& cplSiteName &

Verizon: Hackers Still Using Old Tricks

Carol Wilson
4/19/2011
50%
50%

Hackers and mobsters aren't innovating to steal more data and crack into more networks, because they don't have to -- there is still low-hanging fruit to be harvested in the data security orchard, according to the "2011 Verizon Data Breach Investigations Report."

"We are not seeing James Bond or Star Trek type attacks or anything we haven't seen before," says Dave Ostertag, Verizon Enterprise Solutions global investigations manager. "The bad guys are using the same techniques as five to eight years ago."

The report found an astounding increase in the number of data breaches reported, but a decline in the amount of data stolen. Just over 760 data breaches were reported in 2010, compared to 900 total in the six previous years. But only 4 million records were compromised -- that's a lot, but a lot less than the 144 million compromised in 2009.

That seeming disconnect is the result of a couple of trends: Security systems are protecting large-scale data networking operations, driving the bad guys to go after smaller, unprotected operations such as mom-and-pop retailers. And a growing amount of what's being stolen today is intellectual property that can be used to damage a business, but isn't measured in number of data records.

"That kind of data theft involves only one buyer -- someone who can use information about business processes, corporate earnings or some other intellectual property to damage a business," Ostertag says.

Other notable trends:

  • The "inside" job isn't: More than 90 percent of attacks were by outside sources.
  • There is growing physical theft, much of it by device, such as those put on ATMs or gas pump credit cards. That kind of breach doubled in 2010 and is tied to organized crime.
  • Businesses still need to do the basics, like strengthening and changing passwords, limiting and controlling "privileged" users, actually studying event logs for anomalies and paying closer attention to physical access points.

    Why this matters
    Verizon's annual report gives enterprises a road map for how to spend their limited corporate dollars to reduce vulnerability to security breaches, based on what current attacks look like. Ostertag also used the report to warn enterprises that a new cycle of large-scale attacks -- those designed to capture a large volume of credit card numbers or other monetizable data -- may start soon, and the industry needs to be prepared.

    For more
    Managed security remains a sweet spot for service providers. Here's a look at some recent announcements in this realm:

  • BT Launches Managed, Secured Messaging
  • XO Lands Cloud Security Partner
  • Bad Economy Good for Managed Services Sales
  • Verizon Aims for 'Everything as a Service'
  • MegaPath Chases Managed Security
  • Cox Enhances HSD for SMBs
  • Developers Get Choosy About Mobile App Platforms — Carol Wilson, Chief Editor, Events, Light Reading

    (7)  | 
    Comment  | 
    Print  | 
  • Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
    jepbjr
    50%
    50%
    jepbjr,
    User Rank: Light Beer
    12/5/2012 | 5:07:12 PM
    re: Verizon: Hackers Still Using Old Tricks


    Managed security services are a great idea for carrier service offerings, but the carrier networks themselves are generally shockingly unprotected.  Default passwords left open on network nodes, no centralized logging of NE command interaction, and no centralized administration of user privileges, password aging, or contractor access are not the exception -- they're the rule. 

    DCITDave
    50%
    50%
    DCITDave,
    User Rank: Light Beer
    12/5/2012 | 5:07:07 PM
    re: Verizon: Hackers Still Using Old Tricks


    The survey results raise a question: If hacker moves haven't changed in five years, why invest in more sophisticated security/protection systems?

    paolo.franzoi
    50%
    50%
    paolo.franzoi,
    User Rank: Light Sabre
    12/5/2012 | 5:06:57 PM
    re: Verizon: Hackers Still Using Old Tricks


     


    So, the reason that the hackers are not morphing?  Their current attacks work great!


    What we are seeing in the Spam business anyway is steady state on the spam but a huge rise in Phishing and Malware campaigns.  These are the much more sophisticated attacks.  I am surprised that Verizon did not note the rise in drive by malware attacks (attacks that can happen even if you don't click the link).


    The issue with the more sophisticated security systems is really time to response.  Does your vendor have a way of stopping a specific attack soon after it starts?


    As to the managed security business (since I am in it), the best way to look at it is IT outsourcing.  Instead of having your IT folks have to have deep knowledge in all kinds of equipment are there vendors out there willing to manage equipment so that your IT folks don't have to.


     


    seven


     

    DCITDave
    50%
    50%
    DCITDave,
    User Rank: Light Beer
    12/5/2012 | 5:06:57 PM
    re: Verizon: Hackers Still Using Old Tricks


    Do you think the expertise in IT security outsourcing should break down around network expertise or equipment expertise?


    If a business were choosing between Verizon and, say, a security management specialist, what would be the biggest argument for the specialist?

    paolo.franzoi
    50%
    50%
    paolo.franzoi,
    User Rank: Light Sabre
    12/5/2012 | 5:06:56 PM
    re: Verizon: Hackers Still Using Old Tricks


     


    Well, I can't imagine Verizon being an expert more than an IT department.  We recommend us as the experts on our product. :)


    The "cloud" model with security is often what is being discussed in this area.  Carriers sometimes resell 3rd party services (well that is what our carrier customers often do).  They can offer them directly as well.


    It's funny the network expertise I see is really minimal.  The network stuff from our standpoint is guys who know a lot about routers and firewalls.  Customers often know very little about them and have difficulty dealing with them.  The classic network expertise means very little.  Its an Internet connection or its an Internet connection or its an Internet connection.  The things carriers care about in building networks are basically of little to no value to guys who just want an Ethernet Jack with an Internet Pipe attached to it. 


    What I have not seen is a carrier wanting to take over and manage my internal network with its VPNs (and yes there are multiple of them).  Now THAT would be a service people would pay for.  Bring the network to the desktop and toss out basically the network staff in the IT department.


    seven


     

    desiEngineer
    50%
    50%
    desiEngineer,
    User Rank: Light Beer
    12/5/2012 | 5:06:56 PM
    re: Verizon: Hackers Still Using Old Tricks


    seven,


    I don't think providers have that quality of staff.  I think that security is inherently a much harder problem than network connectivity.  Network connectivity can be taught from a book for dummies, a trade school, etc.


    Network security should only be managed by a paranoiac.  If service providers want to sell managed network security, they need to hire people like that.


    And there aren't enough paranoid networkers to go around, so managed network security could really take off, provided SPs think along those lines.


    -desi

    paolo.franzoi
    50%
    50%
    paolo.franzoi,
    User Rank: Light Sabre
    12/5/2012 | 5:06:54 PM
    re: Verizon: Hackers Still Using Old Tricks


    desi,


    I am not trying to say what SPs staff can and can't do.  I know we have SPs that resell our security services to customers.  So, they can at least do that.  As to outsourcing the Geek Squad stuff, at least that makes some sense to bring across the networking expertise.


    seven


     

    Featured Video
    From The Founder
    John Chambers is still as passionate about business and innovation as he ever was at Cisco, finds Steve Saunders.
    Flash Poll
    Upcoming Live Events
    September 12, 2018, Los Angeles, CA
    September 24-26, 2018, Westin Westminster, Denver
    October 9, 2018, The Westin Times Square, New York
    October 23, 2018, Georgia World Congress Centre, Atlanta, GA
    November 6, 2018, London, United Kingdom
    November 7-8, 2018, London, United Kingdom
    November 8, 2018, The Montcalm by Marble Arch, London
    November 15, 2018, The Westin Times Square, New York
    December 4-6, 2018, Lisbon, Portugal
    All Upcoming Live Events
    Hot Topics
    T-Mobile to Play the Customer Care Card With Layer3 TV
    Jeff Baumgartner, Senior Editor, Light Reading, 8/15/2018
    Australia Could Open 5G Door to Huawei
    Robert Clark, 8/16/2018
    Video Navigation Gets an AI Assist
    Jeff Baumgartner, Senior Editor, Light Reading, 8/16/2018
    Eurobites: Deutsche Telekom Pulls Out of Iran
    Iain Morris, International Editor, 8/17/2018
    Animals with Phones
    When Your Cat Hijacks Your Tech Click Here
    Live Digital Audio

    A CSP's digital transformation involves so much more than technology. Crucial – and often most challenging – is the cultural transformation that goes along with it. As Sigma's Chief Technology Officer, Catherine Michel has extensive experience with technology as she leads the company's entire product portfolio and strategy. But she's also no stranger to merging technology and culture, having taken a company — Tribold — from inception to acquisition (by Sigma in 2013), and she continues to advise service providers on how to drive their own transformations. This impressive female leader and vocal advocate for other women in the industry will join Women in Comms for a live radio show to discuss all things digital transformation, including the cultural transformation that goes along with it.

    Like Us on Facebook
    Twitter Feed