Attacks/Breaches
4/22/2011
12:07 PM
Connect Directly
RSS
E-Mail
50%
50%

Hacking Becomes Leading Cause Of Data Breaches

Businesses are the main target, and lost data is rarely password-protected or encrypted, according to a report from the Identity Theft Resource Center.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
The Identity Theft Resource Center (ITRC) announced on Tuesday that hacking has overtaken malicious insiders to become the leading cause of data breaches. Furthermore, successful attacks against businesses--as opposed to financial services groups, the government, medical sector, or education--have been on the rise, and now account for half of all 2011 data breaches.

Those findings come from the ITRC's analysis of data breaches from the start of January 2011 until April 5, 2011. During that period, the ITRC counted 130 breaches, exposing a total of 9.5 million records.

All told, nearly 37% of those breaches resulted from malicious attacks targeting computer systems, which is double the rate of 17% seen by the ITRC for all of 2010, which suggests that these types of attacks are intensifying. In addition, 12% of breaches for which the cause of data leakage was known were due to malicious insiders. As a result, that means that nearly half of all publicly known breaches resulted from targeted attacks.

Another finding is that more than one-third of all records lost due to 2011 data breaches were medical records. In March, for example, IBM informed Health Net that it couldn't locate multiple drives, previously stored in one of its data centers, which together contained 1.9 million people's medical records, including--potentially--their names, addresses, social security numbers, and financial information. Also that month, a thief stole a computer from the Eisenhower Medical Center in California that contained up to 500,000 medical records, including people's names.

The issue of lost records is not academic, or a problem experienced solely by consumers who see their personal details go missing, exposing them to identity theft. In fact, a study from 2010 found that the leading result of data breaches is business downtime. Needless to say, when employees can't access network-based resources, productivity--and profits--suffer.

Another disturbing finding is that lost data of a sensitive nature rarely seems to be protected. According to the ITRC, just 1% of lost data in 2011 was secured using encryption, and only 5% was password protected.

Some of the ITRC's findings contrast with recent studies, such as the 2011 Data Breach Investigations Report from Verizon Business, which looked at 800 cases in 2010 and had access to investigatory information from Secret Service and Dutch computer crime police cases. The report found that 92% of data breaches involved external people, while 17% involved insiders. It also found that 361 million records were compromised in 2008, while only 4 million had been compromised in 2010.

In a phone interview, ITRC founder and data breach report author Linda Foley said that she's careful to distinguish ITRC's findings from other data breach reports. "We don't have access to the Secret Service's data," she said.

As a result, groups such as the ITRC rely on statements released by breached companies, or reliable news reports. Data breach notification letters, which inform state residents when their information may have been compromised, are another source of information, and about 15 states now require such notifications. But just three states--Maryland, New Hampshire and Vermont--automatically post these data breach notifications to a public website.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5619
Published: 2014-09-29
The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which . is not a reserved name, which allows local users to hide activities it more difficult to conduct forensics activities, as demonstrated by Flame.

CVE-2012-5621
Published: 2014-09-29
lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connection with a party name that contains invalid UTF-8 strings.

CVE-2012-6107
Published: 2014-09-29
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2012-6110
Published: 2014-09-29
bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor.

CVE-2013-1874
Published: 2014-09-29
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.