Verizon Shares Glimpse Into Upcoming 2014 Data Breach Investigations Report

Breach data for upcoming Verizon report comes from some 50 contributing organizations from 95 nations, including Eastern European and Latin American CERTs

RSA CONFERENCE 2014 – San Francisco -- A decade of breach data gathered by Verizon for its Data Breach Investigations Report shows that the bad guys are winning when it comes to the efficiency of hacking into their victims systems, executives from the company said here this week.
Wade Baker, managing principal of RISK Intelligence for Verizon and one of the main authors of the companys renowned annual breach report, gave a little sneak peek here at some of the findings of the upcoming 2014 DBIR, due this spring. Baker says in three-fourths of the cases, it takes attackers days or less to compromise their target, while one-fourth of the time, victim organizations discover the attack in days or less.
Attackers are getting quicker at compromising systems over the past 10 years, Baker said. Less than 25 percent of good guys discovered these incidents in days or less. This is not a good situation ... The bad guys are winning at a faster rate than the good guys are winning.
[Verizon Data Breach Investigations Report 2013 says financial cybercrime accounting for three-fourths of real-world breaches, followed by cyberespionage in one-fifth of breaches. See
No One Size Fits All In Data Breaches, New Verizon Report Finds
.]
This years DBIR draws from 50 different contributing organizations from 95 different countries, including the U.S. Secret Service, the Poland CERT, and Latin American CERTs. Thats a big jump from the 19 contributors representing 27 countries in the 2013 Verizon DBIR.
Bryan Sartin, director of Verizons RISK Team, said incident detection is the underlying problem with the delayed awareness and reaction of victim organizations to attacks. Verizon in its report last year said most intrusions go undiscovered for seven months on average. Victims dont even find out on their own. They are finding out from someone else, Sartin said. Clearly, [what] has to change is detection -- the inability of victims to recognize and react to indicators of a cyberattack before it ends up a data breach and is in the headlines. That inability is securitys greatest single failure.
U.S. Secret Service special agent Edward Lowery, who heads up the agencys criminal investigative division, said in a panel discussion hosted by Verizon here that its all about the money for the bad guys his agency tracks. They are in it for the profit, and their business model requires that they be surreptitious. Its all about the money, Lowery said.
He said the surge in retail breaches of late isnt really new to that industry. But these and other breaches are becoming more sophisticated compared with earlier attacks, such as the one on TJX. We have seen changes in the attack vectors ... how long these individuals have been in the system. They study for their future crimes, looking for the vulnerabilities they can exploit, Lowery said. The actual intrusion may happen really quickly, but the work they do beforehand may not happen quickly.
Verizons Baker says the bad news from this years report is that the cybercriminals and other attackers are getting better at what they do, while the security community is not improving its game quickly enough to keep pace.
Verizon said its upcoming DBIR will include more specific recommendations for incidents and more actionable information.
The 2013 Verizon DBIR found attacks occurring in minutes or less in 84 percent of the cases, while 66 percent of breaches go undetected for months or even years.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Verizon Shares Glimpse Into Upcoming 2014 Data Breach Investigations Report