The Human Element Behind Malware-Related Breaches

Last year, the Verizon Data Breach Investigation Report made a big splash with insightful statistics on actual data breach investigations performed by the company's incident response team. Last week, the team released an updated version (PDF) for 2009 that includes more data, as well as an interesting look at what happened during the past year. What's grabbing my attention? The numbers related to malware.For example, last year nine out of 10 recorded breaches (of a total 285 million) were due to malware deposited onto a system by a remote attacker. The most prevalent function in the deposited malware was some sort of keylogger or spyware to capture authentication credentials. I'm only slightly comforted that it was an attacker behind the malware install and not duped users.

Users aren't totally without blame, though. The Verizon report says seven infections came from Websites -- three directly downloaded and installed by the users. The other four cases involved a vulnerability that had a patch available for more than a year.

So looking at those numbers, who is the culprit? Who gets fingered? Who must shoulder the blame? Malware certainly played a critical role in the breaches, but don't discount the human element, with an attacker installing the malware once a system was compromised. Or perhaps a user browsed to a malicious Website and clicked "Yes" on a deceptive Web pop-up.

Without knowing the details behind the numbers, it's still safe to point out that a person was involved in every breach, either as the perpetrator or, in a handful of cases, the victim.

Be prepared: You'll probably hear a lot of salespeople spouting off numbers from the Verizon report as the reason why you need their producst. Instead of sitting there nodding, take the time to read the report so you can understand the context of the numbers and respond appropriately.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.