Feeds

Despite your fancy-schmancy security tech, passwords still weakest link in IT defences

So concludes Verizon's new global data-breach probe

The Essential Guide to IT Transformation

The use of stolen login credentials continues to be the most common way for network intruders to access sensitive information. Two out of three breaches were the result of weak or swiped passwords, making a case for strong two-factor authentication, according to Verizon’s latest annual Data Breach Investigations Report.

The telco's researchers reckon 94 per cent of all security cock-ups last year each fall into one of nine basic attack patterns: a malware infection; an insider's misuse of privilege; physical theft or loss of gear; web-app compromise; denial-of-service attacks; cyber-espionage; point-of-sale intrusions; payment-card skimmers; and miscellaneous errors such as sending an email to the wrong person.

On average, just three threat patterns cover 72 per cent of the security incidents in any one industry, although the exact mix varies from industry to industry.

For example, in the financial services sector, 75 per cent of security headaches were caused by attacks on web application, distributed denial of service (DDoS) assaults, and card skimming. Meanwhile, 54 per cent of all manufacturing sector attacks were attributed to cyber-espionage and DDoS floods. In the retail sector, the majority attacks are tied to DDoSing (33 per cent) followed by point-of-sale intrusions (31 per cent).

Who is nicking your secrets?

While attacks from beyond an organisation's network borders still outweigh insider betrayals, the latter is not the increase, especially when it comes to stolen intellectual property. The report points out that 85 per cent of insider and privilege-abuse attacks took advantage of access to corporate computer networks, and 22 per cent took advantage of physical access.

The compromise-to-discovery timeline continues to be measured in months and even years, as opposed to hours and days. Third parties – rather than the victims themselves – continue to detect the majority of breaches.

“After analysing 10 years of data, we realise most organisations cannot keep up with cybercrime – and the bad guys are winning,” said Wade Baker, principal author of the report series. “But by applying big data analytics to security risk management, we can begin to combat cybercrime more effectively and strategically.

“Organisations need to realise no one is immune from a data breach. Compounding this issue is the fact that it is taking longer to identify compromises within an organisation – often weeks or months, while penetrating an organisation can take minutes or hours."

"Attackers are getting faster and faster while the defenders are slow," according to Baker, who told El Reg that greater intelligence sharing may help. He said sysadmins should keep a closer eye on network traffic flowing out of an enterprise for signs of compromise and improved filtering should help.

"We might have to sacrifice usability for better security," he added.

Where are attacks coming from?

More than 1,300 confirmed breaches of data security were analysed for the latest report, as well as more than 63,000 reported attacks on computer systems. For the first time, the dossier includes security incidents that didn't result in network break-ins, in order to gain a better understanding of the threats IT admins face. Over the entire 10-year range of this study, the tally of data breaches now exceeds 3,800, and 49 organisations from around the world contributed data and analysis to this year’s report.

Incidents of cyber-espionage increased four-fold over the last 12 months with China and countries in eastern Europe blamed for most of the snooping.

The newest edition of Verizon's report records 511 incidents of cyber-spying compared to 120 in 2013, an increase only partly explained by bigger survey numbers. China is still the leading launchpad of cyber-espionage activity, while more than 20 per cent of attacks were traced as far as eastern Europe. Just two per cent of the breaches attributed to cyber-espioange were blamed on Western European or US actors.

Baker told El Reg that Verizon had widened its network of reporting organisations, and included vendors such as Kaspersky Labs and FireEye into the fold. This has given it a wider picture of cyber-espioange activity that was the main talking point of the 2013 edition of its report. Even so, most of the reporting agencies hail from either North America and Europe. "We're seeing more of what's going on but it's still not a complete picture," he said.

Cyber-espioange has increased to account for about 25 per cent of breaches analysed, but the desire to steal money is still strong among hackers: financially motivated attacks accounted for more than 50 per cent of security break-ins.

Verizon's latest report covered the period from November 2012 to November 2013. The decade-spanning series of dossiers is considered among the best of its type in the infosec business. The study collates data from cops and g-men (including the US Secret Service), vendors and CERTs across many countries as well as information gleaned from running Verizon's managed security services business. About 50 organisations contributed intelligence, as listed in a preview statement on the report. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Fiendishly complex password app extension ships for iOS 8
Just slip it in, won't hurt a bit, 1Password makers urge devs
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.