Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

09:15 AM
Connect Directly

Verizon Data Breach Digest Triangulates Humanity Inside Security

The 99-page report breaks out 16 different attack scenarios and specifies the target, sophistication level, attributes, and attack patterns, along with their times to discovery and containment.

If the whole security management services thing doesn't work out, Verizon may want to consider getting into the techno-thriller mystery writing business. Its newly released Data Breach Digest is chockablock with stories of online shenanigans (with some identifying details altered) that would be right at home in an episode of Mr. Robot.

In one example, an online gaming company finds its production network hacked; worse, points of top players were being siphoned off and customers' personal information might have been compromised as well. Network and application logs were quickly parsed and Verizon's RISK team identified 15 systems that process game-point transactions, yet only 14 of them were known to be legitimate resources.

Sure enough, the anomalous system, while valid, had been abandoned for more than a year after an employee left the company. But it remained attached to the network, if dormant, and was an inviting target for hackers who brute-forced it, then loaded it with malware to do their dirty work.

Situations like these, where hidden endpoints that could be anything from systems, user accounts, software, or data, are what Verizon labels “Unknown Unknowns,” and are the hardest for organizations to plan for and react to, Verizon says in its latest DBD report. "We're seeing lots of cases of Unknown Unknowns … detection systems are picking up old and new malware that may be sitting there," says John Grim, senior manager and lead for Verizon's investigative response team. "We then come in and see if it's done any damage or if it's just laying in wait. Sometimes they emerge when we do testing."

The DBD has two objectives: Sketch out the complexity of the most common kinds of attacks, and provide a guidebook for all the individuals affected in the chain of command.

The 99-page report breaks out 16 different attack scenarios and specifies the target, sophistication level, attributes, and the attack's pattern, along with its times to discovery and containment. Each scenario identifies a threat actor along with their motives, tactics, and techniques; the targeted victim also gets profiled in terms of industry sector(s), key stakeholders, and the necessary countermeasures.

In another DBD scenario dubbed "Mobile Assault – The Secret Squirrel," Verizon outlines the problems faced by a business traveler who may be forced to use sketchy Wi-Fi networks, hand over their laptop or smartphone at security checkpoints or immigration areas, or are required to decrypt their devices completely. There's also the potential for loss, theft, or device tampering in a hotel room; in some instances, specific companies and individual personnel are targeted for the high-value data they carry or are able to access.

The fix for Mobile Assault is ridiculously simple. Employees no longer travel with their assigned corporate devices, but instead are given “travel” smartphones and laptops, and after every trip, these devices are wiped clean and rebuilt. "From a forensic examination standpoint, having this known baseline image to compare against drastically reduces analysis time and helps [the organization] focus on potential problems rather than background noise," Verizon says in the new DBD report.

This year's report also deconstructs the complexity of breaches from a human standpoint and a stakeholder perspective, Grim tells Dark Reading.

And it's no longer enough to tell companies and end-user organizations, "This is the malware, and this is how you fix it," Grim adds. "HR and legal need to be involved too if it's an inside threat or involves employee records." Grim is quick to emphasize that the DBD report isn't just for IT staff or infosec professionals. Human resources professionals can query the report for HR issues, or HR in a specific industry sector. Incident responders can also query by industry, Grim says.

The DBD uses data derived from the Verizon's more comprehensive Data Breach Investigation Report. This is the second year Verizon has released the digest.

Verizon also offers a five-point incident response plan for organizations that have discovered any kind of data breach:

  • Preserve evidence; consider consequences of every action taken once the breach has been discovered.
  • Be flexible; adapt to evolving situations.
  • Establish consistent methods for communication.
  • Know the limits of your own expertise; collaborate with other key stakeholders.
  • Document actions and findings; be prepared to explain them.

Related Content:




Terry Sweeney is a Los Angeles-based writer and editor who has covered technology, networking, and security for more than 20 years. He was part of the team that started Dark Reading and has been a contributor to The Washington Post, Crain's New York Business, Red Herring, ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
2/17/2017 | 9:39:33 PM
Absolutely agree with your thoughts. Nice post btw.
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
2/17/2017 | 6:46:42 PM
Re: "Ridiculously simple"
> we as business people, consumers, IT and cyber security professionals have to get better at picking our battles.

This goes to my consulting philosophy as well.  Increasingly, data security, data privacy, and data compliance are three very different Venn diagram circles with but modest overlaps.  More problematically, however, these three interests sometimes downright conflict with each other!

Ultimately, it's about data stewardship as a whole.  Or, in other words, basic risk management.
T Sweeney
T Sweeney,
User Rank: Moderator
2/13/2017 | 4:12:16 PM
Re: "Ridiculously simple"
Thanks for your comment, HardenStance. There really is very little in information security that is easy or simple, and my "ridiculously simple" characterization was a bit glib. You made several good points, from the threat of the IoT to the need to pick our security battles/priorities carefully. I view the Mobile Assault strategy as a smart way to reduce headaches cut down on headaches for everyone.
User Rank: Strategist
2/13/2017 | 12:51:07 PM
"Ridiculously simple"

Nice write-up, Terry.

Your term "ridiculously simple" about the Mobile Assault Fix is a more important one than some of us would want to acknowledge, I think.

I agree that for a lot of business travel, temporary suspension of access to some data or some apps while traveling need only be a small price to pay relative to the threat of a serious breach. In the consumer space, the potential risk posed by insecure Internet-enabled toasters and Internet-enabled toothbrushes outweighs the value these things can possibly generate by so many times, it's not even funny. 

Engineers and computer scientists tend to have a "yes we can" mentality to using technology to solve human problems. Without it, horses would still be our main mode of travel and the abacus would still be our main tool for supporting mathematical calculations.

But as we zero-in on making security much more of a priority in light of what adversaries are capable of now, we as business people, consumers, IT and cyber security professionals have to get better at picking our battles.

There will always be lots of use cases in cyber security where we have no choice but to engage in pitched battles against our opponents, facing off with the very latest in cutting edge technology. No quarter asked - and none given. Sometimes with no spending limit either.

But there are also some cyber security battles that are just not worth fighting - engaging in them  actually plays right into the hands of adversaries.

We've got to be better served by more of us being willing to  embrace the full end to end gamut of high tech and low tech cyber security options that are available to us, if only we'd pause to seriously consider them all.

That has to be better than automatically rising to the challenge - or the bait - each and every time.


Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-12-02
An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read which can subsequently trigger an out-of-bounds write resulting in remote code execution. An attacker can create/send m...
PUBLISHED: 2020-12-02
An exploitable Out-of-bounds Write vulnerability exists in the xls_addCell function of libxls 2.0. A specially crafted xls file can cause a memory corruption resulting in remote code execution. An attacker can send malicious xls file to trigger this vulnerability.
PUBLISHED: 2020-12-02
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. A specially crafted USDC file format path jumps decompression heap overflow in a way path jumps are processed. To trigger this vulnerability, the victim needs to open an atta...
PUBLISHED: 2020-12-02
A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files. A specially crafted malformed file can trigger a heap overflow which can result in out of bounds memory access which could lead to information disclosure. This vulnerability could...
PUBLISHED: 2020-12-02
An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file can trigger an arbitrary out of bounds memory access in TfToken Type Index. This vulnerability could be used to bypass mitigations and aid further exploitation....