Feeds

Despite your fancy-schmancy security tech, passwords still weakest link in IT defences

So concludes Verizon's new global data-breach probe

The Essential Guide to IT Transformation

The use of stolen login credentials continues to be the most common way for network intruders to access sensitive information. Two out of three breaches were the result of weak or swiped passwords, making a case for strong two-factor authentication, according to Verizon’s latest annual Data Breach Investigations Report.

The telco's researchers reckon 94 per cent of all security cock-ups last year each fall into one of nine basic attack patterns: a malware infection; an insider's misuse of privilege; physical theft or loss of gear; web-app compromise; denial-of-service attacks; cyber-espionage; point-of-sale intrusions; payment-card skimmers; and miscellaneous errors such as sending an email to the wrong person.

On average, just three threat patterns cover 72 per cent of the security incidents in any one industry, although the exact mix varies from industry to industry.

For example, in the financial services sector, 75 per cent of security headaches were caused by attacks on web application, distributed denial of service (DDoS) assaults, and card skimming. Meanwhile, 54 per cent of all manufacturing sector attacks were attributed to cyber-espionage and DDoS floods. In the retail sector, the majority attacks are tied to DDoSing (33 per cent) followed by point-of-sale intrusions (31 per cent).

Who is nicking your secrets?

While attacks from beyond an organisation's network borders still outweigh insider betrayals, the latter is not the increase, especially when it comes to stolen intellectual property. The report points out that 85 per cent of insider and privilege-abuse attacks took advantage of access to corporate computer networks, and 22 per cent took advantage of physical access.

The compromise-to-discovery timeline continues to be measured in months and even years, as opposed to hours and days. Third parties – rather than the victims themselves – continue to detect the majority of breaches.

“After analysing 10 years of data, we realise most organisations cannot keep up with cybercrime – and the bad guys are winning,” said Wade Baker, principal author of the report series. “But by applying big data analytics to security risk management, we can begin to combat cybercrime more effectively and strategically.

“Organisations need to realise no one is immune from a data breach. Compounding this issue is the fact that it is taking longer to identify compromises within an organisation – often weeks or months, while penetrating an organisation can take minutes or hours."

"Attackers are getting faster and faster while the defenders are slow," according to Baker, who told El Reg that greater intelligence sharing may help. He said sysadmins should keep a closer eye on network traffic flowing out of an enterprise for signs of compromise and improved filtering should help.

"We might have to sacrifice usability for better security," he added.

Where are attacks coming from?

More than 1,300 confirmed breaches of data security were analysed for the latest report, as well as more than 63,000 reported attacks on computer systems. For the first time, the dossier includes security incidents that didn't result in network break-ins, in order to gain a better understanding of the threats IT admins face. Over the entire 10-year range of this study, the tally of data breaches now exceeds 3,800, and 49 organisations from around the world contributed data and analysis to this year’s report.

Incidents of cyber-espionage increased four-fold over the last 12 months with China and countries in eastern Europe blamed for most of the snooping.

The newest edition of Verizon's report records 511 incidents of cyber-spying compared to 120 in 2013, an increase only partly explained by bigger survey numbers. China is still the leading launchpad of cyber-espionage activity, while more than 20 per cent of attacks were traced as far as eastern Europe. Just two per cent of the breaches attributed to cyber-espioange were blamed on Western European or US actors.

Baker told El Reg that Verizon had widened its network of reporting organisations, and included vendors such as Kaspersky Labs and FireEye into the fold. This has given it a wider picture of cyber-espioange activity that was the main talking point of the 2013 edition of its report. Even so, most of the reporting agencies hail from either North America and Europe. "We're seeing more of what's going on but it's still not a complete picture," he said.

Cyber-espioange has increased to account for about 25 per cent of breaches analysed, but the desire to steal money is still strong among hackers: financially motivated attacks accounted for more than 50 per cent of security break-ins.

Verizon's latest report covered the period from November 2012 to November 2013. The decade-spanning series of dossiers is considered among the best of its type in the infosec business. The study collates data from cops and g-men (including the US Secret Service), vendors and CERTs across many countries as well as information gleaned from running Verizon's managed security services business. About 50 organisations contributed intelligence, as listed in a preview statement on the report. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.