Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/23/2017
08:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Data Breach, Vulnerability Data on Track to Set New Records in 2017

There are so far 1,254 publicly reported data breaches and 4,837 published vulnerabilities in the first quarter of this year.

Enterprise security executives looking for metrics to justify their budgets to top management should have plenty of material to choose from for the rest of year.

Two reports from Risk Based Security this week show that numbers related to data breaches and software vulnerabilities look set to break new records in 2017, if first quarter trends are any indication.

Risk Based Security's analysis of Q1 data showed there were a total of 1,254 publicly reported data breaches worldwide, which together exposed a mind-boggling 3.4 billion records containing sensitive data.

Two breaches alone accounted for over 2.5 billion of those breached records. One involved River City Media and exposed 1.34 billion email addresses while the other at Chinese Internet Service Provider NetEase Inc. exposed nearly 1.3 billion email addresses and passwords that were later sold on the Dark Web.

On the vulnerability front, Risk Based Security's VulnDB database published a total of 4,837 vulnerabilities in the first quarter of 2017. That number was 29.2% higher than the number of discovered vulnerabilities in the same quarter in 2016 and some 2,274 more than the vulnerabilities in the widely used National Vulnerability Database (NVD).

More than 35% of the flaws already had publicly available exploits or there was enough information about them to make the flaws trivially exploitable, according to Risk Based Security. Over 50% of the disclosed software flaws were remotely exploitable while 18% had a severity rating of 9 or above on an ascending scale of 1 to 10.

The numbers are sobering and suggest that 2017 is well on its way to becoming the worst year on record for data breaches and software vulnerabilities. For all of 2016 for instance, data breaches exposed 4.2 billion records compared to the 3.4 billion in this year's first quarter alone.

The number of extremely large datasets that have been exposed so far this year or offered for sale in particular is surprising, says Inga Goddijn, executive vice president at Risk Based Security.

"After last year's disclosure at Yahoo, we thought it would be a long time before we saw another breach exposing over 1 billion records," she says. Surprisingly, there were two events in Q1 that exposed over one billion records.

The same widespread phishing and business email compromise activity that drove breach numbers in 2016 is fuelling the trend this year as well, according to Risk Based Security. Many of the phishing campaigns have targeted data in W-2 forms for the purposes of carrying on tax fraud.

But as massive as the data breach numbers are, the overall severity of data breaches has not gotten significantly worse.

"While there were a number of surprisingly large breaches, the overall severity of breach events remains steady," Goddijn says. Risk Based Security assigns severity scores based on the number of records that were exposed in a breach, the type of data that was involved, the breached industry, and other factors.

"Approximately 45% of reported breaches impacted somewhere between one and 10,000 records and the majority of breaches score below a 6 on our severity scale of 0.01 to 10," in terms of type of data exposure and impact. "It is encouraging to see severity scores staying relatively steady, indicating overall breach severity is not increasing," Goodign says.

Significantly, nearly 18% of the reported data breaches in the first quarter of 2017 had unknown origins. An unknown breach, says Goodijn, is one where the organization responsible for a data leak cannot be identified at the time of the compromise. "This tends to happen when data is leaked and the persons doing the leaking does not identify the data source or when there is a business relationship between the party responsible for the compromise and the party disclosing the breach," she says.

Jake Kouns, the chief information security office and chief operating officer at Risk Based Security, says a lot of the vulnerabilities discovered in products stem from a lack of mature software development practices at many organizations.

"Of all the vulnerabilities disclosed in Q1 2017, 68.1% are due to insufficient or improper input validation," Kouns says. "While a lot of vulnerabilities fall under this umbrella, including cross-site scripting, SQL injection, shell command injection, and buffer overflows, it underlines that vendors still struggle to carefully validate untrusted input," he says.

Web-related flaws accounted for nearly 60% of publicly disclosed vulnerabilities in Q1 2017. Of this, 30% were SQL injection errors.

Risk Based Security's vulnerability count includes flaws in the National Vulnerability Database that have an assigned CVE number attached to them as well as vulnerabilities for which no CVEs are yet available. Contrary to popular perception, the lack of a CVE number does not automatically mean a vulnerability is not serious or effects only obscure products, Risk Based Security said.

Overall, products from major vendors accounted for 31.1% of the vulnerabilities reported in Q1 2017, Kouns says.

Topping the list of companies with the most publicly reported vulnerabilities in its products was Oracle with 369 security vulnerabilities across its software portfolio. Google, which often makes a big deal about flaws in software from other vendors, came in second with 302 reported security vulnerabilities, while Microsoft took third spot with 204.

Adobe topped the list from a vulnerability severity standpoint. The 100 vulnerabilities that were discovered in its products in the first quarter had an average severity rating of 8.84 compared to 6.05 for Oracle's vulnerabilities and 6.62 for Microsoft's software flaws. Google ranked second with security vulnerabilities in its products, having an average vulnerability severity score of 7.1.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13864
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
CVE-2020-13865
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.
CVE-2020-11696
PUBLISHED: 2020-06-05
In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.
CVE-2020-11697
PUBLISHED: 2020-06-05
In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.
CVE-2020-13646
PUBLISHED: 2020-06-05
In the cheetah free wifi 5.1 driver file liebaonat.sys, local users are allowed to cause a denial of service (BSOD) or other unknown impact due to failure to verify the value of a specific IOCTL.