Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/23/2017
08:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Data Breach, Vulnerability Data on Track to Set New Records in 2017

There are so far 1,254 publicly reported data breaches and 4,837 published vulnerabilities in the first quarter of this year.

Enterprise security executives looking for metrics to justify their budgets to top management should have plenty of material to choose from for the rest of year.

Two reports from Risk Based Security this week show that numbers related to data breaches and software vulnerabilities look set to break new records in 2017, if first quarter trends are any indication.

Risk Based Security's analysis of Q1 data showed there were a total of 1,254 publicly reported data breaches worldwide, which together exposed a mind-boggling 3.4 billion records containing sensitive data.

Two breaches alone accounted for over 2.5 billion of those breached records. One involved River City Media and exposed 1.34 billion email addresses while the other at Chinese Internet Service Provider NetEase Inc. exposed nearly 1.3 billion email addresses and passwords that were later sold on the Dark Web.

On the vulnerability front, Risk Based Security's VulnDB database published a total of 4,837 vulnerabilities in the first quarter of 2017. That number was 29.2% higher than the number of discovered vulnerabilities in the same quarter in 2016 and some 2,274 more than the vulnerabilities in the widely used National Vulnerability Database (NVD).

More than 35% of the flaws already had publicly available exploits or there was enough information about them to make the flaws trivially exploitable, according to Risk Based Security. Over 50% of the disclosed software flaws were remotely exploitable while 18% had a severity rating of 9 or above on an ascending scale of 1 to 10.

The numbers are sobering and suggest that 2017 is well on its way to becoming the worst year on record for data breaches and software vulnerabilities. For all of 2016 for instance, data breaches exposed 4.2 billion records compared to the 3.4 billion in this year's first quarter alone.

The number of extremely large datasets that have been exposed so far this year or offered for sale in particular is surprising, says Inga Goddijn, executive vice president at Risk Based Security.

"After last year's disclosure at Yahoo, we thought it would be a long time before we saw another breach exposing over 1 billion records," she says. Surprisingly, there were two events in Q1 that exposed over one billion records.

The same widespread phishing and business email compromise activity that drove breach numbers in 2016 is fuelling the trend this year as well, according to Risk Based Security. Many of the phishing campaigns have targeted data in W-2 forms for the purposes of carrying on tax fraud.

But as massive as the data breach numbers are, the overall severity of data breaches has not gotten significantly worse.

"While there were a number of surprisingly large breaches, the overall severity of breach events remains steady," Goddijn says. Risk Based Security assigns severity scores based on the number of records that were exposed in a breach, the type of data that was involved, the breached industry, and other factors.

"Approximately 45% of reported breaches impacted somewhere between one and 10,000 records and the majority of breaches score below a 6 on our severity scale of 0.01 to 10," in terms of type of data exposure and impact. "It is encouraging to see severity scores staying relatively steady, indicating overall breach severity is not increasing," Goodign says.

Significantly, nearly 18% of the reported data breaches in the first quarter of 2017 had unknown origins. An unknown breach, says Goodijn, is one where the organization responsible for a data leak cannot be identified at the time of the compromise. "This tends to happen when data is leaked and the persons doing the leaking does not identify the data source or when there is a business relationship between the party responsible for the compromise and the party disclosing the breach," she says.

Jake Kouns, the chief information security office and chief operating officer at Risk Based Security, says a lot of the vulnerabilities discovered in products stem from a lack of mature software development practices at many organizations.

"Of all the vulnerabilities disclosed in Q1 2017, 68.1% are due to insufficient or improper input validation," Kouns says. "While a lot of vulnerabilities fall under this umbrella, including cross-site scripting, SQL injection, shell command injection, and buffer overflows, it underlines that vendors still struggle to carefully validate untrusted input," he says.

Web-related flaws accounted for nearly 60% of publicly disclosed vulnerabilities in Q1 2017. Of this, 30% were SQL injection errors.

Risk Based Security's vulnerability count includes flaws in the National Vulnerability Database that have an assigned CVE number attached to them as well as vulnerabilities for which no CVEs are yet available. Contrary to popular perception, the lack of a CVE number does not automatically mean a vulnerability is not serious or effects only obscure products, Risk Based Security said.

Overall, products from major vendors accounted for 31.1% of the vulnerabilities reported in Q1 2017, Kouns says.

Topping the list of companies with the most publicly reported vulnerabilities in its products was Oracle with 369 security vulnerabilities across its software portfolio. Google, which often makes a big deal about flaws in software from other vendors, came in second with 302 reported security vulnerabilities, while Microsoft took third spot with 204.

Adobe topped the list from a vulnerability severity standpoint. The 100 vulnerabilities that were discovered in its products in the first quarter had an average severity rating of 8.84 compared to 6.05 for Oracle's vulnerabilities and 6.62 for Microsoft's software flaws. Google ranked second with security vulnerabilities in its products, having an average vulnerability severity score of 7.1.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Breaches Are Inevitable, So Embrace the Chaos
Ariel Zeitlin, Chief Technology Officer & Co-Founder, Guardicore,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16761
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the [email protected] npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. All versions >1.0...
CVE-2019-16762
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any...
CVE-2019-13581
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary ...
CVE-2019-13582
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.
CVE-2019-6659
PUBLISHED: 2019-11-15
On version 14.0.0-14.1.0.1, BIG-IP virtual servers with TLSv1.3 enabled may experience a denial of service due to undisclosed incoming messages.