Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/30/2019
06:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Database Leaks, Network Traffic Top Data Exfiltration Methods

Intellectual property and personally identifiable information tie for the type of data IT practitioners are worried about losing.

Today's IT and security pros are no strangers to data theft: 61% have experienced a data breach at their current company; 48% at a previous company. On average, each has dealt with six.

Researchers surveyed 700 IT and security professionals as part of McAfee's new report "Grand Theft Data II: The Drivers and Shifting State of Data Breaches." They found data breaches are more severe and under greater scrutiny, with 73% requiring public disclosure or affecting organizations' financial results over the past three years – up five points from 2015, they report.

There are multiple factors contributing to the rise in disclosures, says Candace Worley, chief technical strategist at McAfee. One is the rise of regulation like the European Union's General Data Protection Regulation (GDPR), which imposes a fine of €20 million or 4% of worldwide annual revenue for noncompliance of its rules, which include failure to report data breaches.

"That's not something anybody takes lightly," says Worley, who also points to larger, more advanced breaches as a driver of the trend. "We see very complex, very sophisticated attacks and campaigns affecting organizations," she adds. It can take companies a longer amount of time to detect a breach; the longer an attacker is on a network, the more data they can take.

GDPR is also the reason businesses are more concerned about theft of intellectual property (IP), which for the first time tied with personally identifiable information (PII) as the data categories with the highest potential impact, as indicated by 43% of respondents. IP theft is of even greater concern among Asia-Pacific countries, where 51% deemed it highest potential impact.

"It's obviously a very competitive global market," says Worley. "There are various players out there in the space that target IP. I think that's an increasing concern for companies."

PII is historically a major target for cybercriminals because it's easily monetized on the Dark Web, she continues. But there's "a mix of different players" who may go after IP, including nation-state attackers who are less interested in money and more curious about the data itself.

Exfiltration Tactics

The most common means for stealing data depend on who is taking it and where they're taking it from. Database leaks (38%), network traffic (37%), file shares (36%), and corporate email (36%) are most popular overall. Corporate email is top in North America; USB drives are the number-one exfiltration vector in Europe and APAC. Email is most common with insider threats.

"Databases are typically where the crown jewels of an organization are kept," says Worley. Having strong controls around your database, especially with respect to who is accessing it, is imperative when considering the value of information stored in a corporate database.

Who is taking the data? External attackers (hackers, malware authors, organized crime, nation-states, activitists) are behind 61% of data theft instances, up from 57% in 2015. The biggest change was in malware-driven theft, which reached 29%, up from 23% three years prior.

There are also inside actors (employees, contractors, and other parties) whose access can put an organization at risk. Employee-driven breaches make up nearly 60% of internal incidents. Accidental breaches increased by four points (27% to 31%) in the past three years while intentional theft dropped six points (30% to 24%).

Researchers found IT or security departments are involved with 52% of all data leakage; business ops fell second at 29%.

Cloudy Concerns

Cloud applications and infrastructure are broadly deployed but don't appear to cause any more breaches than traditional networks and data centers. Nearly half (46%) of organizations polled use a hybrid cloud approach to data storage, and 29% are cloud-only. About two-thirds of breaches occurred on traditional networks, respondents said, and one-third were in the cloud.

While cloud "is not quite the wild wild west anymore," as Worley puts it, there are still myriad factors to consider when moving to cloud. She points to the shared responsibility model as an example. "That's an area where there's just still a lot of moving parts for organizations as they try to contemplate how their security program needs to change as they move to the cloud," she adds. Whether they're managing IaaS or SaaS, they need to determine how to configure their environments in a secure way.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This is not what I meant by "I would like to share some desk space"
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27221
PUBLISHED: 2021-01-21
In Eclipse OpenJ9 up to version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
CVE-2021-1067
PUBLISHED: 2021-01-20
NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the implementation of the RPMB command status, in which an attacker can write to the Write Protect Configuration Block, which may lead to denial of service or escalation of privileges.
CVE-2021-1068
PUBLISHED: 2021-01-20
NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVDEC component, in which an attacker can read from or write to a memory location that is outside the intended boundary of the buffer, which may lead to denial of service or escalation of privileges.
CVE-2021-1069
PUBLISHED: 2021-01-20
NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVHost function, which may lead to abnormal reboot due to a null pointer reference, causing data loss.
CVE-2020-26252
PUBLISHED: 2021-01-20
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server ...