Insider attacks comprised only 5% of breaches; most outsiders exploited weak passwords to enter networks, reported Verizon.
RSA CONFERENCE 2012 -- San Francisco -- More than 85% of the data breach incident response cases investigated by Verizon Business last year originated from a hack, and more than 90% of them came from the outside rather than via a malicious insider or business partner.
Tuesday, Verizon published a snapshot of data from its upcoming 2012 Data Breach Investigations Report, using data from its own caseload of some 90 of its 855 breach cases for last year.
"This is the first year that we worked more cases outside the U.S. than inside. That ratio has been building and it makes the case that this is not a U.S.-specific problem. All regions are having data breaches," said Wade Baker, director of research and intelligence at Verizon Enterprise Solutions.
At the top of the list of compromised industries again were retail, financial services, and hospitality. And a big factor in this year's cases was the rise in hacktivist-based attacks, according to Baker.
Outside or external attackers jumped from 88% in 2010 to 92% in 2011, and breaches due to internal threats continued to decline, from just more than 10% in 2010 to less than 5% in 2011, according to Verizon's data. "We can expect this trend to continue. Every single caseload we ever looked at shows the external [threat agent] as the majority except for one," Baker says.
As for breach methods, hacking (86%) and malware (57%) were on the rise, while social engineering, misuse, physical threats, errors, and environmental factors all dropped.
The most commonly used venue for breaches was exploiting default or easily guessed passwords, with 29% of the cases last year, followed by backdoor malware (26%), use of stolen credentials (24%), exploiting backdoor or command and control channels (23%), and keyloggers and spyware (18%). SQL injection attacks accounted for 13% of the breaches.
It's no longer a matter of if you get hacked, but when. In this special retrospective of news coverage, Monitoring Tools And Logs Make All The Difference, Dark Reading takes a look at ways to measure your security posture and the challenges that lie ahead with the emerging threat landscape. (Free registration required.)
Published: 2014-09-18 GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...
Published: 2014-09-18 Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
Published: 2014-09-18 Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.
Published: 2014-09-18 Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.