Risk
6/10/2008
07:13 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Data Breaches Made Possible By Incompetence, Carelessness

Still, installing software patches as soon as they're made available will significantly reduce the chance of a data breach, according to a Verizon Business Security survey.

Eighty-seven percent of data breaches could have been prevented with reasonable security precautions, according to a study of over 500 forensic investigations conducted by Verizon Business Security Solutions.

Verizon's study of actual data breach investigations from 2004 through 2007 suggests that incompetence and carelessness represents the greatest threat to business information.

The study found that breaches were attributable a combination of events more frequently than a single action, including: a significant error (62%), hacking and intrusions (59%), malicious code (31%), an exploited vulnerability (22%), and physical threats (15%).

But for 90% of the known vulnerabilities exploited, patches were available for at least six months prior to the attack. This data point alone suggests that installing software patches as soon as they're made available will significantly reduce the chance of a data breach.

"We're seeing more and more examples of security breaches and compromises taking the path of least resistance," said Bryan Sartin, VP of investigative response at Verizon.

Fifty-two percent of attacks were rated as having a "low" difficulty level, according to the report. And only 15% of attacks were fully targeted. The remaining attacks were directed but opportunistic (46%) or randomly opportunistic (39%). An example of such an attack might be a hacker scanning the Web for sites running a particular vulnerable software application.

Based on the cases investigated, the type of data compromised falls into the following categories: payment card data (84%), personally identifiable information (32%), non-sensitive data (16%), authentication credentials (15%), other sensitive data (10%), intellectual property (8%), corporate financial data (5%), and medical/patient data (3%).

The study found that those responsible for data breaches were: external sources (73%), insiders (18%), business partners (39%), and multiple parties (30%). While insiders accounted for the smallest percentage of breaches, the breaches traced to them involved more than ten times as many records (375,000) as breaches traced to outsiders (30,000) and about twice as many records as breaches traced to partners (187,500).

Calculating risk by multiplying the likelihood of involvement times the number of records affected, the study concludes that business partners represent the greatest threat, followed closely by insiders.

"The most insidious breaches these days involve partial insiders, contractors, and third-parties who have ability misuse access," said Sartin.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-4350
Published: 2014-09-19
Buffer overflow in QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MIDI file.

CVE-2014-4376
Published: 2014-09-19
IOKit in IOAcceleratorFamily in Apple OS X before 10.9.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an application that provides crafted API arguments.

CVE-2014-4390
Published: 2014-09-19
Bluetooth in Apple OS X before 10.9.5 does not properly validate API calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application.

Best of the Web
Dark Reading Radio