Attacks/Breaches
5/23/2017
08:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Data Breach, Vulnerability Data on Track to Set New Records in 2017

There are so far 1,254 publicly reported data breaches and 4,837 published vulnerabilities in the first quarter of this year.

Enterprise security executives looking for metrics to justify their budgets to top management should have plenty of material to choose from for the rest of year.

Two reports from Risk Based Security this week show that numbers related to data breaches and software vulnerabilities look set to break new records in 2017, if first quarter trends are any indication.

Risk Based Security's analysis of Q1 data showed there were a total of 1,254 publicly reported data breaches worldwide, which together exposed a mind-boggling 3.4 billion records containing sensitive data.

Two breaches alone accounted for over 2.5 billion of those breached records. One involved River City Media and exposed 1.34 billion email addresses while the other at Chinese Internet Service Provider NetEase Inc. exposed nearly 1.3 billion email addresses and passwords that were later sold on the Dark Web.

On the vulnerability front, Risk Based Security's VulnDB database published a total of 4,837 vulnerabilities in the first quarter of 2017. That number was 29.2% higher than the number of discovered vulnerabilities in the same quarter in 2016 and some 2,274 more than the vulnerabilities in the widely used National Vulnerability Database (NVD).

More than 35% of the flaws already had publicly available exploits or there was enough information about them to make the flaws trivially exploitable, according to Risk Based Security. Over 50% of the disclosed software flaws were remotely exploitable while 18% had a severity rating of 9 or above on an ascending scale of 1 to 10.

The numbers are sobering and suggest that 2017 is well on its way to becoming the worst year on record for data breaches and software vulnerabilities. For all of 2016 for instance, data breaches exposed 4.2 billion records compared to the 3.4 billion in this year's first quarter alone.

The number of extremely large datasets that have been exposed so far this year or offered for sale in particular is surprising, says Inga Goddijn, executive vice president at Risk Based Security.

"After last year's disclosure at Yahoo, we thought it would be a long time before we saw another breach exposing over 1 billion records," she says. Surprisingly, there were two events in Q1 that exposed over one billion records.

The same widespread phishing and business email compromise activity that drove breach numbers in 2016 is fuelling the trend this year as well, according to Risk Based Security. Many of the phishing campaigns have targeted data in W-2 forms for the purposes of carrying on tax fraud.

But as massive as the data breach numbers are, the overall severity of data breaches has not gotten significantly worse.

"While there were a number of surprisingly large breaches, the overall severity of breach events remains steady," Goddijn says. Risk Based Security assigns severity scores based on the number of records that were exposed in a breach, the type of data that was involved, the breached industry, and other factors.

"Approximately 45% of reported breaches impacted somewhere between one and 10,000 records and the majority of breaches score below a 6 on our severity scale of 0.01 to 10," in terms of type of data exposure and impact. "It is encouraging to see severity scores staying relatively steady, indicating overall breach severity is not increasing," Goodign says.

Significantly, nearly 18% of the reported data breaches in the first quarter of 2017 had unknown origins. An unknown breach, says Goodijn, is one where the organization responsible for a data leak cannot be identified at the time of the compromise. "This tends to happen when data is leaked and the persons doing the leaking does not identify the data source or when there is a business relationship between the party responsible for the compromise and the party disclosing the breach," she says.

Jake Kouns, the chief information security office and chief operating officer at Risk Based Security, says a lot of the vulnerabilities discovered in products stem from a lack of mature software development practices at many organizations.

"Of all the vulnerabilities disclosed in Q1 2017, 68.1% are due to insufficient or improper input validation," Kouns says. "While a lot of vulnerabilities fall under this umbrella, including cross-site scripting, SQL injection, shell command injection, and buffer overflows, it underlines that vendors still struggle to carefully validate untrusted input," he says.

Web-related flaws accounted for nearly 60% of publicly disclosed vulnerabilities in Q1 2017. Of this, 30% were SQL injection errors.

Risk Based Security's vulnerability count includes flaws in the National Vulnerability Database that have an assigned CVE number attached to them as well as vulnerabilities for which no CVEs are yet available. Contrary to popular perception, the lack of a CVE number does not automatically mean a vulnerability is not serious or effects only obscure products, Risk Based Security said.

Overall, products from major vendors accounted for 31.1% of the vulnerabilities reported in Q1 2017, Kouns says.

Topping the list of companies with the most publicly reported vulnerabilities in its products was Oracle with 369 security vulnerabilities across its software portfolio. Google, which often makes a big deal about flaws in software from other vendors, came in second with 302 reported security vulnerabilities, while Microsoft took third spot with 204.

Adobe topped the list from a vulnerability severity standpoint. The 100 vulnerabilities that were discovered in its products in the first quarter had an average severity rating of 8.84 compared to 6.05 for Oracle's vulnerabilities and 6.62 for Microsoft's software flaws. Google ranked second with security vulnerabilities in its products, having an average vulnerability severity score of 7.1.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Malware Incidents Hit 100% of Businesses
Dawn Kawamoto, Associate Editor, Dark Reading,  11/17/2017
3 Ways to Retain Security Operations Staff
Oliver Rochford, Vice President of Security Evangelism at DFLabs,  11/20/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.