Users aren't totally without blame, though. The Verizon report says seven infections came from Websites -- three directly downloaded and installed by the users. The other four cases involved a vulnerability that had a patch available for more than a year.
So looking at those numbers, who is the culprit? Who gets fingered? Who must shoulder the blame? Malware certainly played a critical role in the breaches, but don't discount the human element, with an attacker installing the malware once a system was compromised. Or perhaps a user browsed to a malicious Website and clicked "Yes" on a deceptive Web pop-up.
Without knowing the details behind the numbers, it's still safe to point out that a person was involved in every breach, either as the perpetrator or, in a handful of cases, the victim.
Be prepared: You'll probably hear a lot of salespeople spouting off numbers from the Verizon report as the reason why you need their producst. Instead of sitting there nodding, take the time to read the report so you can understand the context of the numbers and respond appropriately.
John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.