Attacks/Breaches
2/28/2014
03:27 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Verizon Shares Glimpse Into Upcoming 2014 Data Breach Investigations Report

Breach data for upcoming Verizon report comes from some 50 contributing organizations from 95 nations, including Eastern European and Latin American CERTs

RSA CONFERENCE 2014 – San Francisco -- A decade of breach data gathered by Verizon for its Data Breach Investigations Report shows that the bad guys are winning when it comes to the efficiency of hacking into their victims' systems, executives from the company said here this week.

RSA Conference 2014
Click here for more articles about the RSA Conference.

Wade Baker, managing principal of RISK Intelligence for Verizon and one of the main authors of the company's renowned annual breach report, gave a little sneak peek here at some of the findings of the upcoming 2014 DBIR, due this spring. Baker says in three-fourths of the cases, it takes attackers days or less to compromise their target, while one-fourth of the time, victim organizations discover the attack in days or less.

"Attackers are getting quicker at compromising systems over the past 10 years," Baker said. "Less than 25 percent of good guys discovered these incidents in days or less. This is not a good situation ... The bad guys are winning at a faster rate than the good guys are winning."

[Verizon Data Breach Investigations Report 2013 says financial cybercrime accounting for three-fourths of real-world breaches, followed by cyberespionage in one-fifth of breaches. See No 'One Size Fits All' In Data Breaches, New Verizon Report Finds.]

This year's DBIR draws from 50 different contributing organizations from 95 different countries, including the U.S. Secret Service, the Poland CERT, and Latin American CERTs. That's a big jump from the 19 contributors representing 27 countries in the 2013 Verizon DBIR.

Bryan Sartin, director of Verizon's RISK Team, said incident detection is the underlying problem with the delayed awareness and reaction of victim organizations to attacks. Verizon in its report last year said most intrusions go undiscovered for seven months on average. "Victims don't even find out on their own. They are finding out from someone else," Sartin said. "Clearly, [what] has to change is detection -- the inability of victims to recognize and react to indicators of a cyberattack before it ends up a data breach and is in the headlines. That inability is security's greatest single failure."

U.S. Secret Service special agent Edward Lowery, who heads up the agency's criminal investigative division, said in a panel discussion hosted by Verizon here that it's all about the money for the bad guys his agency tracks. "They are in it for the profit, and their business model requires that they be surreptitious. It's all about the money," Lowery said.

He said the surge in retail breaches of late isn't really new to that industry. But these and other breaches are becoming more sophisticated compared with earlier attacks, such as the one on TJX. "We have seen changes in the attack vectors ... how long these individuals have been in the system. They study for their future crimes, looking for the vulnerabilities they can exploit," Lowery said. "The actual intrusion may happen really quickly, but the work they do beforehand may not happen quickly."

Verizon's Baker says the bad news from this year's report is that the cybercriminals and other attackers are getting better at what they do, while the security community is not improving its game quickly enough to keep pace.

Verizon said its upcoming DBIR will include more specific recommendations for incidents and more "actionable" information.

The 2013 Verizon DBIR found attacks occurring in minutes or less in 84 percent of the cases, while 66 percent of breaches go undetected for months or even years.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Ulf Mattsson
50%
50%
Ulf Mattsson,
User Rank: Apprentice
4/26/2014 | 12:01:43 PM
The Bad Guys are Winning
I agree when Verizon's Baker says "the bad news from this year's report is that the cybercriminals and other attackers are getting better at what they do, while the security community is not improving its game quickly enough to keep pace."

The bad news, as Wade Baker, principal author of the Data Breach Investigations Report (DBIR) series, says is that: "After analyzing 10 years of data, we realize most organizations cannot keep up with cybercrime – and the bad guys are winning."

My view is that that we are now more concerned about attackers that are targeting our data flow, including data in memory since the DBIR reported that "RAM scrapers" went from a low #17 in 2012 and shoot up the charts to a very concerning #4 spot in 2013. 

My view is that that we are now less concerned about attackers that are targeting our stored data since the DBIR reported that "Capture stored data" went from a #4 in 2012 and to a less concerning #9 spot in 2013 and "Privilege abuse" went from a #14 in 2012 and to a less concerning #17 spot in 2013.

I think that file encryption will not stop the bad guys. The bad guys are no longer attacking stored data. The bad guys are now attacking the data flow, including data in memory.

My view is that we now need to secure the data flow, including data in memory. The bad guys are no longer attacking stored data.

I'm increasingly concerned about Big Data and Cloud platforms, great targets for attackers.

An important development was the addition of coarse-grained volume or file encryption will only solve one problem, protecting data at rest, but considering one of the primary goals is using the data, one might suggest that it provided little in the grand scheme of Data security.  Sensitive data in use for analytics, traveling between nodes, sent to other systems, or even just being viewed is subject to full exposure.

What they're seeking is advanced functionality equal to the task of balancing security and regulatory compliance with data insights and data utility. This balance is critical for Big Data and Cloud platforms.

Emerging Big Data and Cloud platforms are presenting new use cases that are requiring data insight for analytics, high performance and scalability for Big Data platforms cannot be achieved by old security approaches.  New security approaches are required since Big Data is based on a new and different architecture.

Big Data is introducing a new approach to collecting data by allowing unstructured data to be blindly collected. In many cases we do not even know about all sensitive and regulated data fields that are contained in these large data feeds. Analysis of the content is often deferred to a later point in the process, to a stage when we are starting to use the data for analytics. Then it is too late to go back and try to apply data security and compliance to regulations.

My view is that we now need to secure the data flow. The bad guys are no longer attacking stored data in files.

Ulf Mattsson, CTO Protegrity
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7877
Published: 2014-10-30
Unspecified vulnerability in the kernel in HP HP-UX B.11.31 allows local users to cause a denial of service via unknown vectors.

CVE-2014-3051
Published: 2014-10-29
The Internet Service Monitor (ISM) agent in IBM Tivoli Composite Application Manager (ITCAM) for Transactions 7.1 and 7.2 before 7.2.0.3 IF28, 7.3 before 7.3.0.1 IF30, and 7.4 before 7.4.0.0 IF18 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s...

CVE-2014-3668
Published: 2014-10-29
Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) via (1) a crafted first argument t...

CVE-2014-3669
Published: 2014-10-29
Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function ...

CVE-2014-3670
Published: 2014-10-29
The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly exec...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.