Feeds

Despite your fancy-schmancy security tech, passwords still weakest link in IT defences

So concludes Verizon's new global data-breach probe

Protecting against web application threats using SSL

The use of stolen login credentials continues to be the most common way for network intruders to access sensitive information. Two out of three breaches were the result of weak or swiped passwords, making a case for strong two-factor authentication, according to Verizon’s latest annual Data Breach Investigations Report.

The telco's researchers reckon 94 per cent of all security cock-ups last year each fall into one of nine basic attack patterns: a malware infection; an insider's misuse of privilege; physical theft or loss of gear; web-app compromise; denial-of-service attacks; cyber-espionage; point-of-sale intrusions; payment-card skimmers; and miscellaneous errors such as sending an email to the wrong person.

On average, just three threat patterns cover 72 per cent of the security incidents in any one industry, although the exact mix varies from industry to industry.

For example, in the financial services sector, 75 per cent of security headaches were caused by attacks on web application, distributed denial of service (DDoS) assaults, and card skimming. Meanwhile, 54 per cent of all manufacturing sector attacks were attributed to cyber-espionage and DDoS floods. In the retail sector, the majority attacks are tied to DDoSing (33 per cent) followed by point-of-sale intrusions (31 per cent).

Who is nicking your secrets?

While attacks from beyond an organisation's network borders still outweigh insider betrayals, the latter is not the increase, especially when it comes to stolen intellectual property. The report points out that 85 per cent of insider and privilege-abuse attacks took advantage of access to corporate computer networks, and 22 per cent took advantage of physical access.

The compromise-to-discovery timeline continues to be measured in months and even years, as opposed to hours and days. Third parties – rather than the victims themselves – continue to detect the majority of breaches.

“After analysing 10 years of data, we realise most organisations cannot keep up with cybercrime – and the bad guys are winning,” said Wade Baker, principal author of the report series. “But by applying big data analytics to security risk management, we can begin to combat cybercrime more effectively and strategically.

“Organisations need to realise no one is immune from a data breach. Compounding this issue is the fact that it is taking longer to identify compromises within an organisation – often weeks or months, while penetrating an organisation can take minutes or hours."

"Attackers are getting faster and faster while the defenders are slow," according to Baker, who told El Reg that greater intelligence sharing may help. He said sysadmins should keep a closer eye on network traffic flowing out of an enterprise for signs of compromise and improved filtering should help.

"We might have to sacrifice usability for better security," he added.

Where are attacks coming from?

More than 1,300 confirmed breaches of data security were analysed for the latest report, as well as more than 63,000 reported attacks on computer systems. For the first time, the dossier includes security incidents that didn't result in network break-ins, in order to gain a better understanding of the threats IT admins face. Over the entire 10-year range of this study, the tally of data breaches now exceeds 3,800, and 49 organisations from around the world contributed data and analysis to this year’s report.

Incidents of cyber-espionage increased four-fold over the last 12 months with China and countries in eastern Europe blamed for most of the snooping.

The newest edition of Verizon's report records 511 incidents of cyber-spying compared to 120 in 2013, an increase only partly explained by bigger survey numbers. China is still the leading launchpad of cyber-espionage activity, while more than 20 per cent of attacks were traced as far as eastern Europe. Just two per cent of the breaches attributed to cyber-espioange were blamed on Western European or US actors.

Baker told El Reg that Verizon had widened its network of reporting organisations, and included vendors such as Kaspersky Labs and FireEye into the fold. This has given it a wider picture of cyber-espioange activity that was the main talking point of the 2013 edition of its report. Even so, most of the reporting agencies hail from either North America and Europe. "We're seeing more of what's going on but it's still not a complete picture," he said.

Cyber-espioange has increased to account for about 25 per cent of breaches analysed, but the desire to steal money is still strong among hackers: financially motivated attacks accounted for more than 50 per cent of security break-ins.

Verizon's latest report covered the period from November 2012 to November 2013. The decade-spanning series of dossiers is considered among the best of its type in the infosec business. The study collates data from cops and g-men (including the US Secret Service), vendors and CERTs across many countries as well as information gleaned from running Verizon's managed security services business. About 50 organisations contributed intelligence, as listed in a preview statement on the report. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.