The use of stolen login credentials continues to be the most common way for network intruders to access sensitive information. Two out of three breaches were the result of weak or swiped passwords, making a case for strong two-factor authentication, according to Verizon’s latest annual Data Breach Investigations Report.
The telco's researchers reckon 94 per cent of all security cock-ups last year each fall into one of nine basic attack patterns: a malware infection; an insider's misuse of privilege; physical theft or loss of gear; web-app compromise; denial-of-service attacks; cyber-espionage; point-of-sale intrusions; payment-card skimmers; and miscellaneous errors such as sending an email to the wrong person.
On average, just three threat patterns cover 72 per cent of the security incidents in any one industry, although the exact mix varies from industry to industry.
For example, in the financial services sector, 75 per cent of security headaches were caused by attacks on web application, distributed denial of service (DDoS) assaults, and card skimming. Meanwhile, 54 per cent of all manufacturing sector attacks were attributed to cyber-espionage and DDoS floods. In the retail sector, the majority attacks are tied to DDoSing (33 per cent) followed by point-of-sale intrusions (31 per cent).
Who is nicking your secrets?
While attacks from beyond an organisation's network borders still outweigh insider betrayals, the latter is not the increase, especially when it comes to stolen intellectual property. The report points out that 85 per cent of insider and privilege-abuse attacks took advantage of access to corporate computer networks, and 22 per cent took advantage of physical access.
The compromise-to-discovery timeline continues to be measured in months and even years, as opposed to hours and days. Third parties – rather than the victims themselves – continue to detect the majority of breaches.
“After analysing 10 years of data, we realise most organisations cannot keep up with cybercrime – and the bad guys are winning,” said Wade Baker, principal author of the report series. “But by applying big data analytics to security risk management, we can begin to combat cybercrime more effectively and strategically.
“Organisations need to realise no one is immune from a data breach. Compounding this issue is the fact that it is taking longer to identify compromises within an organisation – often weeks or months, while penetrating an organisation can take minutes or hours."
"Attackers are getting faster and faster while the defenders are slow," according to Baker, who told El Reg that greater intelligence sharing may help. He said sysadmins should keep a closer eye on network traffic flowing out of an enterprise for signs of compromise and improved filtering should help.
"We might have to sacrifice usability for better security," he added.
Where are attacks coming from?
More than 1,300 confirmed breaches of data security were analysed for the latest report, as well as more than 63,000 reported attacks on computer systems. For the first time, the dossier includes security incidents that didn't result in network break-ins, in order to gain a better understanding of the threats IT admins face. Over the entire 10-year range of this study, the tally of data breaches now exceeds 3,800, and 49 organisations from around the world contributed data and analysis to this year’s report.
Incidents of cyber-espionage increased four-fold over the last 12 months with China and countries in eastern Europe blamed for most of the snooping.
The newest edition of Verizon's report records 511 incidents of cyber-spying compared to 120 in 2013, an increase only partly explained by bigger survey numbers. China is still the leading launchpad of cyber-espionage activity, while more than 20 per cent of attacks were traced as far as eastern Europe. Just two per cent of the breaches attributed to cyber-espioange were blamed on Western European or US actors.
Baker told El Reg that Verizon had widened its network of reporting organisations, and included vendors such as Kaspersky Labs and FireEye into the fold. This has given it a wider picture of cyber-espioange activity that was the main talking point of the 2013 edition of its report. Even so, most of the reporting agencies hail from either North America and Europe. "We're seeing more of what's going on but it's still not a complete picture," he said.
Cyber-espioange has increased to account for about 25 per cent of breaches analysed, but the desire to steal money is still strong among hackers: financially motivated attacks accounted for more than 50 per cent of security break-ins.
Verizon's latest report covered the period from November 2012 to November 2013. The decade-spanning series of dossiers is considered among the best of its type in the infosec business. The study collates data from cops and g-men (including the US Secret Service), vendors and CERTs across many countries as well as information gleaned from running Verizon's managed security services business. About 50 organisations contributed intelligence, as listed in a preview statement on the report. ®