Attacks/Breaches
4/22/2011
12:07 PM
Connect Directly
RSS
E-Mail
50%
50%

Hacking Becomes Leading Cause Of Data Breaches

Businesses are the main target, and lost data is rarely password-protected or encrypted, according to a report from the Identity Theft Resource Center.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
The Identity Theft Resource Center (ITRC) announced on Tuesday that hacking has overtaken malicious insiders to become the leading cause of data breaches. Furthermore, successful attacks against businesses--as opposed to financial services groups, the government, medical sector, or education--have been on the rise, and now account for half of all 2011 data breaches.

Those findings come from the ITRC's analysis of data breaches from the start of January 2011 until April 5, 2011. During that period, the ITRC counted 130 breaches, exposing a total of 9.5 million records.

All told, nearly 37% of those breaches resulted from malicious attacks targeting computer systems, which is double the rate of 17% seen by the ITRC for all of 2010, which suggests that these types of attacks are intensifying. In addition, 12% of breaches for which the cause of data leakage was known were due to malicious insiders. As a result, that means that nearly half of all publicly known breaches resulted from targeted attacks.

Another finding is that more than one-third of all records lost due to 2011 data breaches were medical records. In March, for example, IBM informed Health Net that it couldn't locate multiple drives, previously stored in one of its data centers, which together contained 1.9 million people's medical records, including--potentially--their names, addresses, social security numbers, and financial information. Also that month, a thief stole a computer from the Eisenhower Medical Center in California that contained up to 500,000 medical records, including people's names.

The issue of lost records is not academic, or a problem experienced solely by consumers who see their personal details go missing, exposing them to identity theft. In fact, a study from 2010 found that the leading result of data breaches is business downtime. Needless to say, when employees can't access network-based resources, productivity--and profits--suffer.

Another disturbing finding is that lost data of a sensitive nature rarely seems to be protected. According to the ITRC, just 1% of lost data in 2011 was secured using encryption, and only 5% was password protected.

Some of the ITRC's findings contrast with recent studies, such as the 2011 Data Breach Investigations Report from Verizon Business, which looked at 800 cases in 2010 and had access to investigatory information from Secret Service and Dutch computer crime police cases. The report found that 92% of data breaches involved external people, while 17% involved insiders. It also found that 361 million records were compromised in 2008, while only 4 million had been compromised in 2010.

In a phone interview, ITRC founder and data breach report author Linda Foley said that she's careful to distinguish ITRC's findings from other data breach reports. "We don't have access to the Secret Service's data," she said.

As a result, groups such as the ITRC rely on statements released by breached companies, or reliable news reports. Data breach notification letters, which inform state residents when their information may have been compromised, are another source of information, and about 15 states now require such notifications. But just three states--Maryland, New Hampshire and Vermont--automatically post these data breach notifications to a public website.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7392
Published: 2014-07-22
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.

CVE-2014-2385
Published: 2014-07-22
Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter t...

CVE-2014-4326
Published: 2014-07-22
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.

CVE-2014-4511
Published: 2014-07-22
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.

CVE-2014-4911
Published: 2014-07-22
The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.