Criminal gangs on the hunt for weak business security

gallery

Nine out of ten compromised records as a result of a data breach were the responsibility of organised criminals, according to a report.

The Verizon Business Data Breach Investigations Report also said more than 285 million records were compromised in 2008 - more than the previous four years combined.

The results were taken from Verizon Business’ forensic team analysis of data breach investigations around the world, some of which weren’t publicly reported.

The report said: “While hackers prefer soft targets, they do seem to know where best to apply the pressure when motivated.”

However, it said that most of those incidents did not require difficult or expensive preventative controls, and that it was mistakes and oversights that hindered security efforts.

Evidence for this was that 81 per cent of breached organisations subject to PCI DSS were not compliant prior to being compromised.

The report said that the best defence against data breaches was to not retain data, but that wasn’t realistic for many organisations.

It said: “The next best thing is to retain only what is required for business or legal reasons, to know where it lives and flows, to protect it diligently.”

It warned businesses that if obvious weaknesses existed, it was likely that attackers would exploit them. Criminals were unlikely to waste effort if none were readily apparent.

The report also said that in 2008, a very large proportion of attackers gained access to enterprise networks using default, shared or stolen credentials, and that businesses didn’t seem to have a handle on the problem.

It said: “It’s certainly best to prevent such incidents in the first place, but a second line of defence is to review accounts for signs of abuse or anomalies.”

The report said that SQL injections were a common way of breaching corporate data last year.

“Secure development, code review, application testing, etc, are all considered beneficial in light of this finding,” it added.

Email to a friend

Print this page