Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/30/2016
04:50 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

BakerHostetler Data Security Incident Response Report Reveals Being 'Compromise Ready' Better Positions Companies to Respond to Incidents

Second annual report shows shift in cause of incidents - phishing/hacking/malware is now number one; cybersecurity needs to remain a top priority

New York, March 30, 2016 ––According to the 2nd annual BakerHostetler Data Security Incident Response Report phishing/hacking/malware was the cause of 31% of data security incidents during 2015, revealing a shift from 2014 when human error was the leading cause. The report also continues the inaugural-year theme that no industry is immune to data security incidents – reinforcing that it is more important than ever that companies take action in advance to become ready for the inevitable incidents to come.

“Being ‘compromise ready’ better positions companies to respond to data security incidents faster, contain the threat, and potentially lessen the severity of these events,” explains Theodore Kobus, Chair of BakerHostetler’s Privacy and Data Protection team. “This year’s report has evolved to include more robust data to raise awareness of how these events take place, and also includes the action items companies should take to their boards of directors to plan for the inevitable data security incident.”

The full 2016 BakerHostetler Data Security Incident Response Report can be found here: 2016 Report. The Privacy and Data Protection team will host a webinar on these findings on April 20 at noon ET.

The report, produced by the Privacy and Data Protection Team at BakerHostetler, analyzes data from more than 300 incidents on which the firm advised in 2015. The report looks at causes of incidents, industries most affected, and what happens after a security incident is detected – from containment, to notification, to regulatory investigations and even lawsuits. A final section in the report provides the eight components of being compromise ready and identifies measures companies should take to minimize the impact of an incident.

Notable statistics from the report include:

  • Cause of incidents: phishing/hacking/malware (31%), employee actions/mistakes (24%), external theft (17%), vendor-related incidents (14%), internal theft (8%), and lost or improper disposal (6%).
  • No industry is immune: the healthcare industry (23%) was affected more than any other. Rounding out the top three are financial services (18%) and education (16%).
  • Number of individuals notified: for incidents in 2015 where notification was made, the average number of individuals notified was 269,609 and the median was 190,000.
  • 52% of the incidents that BakerHostetler helped manage in 2015 were self-detected.
  • Detection time – the time from when an incident first began until it was detected – ranged from 0 days to more than 400 days. The average amount of time from incident to discovery for all industries was 69 days, with healthcare taking nearly twice as long as other industries. Average amount of time from discovery to containment was 7 days.
  • Notification – the average amount of time from discovery to notification – was 40 days.
  • Not all incidents require notification to individuals or the public at large. In about 40% of the incidents that BakerHostetler helped manage in 2015, notification or public disclosure was not necessary.
  • Credit monitoring was offered in 53% of the incidents that BakerHostetler advised on in 2015 and the average redemption rate was 10%.
  • Regulatory inquiries resulted from 24% of incidents reported, and litigation commenced after 6% of the incidents were made public.

“While healthcare companies again topped the ‘Frequency of Breach Incidents by Industry’ list, our findings show that those incidents are less severe than those that occur in other industries on average. In fact, topping the severity list by number of individuals affected was restaurants/hospitality, mostly due to financially motivated attacker groups moving their focus from grocers and big-box retailers to restaurants, hotels, and casinos,” explains Kobus.

Compromise Ready

“Every company should be constantly focused on preventing, detecting, and having the right capabilities in place to respond to incidents. Accepting that incidents are inevitable does not mean that you stop trying to prevent them. In addition to reducing risk profiles through information governance and implementing preventative security measures, companies must focus on adapting measures to changing risks along with faster detection and containment to effectively respond,” says BakerHostetler Privacy and Data Protection Team Partner Craig Hoffman.

“The bottom line is that the key to successful and rapid containment is to plan for the inevitable incident. Companies that have identified the forensic firm they will work with, have a master services agreement in place, and have conducted scenario planning usually reach containment faster and with less impact to business operations and reputation,” says Kobus.

###

About BakerHostetler
Celebrating the 100th anniversary of its founding this year, BakerHostetler is a leading national law firm that helps clients around the world to address their most complex and critical business and regulatory issues. With five core national practice groups – Business, Employment, Intellectual Property, Litigation, and Tax – the firm has more than 940 lawyers located in 14 offices coast to coast. Recognized for its role as court-appointed counsel to the Securities Investor Protection Act (SIPA) Trustee in the recovery of billions of dollars in principal lost in the Ponzi scheme perpetrated by Bernard L. Madoff, BakerHostetler is widely regarded as having one of the country’s top 10 tax practices, a nationally recognized litigation practice, an award-winning data privacy practice, and an industry-leading business practice. For more information, visit bakerlaw.com.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/22/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Is Zero Trust the Best Answer to the COVID-19 Lockdown?
Dan Blum, Cybersecurity & Risk Management Strategist,  5/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13485
PUBLISHED: 2020-05-25
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.
CVE-2020-13486
PUBLISHED: 2020-05-25
The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection.
CVE-2020-13482
PUBLISHED: 2020-05-25
EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
CVE-2020-13458
PUBLISHED: 2020-05-25
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action.
CVE-2020-13459
PUBLISHED: 2020-05-25
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action.