hundreds of corporate breaches including three of the five largest ones ever reported. What did they find? How about (1) Nearly nine in 10 corporate data breaches could have been prevented had reasonable security measures been in place, (2) Fewer than 25 percent of attacks took advantage of a known or unknown vulnerability and (3) attacks from Asia, particularly in China and Vietnam, often involve application exploits leading to data compromise, while defacements frequently originate from the Middle East."
How the hell are we supposed to defend ourselves against the 75% of attacks that are immune to the laws of logic???
Some Partners!!
Watch your backs guys.
PS. How can 39% rise 5 fold?
If I had an Ass, I'd call it Fanny Bottom, then I could slap my Ass; Fanny Bottom, on the Arse.
My blog
Here is a link to the actual report (PDF): http://www.verizonbusiness.com/resources/security/databreachreport.pdf
I quickly scanned the report and it appears to be quite detailed. Definitely required reading for any CxO!
But often I wonder how many companies connect everybody in the company to the internet when there is no real need? One place I worked maintained three separate networks; one for internet, one for work, one for very confidential work. The work network had access to e-mail (internet-based e-mail through a firewall through which only the mail-server could talk) while the confidential network had only internal e-mail. This may have been overkill, but breaches were more or less impossible. Running NT4 also made sure USB sticks weren't an issue, though I believe they managed to upgrade to XP a few years ago, but testing was extensive.
Stupid users and administrators would still be considered a vulnerability, which is the problem with the wording. If a system has no vulnerabilities it is impossible to break into.
... those are features.
No, that means that there were patches available but they were never applied, or the attacker might have used social engineering or some other means to trick the person into installing malware.
The eternal struggle of good vs. evil begins within one's self.
the attacker might have used social engineering ...which is a vulnerability. Lack of proper security measures and security training.
In addition to the training, you need to make breaches of security a terminable offense, for everything from a deliberate theft of information, to writing down a password on a sticky note and putting it on your monitor. Without teeth, you cannot enforce a security policy, and a policy that isn't enforced isn't a policy.
Never underestimate the power of stupid people in large groups.
... took advantage of a known or unknown vulnerability? What the hell did the other 75% do?? username: adminpassword: password
Clearly what they are referring to are quantum vulnerabilities. The exact nature of the vulnerability doesn't become clear until someone observes it.
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
TAKE down your damn post. I'm reporting you to the FBI for cracking my password!
What are we going to do tonight Brain?
Though it wasn't our intention, it seems the reference to the % of attacks exploiting vulnerabilities has caused some confusion. It's true that 'vulnerability' can have a very broad definition (synonym for 'weakness') but we are referring specifically here to specific named/numbered (has a CVE or MS #) software vulnerabilities. The bulk of attacks across our caseload did not exploit such vulnerabilities - they exploited misconfigurations, omissions, poor security, etc. Hope that helps clear things up a bit.