Feeds

Despite your fancy-schmancy security tech, passwords still weakest link in IT defences

So concludes Verizon's new global data-breach probe

5 things you didn’t know about cloud backup

The use of stolen login credentials continues to be the most common way for network intruders to access sensitive information. Two out of three breaches were the result of weak or swiped passwords, making a case for strong two-factor authentication, according to Verizon’s latest annual Data Breach Investigations Report.

The telco's researchers reckon 94 per cent of all security cock-ups last year each fall into one of nine basic attack patterns: a malware infection; an insider's misuse of privilege; physical theft or loss of gear; web-app compromise; denial-of-service attacks; cyber-espionage; point-of-sale intrusions; payment-card skimmers; and miscellaneous errors such as sending an email to the wrong person.

On average, just three threat patterns cover 72 per cent of the security incidents in any one industry, although the exact mix varies from industry to industry.

For example, in the financial services sector, 75 per cent of security headaches were caused by attacks on web application, distributed denial of service (DDoS) assaults, and card skimming. Meanwhile, 54 per cent of all manufacturing sector attacks were attributed to cyber-espionage and DDoS floods. In the retail sector, the majority attacks are tied to DDoSing (33 per cent) followed by point-of-sale intrusions (31 per cent).

Who is nicking your secrets?

While attacks from beyond an organisation's network borders still outweigh insider betrayals, the latter is not the increase, especially when it comes to stolen intellectual property. The report points out that 85 per cent of insider and privilege-abuse attacks took advantage of access to corporate computer networks, and 22 per cent took advantage of physical access.

The compromise-to-discovery timeline continues to be measured in months and even years, as opposed to hours and days. Third parties – rather than the victims themselves – continue to detect the majority of breaches.

“After analysing 10 years of data, we realise most organisations cannot keep up with cybercrime – and the bad guys are winning,” said Wade Baker, principal author of the report series. “But by applying big data analytics to security risk management, we can begin to combat cybercrime more effectively and strategically.

“Organisations need to realise no one is immune from a data breach. Compounding this issue is the fact that it is taking longer to identify compromises within an organisation – often weeks or months, while penetrating an organisation can take minutes or hours."

"Attackers are getting faster and faster while the defenders are slow," according to Baker, who told El Reg that greater intelligence sharing may help. He said sysadmins should keep a closer eye on network traffic flowing out of an enterprise for signs of compromise and improved filtering should help.

"We might have to sacrifice usability for better security," he added.

Where are attacks coming from?

More than 1,300 confirmed breaches of data security were analysed for the latest report, as well as more than 63,000 reported attacks on computer systems. For the first time, the dossier includes security incidents that didn't result in network break-ins, in order to gain a better understanding of the threats IT admins face. Over the entire 10-year range of this study, the tally of data breaches now exceeds 3,800, and 49 organisations from around the world contributed data and analysis to this year’s report.

Incidents of cyber-espionage increased four-fold over the last 12 months with China and countries in eastern Europe blamed for most of the snooping.

The newest edition of Verizon's report records 511 incidents of cyber-spying compared to 120 in 2013, an increase only partly explained by bigger survey numbers. China is still the leading launchpad of cyber-espionage activity, while more than 20 per cent of attacks were traced as far as eastern Europe. Just two per cent of the breaches attributed to cyber-espioange were blamed on Western European or US actors.

Baker told El Reg that Verizon had widened its network of reporting organisations, and included vendors such as Kaspersky Labs and FireEye into the fold. This has given it a wider picture of cyber-espioange activity that was the main talking point of the 2013 edition of its report. Even so, most of the reporting agencies hail from either North America and Europe. "We're seeing more of what's going on but it's still not a complete picture," he said.

Cyber-espioange has increased to account for about 25 per cent of breaches analysed, but the desire to steal money is still strong among hackers: financially motivated attacks accounted for more than 50 per cent of security break-ins.

Verizon's latest report covered the period from November 2012 to November 2013. The decade-spanning series of dossiers is considered among the best of its type in the infosec business. The study collates data from cops and g-men (including the US Secret Service), vendors and CERTs across many countries as well as information gleaned from running Verizon's managed security services business. About 50 organisations contributed intelligence, as listed in a preview statement on the report. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.