Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

09:15 AM
Connect Directly

Verizon Data Breach Digest Triangulates Humanity Inside Security

The 99-page report breaks out 16 different attack scenarios and specifies the target, sophistication level, attributes, and attack patterns, along with their times to discovery and containment.

If the whole security management services thing doesn't work out, Verizon may want to consider getting into the techno-thriller mystery writing business. Its newly released Data Breach Digest is chockablock with stories of online shenanigans (with some identifying details altered) that would be right at home in an episode of Mr. Robot.

In one example, an online gaming company finds its production network hacked; worse, points of top players were being siphoned off and customers' personal information might have been compromised as well. Network and application logs were quickly parsed and Verizon's RISK team identified 15 systems that process game-point transactions, yet only 14 of them were known to be legitimate resources.

Sure enough, the anomalous system, while valid, had been abandoned for more than a year after an employee left the company. But it remained attached to the network, if dormant, and was an inviting target for hackers who brute-forced it, then loaded it with malware to do their dirty work.

Situations like these, where hidden endpoints that could be anything from systems, user accounts, software, or data, are what Verizon labels “Unknown Unknowns,” and are the hardest for organizations to plan for and react to, Verizon says in its latest DBD report. "We're seeing lots of cases of Unknown Unknowns … detection systems are picking up old and new malware that may be sitting there," says John Grim, senior manager and lead for Verizon's investigative response team. "We then come in and see if it's done any damage or if it's just laying in wait. Sometimes they emerge when we do testing."

The DBD has two objectives: Sketch out the complexity of the most common kinds of attacks, and provide a guidebook for all the individuals affected in the chain of command.

The 99-page report breaks out 16 different attack scenarios and specifies the target, sophistication level, attributes, and the attack's pattern, along with its times to discovery and containment. Each scenario identifies a threat actor along with their motives, tactics, and techniques; the targeted victim also gets profiled in terms of industry sector(s), key stakeholders, and the necessary countermeasures.

In another DBD scenario dubbed "Mobile Assault – The Secret Squirrel," Verizon outlines the problems faced by a business traveler who may be forced to use sketchy Wi-Fi networks, hand over their laptop or smartphone at security checkpoints or immigration areas, or are required to decrypt their devices completely. There's also the potential for loss, theft, or device tampering in a hotel room; in some instances, specific companies and individual personnel are targeted for the high-value data they carry or are able to access.

The fix for Mobile Assault is ridiculously simple. Employees no longer travel with their assigned corporate devices, but instead are given “travel” smartphones and laptops, and after every trip, these devices are wiped clean and rebuilt. "From a forensic examination standpoint, having this known baseline image to compare against drastically reduces analysis time and helps [the organization] focus on potential problems rather than background noise," Verizon says in the new DBD report.

This year's report also deconstructs the complexity of breaches from a human standpoint and a stakeholder perspective, Grim tells Dark Reading.

And it's no longer enough to tell companies and end-user organizations, "This is the malware, and this is how you fix it," Grim adds. "HR and legal need to be involved too if it's an inside threat or involves employee records." Grim is quick to emphasize that the DBD report isn't just for IT staff or infosec professionals. Human resources professionals can query the report for HR issues, or HR in a specific industry sector. Incident responders can also query by industry, Grim says.

The DBD uses data derived from the Verizon's more comprehensive Data Breach Investigation Report. This is the second year Verizon has released the digest.

Verizon also offers a five-point incident response plan for organizations that have discovered any kind of data breach:

  • Preserve evidence; consider consequences of every action taken once the breach has been discovered.
  • Be flexible; adapt to evolving situations.
  • Establish consistent methods for communication.
  • Know the limits of your own expertise; collaborate with other key stakeholders.
  • Document actions and findings; be prepared to explain them.

Related Content:




Terry Sweeney is a Los Angeles-based writer and editor who has covered technology, networking, and security for more than 20 years. He was part of the team that started Dark Reading and has been a contributor to The Washington Post, Crain's New York Business, Red Herring, ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
User Rank: Strategist
2/13/2017 | 12:51:07 PM
"Ridiculously simple"

Nice write-up, Terry.

Your term "ridiculously simple" about the Mobile Assault Fix is a more important one than some of us would want to acknowledge, I think.

I agree that for a lot of business travel, temporary suspension of access to some data or some apps while traveling need only be a small price to pay relative to the threat of a serious breach. In the consumer space, the potential risk posed by insecure Internet-enabled toasters and Internet-enabled toothbrushes outweighs the value these things can possibly generate by so many times, it's not even funny. 

Engineers and computer scientists tend to have a "yes we can" mentality to using technology to solve human problems. Without it, horses would still be our main mode of travel and the abacus would still be our main tool for supporting mathematical calculations.

But as we zero-in on making security much more of a priority in light of what adversaries are capable of now, we as business people, consumers, IT and cyber security professionals have to get better at picking our battles.

There will always be lots of use cases in cyber security where we have no choice but to engage in pitched battles against our opponents, facing off with the very latest in cutting edge technology. No quarter asked - and none given. Sometimes with no spending limit either.

But there are also some cyber security battles that are just not worth fighting - engaging in them  actually plays right into the hands of adversaries.

We've got to be better served by more of us being willing to  embrace the full end to end gamut of high tech and low tech cyber security options that are available to us, if only we'd pause to seriously consider them all.

That has to be better than automatically rising to the challenge - or the bait - each and every time.


T Sweeney
T Sweeney,
User Rank: Moderator
2/13/2017 | 4:12:16 PM
Re: "Ridiculously simple"
Thanks for your comment, HardenStance. There really is very little in information security that is easy or simple, and my "ridiculously simple" characterization was a bit glib. You made several good points, from the threat of the IoT to the need to pick our security battles/priorities carefully. I view the Mobile Assault strategy as a smart way to reduce headaches cut down on headaches for everyone.
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
2/17/2017 | 6:46:42 PM
Re: "Ridiculously simple"
> we as business people, consumers, IT and cyber security professionals have to get better at picking our battles.

This goes to my consulting philosophy as well.  Increasingly, data security, data privacy, and data compliance are three very different Venn diagram circles with but modest overlaps.  More problematically, however, these three interests sometimes downright conflict with each other!

Ultimately, it's about data stewardship as a whole.  Or, in other words, basic risk management.
User Rank: Apprentice
2/17/2017 | 9:39:33 PM
Absolutely agree with your thoughts. Nice post btw.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
WannaCry Has IoT in Its Crosshairs
Ed Koehler, Distinguished Principal Security Engineer, Office of CTO, at Extreme Network,  9/25/2020
Safeguarding Schools Against RDP-Based Ransomware
James Lui, Ericom Group CTO, Americas,  9/28/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-09-27
XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even witho...
PUBLISHED: 2020-09-27
An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against "page creation" and the attacker should not be able to create it. This occurs because of a mishandled distinction between an uploa...
PUBLISHED: 2020-09-27
An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.
PUBLISHED: 2020-09-27
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users.
PUBLISHED: 2020-09-27
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> ...