Light Reading

Verizon Offers Industry-Specific Security Advice

Carol Wilson

Seven years into publishing its annual analysis of data breach information, Verizon is taking a new approach, combining big data analysis with 10 years of data breach records to produce information specific industries can use to make their networks safer. (See Verizon DBIR Focuses Security by Industry.)

The 2014 Data Breach Investigations Report, known as the DBIR, goes beyond what past reports have delivered, says Verizon Enterprise Solutions 's Marc Spitler, senior analyst and DBIR co-author, to give enterprises more information on which they can act. After analyzing 63,000 incidents and 1,600 confirmed data breaches, Verizon determined that 90% of these fall into one of nine incident patterns. (By the way, you can download a copy of the report here.)

"These incidents patterns are analyzed, and they are mapped to particular industries, because we believe that will make it more actionable to those industries," Spitler says. "We think this is the proper evolution of what we are doing because people want more analysis and more advice on what to do."

By focusing on the type of incidents that most often affect their specific industry segment, enterprises can make more efficient use of the information Verizon is providing. That's particularly important because most industries are hit harder by a limited number of attack types, Spitler says.

What Verizon found is that most industries face the greatest threat from only three of the nine data threat patterns. Those patterns are:

  • Crimeware: malware intended to gain control of systems
  • Insider/privilege misuse
  • Physical theft/loss
  • Cyber-espionage
  • Denial-of-service attacks
  • Web app attacks
  • Point-of-sale intrusions
  • Payment card skimmers
  • Miscellaneous errors such as directing email to the wrong person

That's not to say the 2014 DBIR isn't full of its usual juicy tidbits about trends in cybercrime, because it is. For example, cyber-espionage is up, with the number of incidents reported totaling three times what was reported in 2013, although that is due in part to a greater data set. Many data breaches today happen stealthily and can take a long time to identify, leading to greater damage.

For the first time, the Verizon DBIR chose to address DDOS attacks and found these are getting stronger every year. DDOS attacks compromise network resources and can be either a distraction to the real data breach or an intended disruption of business. Financial services, retail, professional, information, and public sector enterprises all count DDOS attacks among their main threats.

The number one way of getting information remains use of stolen or hacked passwords, and DBIR authors say that makes a strong case for two-factor authentication.

Interestingly, retail point-of-sale attacks, which have been in the news of late, are actually on the wane in terms of volume, the DBIR notes.

Verizon issues its annual DBIR in part to highlight its own Verizon Managed Security Services which delivers, among many other things, two-factor authentication capabilities.

— Carol Wilson, Editor-at-Large, Light Reading

(2)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
Carol Wilson
Carol Wilson,
User Rank: Blogger
4/22/2014 | 3:22:35 PM
Re: Social Engineering
One of the DBIR's findings this year is that many data breaches go unnoticed for a substantial period of time. 

Certainly that was the case with many of the retail breaches this year, like the Target and Lord&Taylor incidents. Information gathering can be done over a long period of time, which means the impact of the breach is much greater. 

That puts a premium on not only trying to prevent breaches but on identifying them more quickly, which I think depends more on the ongoing analysis and tracking of LAN and WAN activity. 
User Rank: Light Sabre
4/22/2014 | 3:18:32 PM
Social Engineering
Getting stolen or hacked passwords probably comes from phishing attempts. It would seem, in my estimation, one of the easiest ways to procure authentication information. 

Social engineering is a bit different in that oftentimes a user doesn't realize they have been hacked for a long time. This type of intrusion can go unnoticed for a lengthy amount of time, and can reap a treasure trove of information for malicious actors. 
Educational Resources
sponsor supplied content
Educational Resources Archive
From The Founder
Steve Saunders provides an overview of white box networking and introduces a new "slim line" version of the OSI 7-layer model.
Flash Poll
Live Streaming Video
CLOUD / MANAGED SERVICES: Prepping Ethernet for the Cloud
Moderator: Ray LeMaistre Panelists: Jeremy Bye, Leonard Sheahan
Between the CEOs
Centec on Ethernet Switching

11|26|15   |   09:58   |   (0) comments

Centec CEO James Sun talks to Steve Saunders about Ethernet switching and the white box revolution.
LRTV Custom TV
Delivering Service Agility in the Virtualization Era

11|25|15   |   5.41   |   (0) comments

Interview with Massimo Fatato, WW OSS Business Lead, Hewlett Packard Enterprise.
Wagner’s Ring
How Might Open Source Fail?

11|24|15   |     |   (9) comments

Open source, SDN, and NFV are looking inevitable – but performance, standards proliferation and regulatory capture could derail the movement.
LRTV Custom TV
NFV Lifecycle Orchestration – a Fresh Vision for Telco

11|23|15   |   6.40   |   (0) comments

Simon Osborne, CTO Comptel, and Heavy Reading's Caroline Chappell reveal the business impacts of new SDN and NFV, and what the term service orchestration actually means. Together they define Lifecycle Service Orchestration and how the virtualized future will look for telecoms operators.
Between the CEOs
Cisco's Virtual Role in Saudi

11|20|15   |   12:15   |   (2) comments

Light Reading founder and CEO Steve Saunders talks with Zayan Sadek, Regional Manager at Cisco Systems, about the competitive communications services market and advance of virtualization in Saudi Arabia.
LRTV Huawei Video Resource Center
Huawei Leads With Kubernetes for Cloud PaaS

11|19|15   |   08:26   |   (0) comments

Huawei is looking to Kubernetes as a key tool for building robust open source technologies for customers and partners, said Ying Xiong, chief architect of cloud platform at Huawei, in an interview with Light Reading West Coast Bureau Chief Mitch Wagner at the recent Kubecon conference.
Women in Comms Introduction Videos
WiC in London: The Highlight Reel

11|19|15   |   5:33   |   (1) comment

NetCracker's Mervat El Dabae headlines an inspiring morning in London with help from leading women from Vodafone, TalkTalk, Hyperoptics and Ciena.
LRTV Documentaries
Why Saudi's So Hot for New Tech

11|19|15   |   05:07   |   (0) comments

Light Reading's Steve Saunders reports from Saudi Arabia, a hyper-competitive market desperate to embrace the next generation of communications technologies and services.
LRTV Custom TV
Why Data Models Deliver More Value Than Information Models

11|19|15   |   5.08   |   (0) comments

Stefan Vallin argues that more automation is needed to manage end-to-end services and the hybrid networks they run on, and that data models are key to achieving this.
Telecom Innovators Video Showcase
SDN Management & Orchestration in the WAN

11|17|15   |   7.20   |   (0) comments

Carol Wilson and Packet Design CTO Cengiz Alaettinoglu discuss CSPs' SDN service delivery and assurance requirements. Learn about a modular approach to building automated control, orchestration and management functions for the WAN that are policy- and analytics-driven.
LRTV Custom TV
Flash Networks: Optimizing for Radio Spectral Efficiency

11|17|15   |   3:34   |   (0) comments

Today most optimization vendors only focus on optimizing voice or data. Ofer Gottfried, Flash Networks' CTO, shows how improving data throughput and maximizing spectral efficiency reduces capital and operating expenses while also providing a platform for user engagement.
LRTV Custom TV
Making Pay-TV User Experiences Millennial-Friendly

11|16|15   |   6:42   |   (0) comments

The unique challenge of reaching and engaging Millennials is driving pay-TV video experience transformation that can include higher quality UIs, viewing of multiple content streams at once and seamless transitions between handheld devices and the television.
Allot MobileTrends Report H2/2015 reveals how daily online behavior can be used to discover smarter ways to profile customers and propose valuable, real-time offers to them.
Hot Topics
Samsung to Sell Wireless Networking Unit?
Dan Jones, Mobile Editor, 11/23/2015
Samsung: No Sale of Wireless Unit
Dan Jones, Mobile Editor, 11/25/2015
How Might Open Source Fail?
Mitch Wagner, West Coast Bureau Chief, Light Reading, 11/24/2015
Sprint to Get $1.2B From New Leasing Venture
Dan Jones, Mobile Editor, 11/23/2015
Networking Shines in HP's Gloomy Final Earnings
Mitch Wagner, West Coast Bureau Chief, Light Reading, 11/25/2015
Like Us on Facebook
Twitter Feed
December 15, 2015
Virtualizing Cable Services
Webinar Archive
BETWEEN THE CEOs - Executive Interviews
Centec CEO James Sun talks to Steve Saunders about Ethernet switching and the white box revolution.
Light Reading founder and CEO Steve Saunders talks with Zayan Sadek, Regional Manager at Cisco Systems, about the competitive communications services market and advance of virtualization in Saudi Arabia.
Cats with Phones
Can't Find the Phone on Thanksgiving? Click Here
Check under the cat! (hint: bottom right)
Live Digital Audio

Broadband speeds are ramping up across Europe as the continent, at its own pace, follows North America towards a gigabit society. But there are many steps to take on the road to gigabit broadband availability and a number of technology options that can meet the various requirements of Europe’s high-speed fixed broadband network operators. During this radio show we will look at some of the catalysts for broadband network investments and examine the menu of technology options on offer, including vectoring and for copper plant evolution and the various deployment possibilities for FTTH/B.