Verizon Data Breach Digest Triangulates Humanity Inside Security
The 99-page report breaks out 16 different attack scenarios and specifies the target, sophistication level, attributes, and attack patterns, along with their times to discovery and containment.
If the whole security management services thing doesnt work out, Verizon may want to consider getting into the techno-thriller mystery writing business. Its newly released
Data Breach Digest
is chockablock with stories of online shenanigans (with some identifying details altered) that would be right at home in an episode of
Mr. Robot
.
In one example, an online gaming company finds its production network hacked; worse, points of top players were being siphoned off and customers personal information might have been compromised as well. Network and application logs were quickly parsed and Verizons RISK team identified 15 systems that process game-point transactions, yet only 14 of them were known to be legitimate resources.
Sure enough, the anomalous system, while valid, had been abandoned for more than a year after an employee left the company. But it remained attached to the network, if dormant, and was an inviting target for hackers who brute-forced it, then loaded it with malware to do their dirty work.
Situations like these, where hidden endpoints that could be anything from systems, user accounts, software, or data, are what Verizon labels “Unknown Unknowns,” and are the hardest for organizations to plan for and react to, Verizon says in its latest DBD report. Were seeing lots of cases of Unknown Unknowns … detection systems are picking up old and new malware that may be sitting there, says John Grim, senior manager and lead for Verizons investigative response team. We then come in and see if its done any damage or if its just laying in wait. Sometimes they emerge when we do testing.
The DBD has two objectives: Sketch out the complexity of the most common kinds of attacks, and provide a guidebook for all the individuals affected in the chain of command.
The 99-page report breaks out 16 different attack scenarios and specifies the target, sophistication level, attributes, and the attacks pattern, along with its times to discovery and containment. Each scenario identifies a threat actor along with their motives, tactics, and techniques; the targeted victim also gets profiled in terms of industry sector(s), key stakeholders, and the necessary countermeasures.
In another DBD scenario dubbed Mobile Assault – The Secret Squirrel, Verizon outlines the problems faced by a business traveler who may be forced to use sketchy Wi-Fi networks, hand over their laptop or smartphone at security checkpoints or immigration areas, or are required to decrypt their devices completely. Theres also the potential for loss, theft, or device tampering in a hotel room; in some instances, specific companies and individual personnel are targeted for the high-value data they carry or are able to access.
The fix for Mobile Assault is ridiculously simple. Employees no longer travel with their assigned corporate devices, but instead are given “travel” smartphones and laptops, and after every trip, these devices are wiped clean and rebuilt. From a forensic examination standpoint, having this known baseline image to compare against drastically reduces analysis time and helps [the organization] focus on potential problems rather than background noise, Verizon says in the new DBD report.
This years report also deconstructs the complexity of breaches from a human standpoint and a stakeholder perspective, Grim tells Dark Reading.
And its no longer enough to tell companies and end-user organizations, This is the malware, and this is how you fix it, Grim adds. HR and legal need to be involved too if its an inside threat or involves employee records. Grim is quick to emphasize that the DBD report isnt just for IT staff or infosec professionals. Human resources professionals can query the report for HR issues, or HR in a specific industry sector. Incident responders can also query by industry, Grim says.
The DBD uses data derived from the Verizons more comprehensive
Data Breach Investigation Report
. This is the
second year
Verizon has released the digest.
Verizon also offers a five-point incident response plan for organizations that have discovered any kind of data breach:
Preserve evidence; consider consequences of every action taken once the breach has been discovered.
Be flexible; adapt to evolving situations.
Establish consistent methods for communication.
Know the limits of your own expertise; collaborate with other key stakeholders.
Document actions and findings; be prepared to explain them.
Related Content:
Pirates, Ships, And A Hacked CMS: Inside Verizons Breach Investigations
Verizon DBIR: Over Half Of Data Breaches Exploited Legitimate Passwords In 2015
Advanced Threat Hunting: Are You The Hunter Or The Hunted?
Save
Save
Save
Tags:
Verizon Data Breach Digest Triangulates Humanity Inside Security