Thumbnail: 

Breaches of electronic records last year involved more insider threats, greater use of social engineering and the continued strong involvement of organized criminal groups, according to the 2010 Verizon Data Breach Investigations Report, based on a first-of-its kind collaboration with the U.S. Secret Service.
 
The study, released July 28, also noted that the overall number of breaches investigated last year declined from the total for the previous year – “a promising” indication.
 
The report cited stolen credentials as the most common way of gaining unauthorized access into organizations in 2009, pointing once again to the importance of strong security practices both for individuals and organizations. Organized criminal groups were responsible for 85% of all stolen data last year, the report said. 
 
Verizon Business investigative experts found, as they did in the company’s prior data breach reports, that most breaches were considered avoidable if security basics had been followed. Only 4% of breaches assessed required difficult and expensive protective measures.
 
The 2010 report concluded that being prepared remains the best defense against security breaches. For the most part, organizations still remain sluggish in detecting and responding to incidents. Most breaches (60%) continue to be discovered by external parties and then only after a considerable amount of time. And while most victimized organizations have evidence of a breach in their security logs, they often overlook them due to a lack of staff, tools or processes.
 
The 2010 study shows that simple actions, when done diligently and continually, can reap big benefits. These actions include restricting and monitoring privileged users; watching for ‘minor’ policy violations; implementing measures to thwart stolen credentials; monitoring and filtering outbound traffic; change the approach to event monitoring and log analysis; and sharing incident information.
 
The collaboration with the Secret Service, announced in May, enabled this year’s Data Breach Investigations Report to provide an expanded view of data breaches over the last six years. With the addition of Verizon’s 2009 caseload and data contributed by the Secret Service -- which investigates financial crimes -- the report covers 900-plus breaches involving more than 900 million compromised records.

Quote Image: