Slashdot Mirror

← Back to Stories (view on slashdot.org)

Data Breach Study Spanning 500 Break-Ins Released

Posted by samzenpus on from the did-you-update-the-windows dept.

Dr. Jim Anderson writes "The good folks over at Verizon Business have released a report that summarizes what they've found after looking through 500 forensic investigations involving 230 million records, and analyzes hundreds of corporate breaches including three of the five largest ones ever reported. What did they find? How about (1) Nearly nine in 10 corporate data breaches could have been prevented had reasonable security measures been in place, (2) Fewer than 25 percent of attacks took advantage of a known or unknown vulnerability and (3) attacks from Asia, particularly in China and Vietnam, often involve application exploits leading to data compromise, while defacements frequently originate from the Middle East."

10 of 71 comments (clear)

  1. Aarrgghhh!!! by DoofusOfDeath · · Score: 4, Funny

    (2) Fewer than 25 percent of attacks took advantage of a known or unknown vulnerability and

    How the hell are we supposed to defend ourselves against the 75% of attacks that are immune to the laws of logic???

    1. Re:Aarrgghhh!!! by ledow · · Score: 4, Informative

      Yeah, it's really not clearly worded, is it?

      I assume they mean "software/hardware vulnerability", and that the other 75% are people doing stupid things - "human vulnerabilities" or even "policy vulnerabilities". It's interesting in itself though that 75% of the attacks are due to, presumably, direct human error and nothing to do with the data being on computer.

      So when you're bank next releases your details, don't accept an explanation. Most probably, someone who works there did something incredibly stupid and deliberate, rather than they got hacked or outwitted.

    2. Re:Aarrgghhh!!! by Tanktalus · · Score: 4, Insightful

      Apparently, someone is trying to make Rumsfeld out to be an idiot. Though that he may be, IMO this quote is actually fairly insightful, if somewhat poorly worded. I've had a similar saying (is it a saying if I'm the only one saying it?): "There are three types of people in the world. Those who don't know what they're doing and know they don't; those who know what they're doing and know they do; and those who don't know what they're doing but think they do. It's the last group that screws everything up for the other two groups." The thing to realise is that everyone falls into all three categories for different aspects of our lives, and the challenge is to tell the difference for each situation to try to avoid being in the last group.

      In Rumsfeld's quote, "known knowns" are the areas where we are in the middle group: knowing what we're doing, and knowing that. "Known unknowns" are the areas where we don't know what we're doing and know we don't. And "unknown unknowns" are the last group: things we think we know, but don't. (Ok, that's not quite precisely what he's talking about, but it's analogous.) And that last group is the most dangerous one.

  2. Business Partners?? by Finallyjoined!!! · · Score: 4, Funny

    Thirty-nine percent of breaches were attributed to business partners, a number that rose five-fold during the course of the period studied.

    Some Partners!!

    Watch your backs guys.

    PS. How can 39% rise 5 fold?

    --
    If I had an Ass, I'd call it Fanny Bottom, then I could slap my Ass; Fanny Bottom, on the Arse.
  3. Re:Fewer than 25 percent... by morgan_greywolf · · Score: 5, Interesting

    ... took advantage of a known or unknown vulnerability? What the hell did the other 75% do??
    Try RTFS.

    Nearly nine in 10 corporate data breaches could have been prevented had reasonable security measures been in place,
    The rest didn't need to take advantage of vulnerabilities because good security was simply not in place.
    --
    My blog
  4. Actual report by martyb · · Score: 5, Informative

    Here is a link to the actual report (PDF): http://www.verizonbusiness.com/resources/security/databreachreport.pdf

    I quickly scanned the report and it appears to be quite detailed. Definitely required reading for any CxO!

    1. Re:Actual report by morgan_greywolf · · Score: 5, Insightful

      Definitely required reading for any CxO!
      CxOs don't read things like this. Instead, they usually read advertisements that say BS things like "buy our product and you'll never have any security problems again!"

      That's why 9/10 attacks involved totally preventable breaches -- if reasonable security had been in place.

      --
      My blog
  5. Data transaction zones by Pysslingen · · Score: 5, Interesting

    But often I wonder how many companies connect everybody in the company to the internet when there is no real need? One place I worked maintained three separate networks; one for internet, one for work, one for very confidential work. The work network had access to e-mail (internet-based e-mail through a firewall through which only the mail-server could talk) while the confidential network had only internal e-mail. This may have been overkill, but breaches were more or less impossible. Running NT4 also made sure USB sticks weren't an issue, though I believe they managed to upgrade to XP a few years ago, but testing was extensive.

  6. Those aren't vulnerabilities... by gardyloo · · Score: 4, Funny

    ... those are features.

  7. Re:Fewer than 25 percent... by nocaster · · Score: 5, Funny

    ... took advantage of a known or unknown vulnerability? What the hell did the other 75% do?? username: admin
    password: password