Light Reading

Verizon Offers Industry-Specific Security Advice

Carol Wilson
4/22/2014
50%
50%

Seven years into publishing its annual analysis of data breach information, Verizon is taking a new approach, combining big data analysis with 10 years of data breach records to produce information specific industries can use to make their networks safer. (See Verizon DBIR Focuses Security by Industry.)

The 2014 Data Breach Investigations Report, known as the DBIR, goes beyond what past reports have delivered, says Verizon Enterprise Solutions 's Marc Spitler, senior analyst and DBIR co-author, to give enterprises more information on which they can act. After analyzing 63,000 incidents and 1,600 confirmed data breaches, Verizon determined that 90% of these fall into one of nine incident patterns. (By the way, you can download a copy of the report here.)

"These incidents patterns are analyzed, and they are mapped to particular industries, because we believe that will make it more actionable to those industries," Spitler says. "We think this is the proper evolution of what we are doing because people want more analysis and more advice on what to do."

By focusing on the type of incidents that most often affect their specific industry segment, enterprises can make more efficient use of the information Verizon is providing. That's particularly important because most industries are hit harder by a limited number of attack types, Spitler says.

What Verizon found is that most industries face the greatest threat from only three of the nine data threat patterns. Those patterns are:

  • Crimeware: malware intended to gain control of systems
  • Insider/privilege misuse
  • Physical theft/loss
  • Cyber-espionage
  • Denial-of-service attacks
  • Web app attacks
  • Point-of-sale intrusions
  • Payment card skimmers
  • Miscellaneous errors such as directing email to the wrong person

That's not to say the 2014 DBIR isn't full of its usual juicy tidbits about trends in cybercrime, because it is. For example, cyber-espionage is up, with the number of incidents reported totaling three times what was reported in 2013, although that is due in part to a greater data set. Many data breaches today happen stealthily and can take a long time to identify, leading to greater damage.

For the first time, the Verizon DBIR chose to address DDOS attacks and found these are getting stronger every year. DDOS attacks compromise network resources and can be either a distraction to the real data breach or an intended disruption of business. Financial services, retail, professional, information, and public sector enterprises all count DDOS attacks among their main threats.

The number one way of getting information remains use of stolen or hacked passwords, and DBIR authors say that makes a strong case for two-factor authentication.

Interestingly, retail point-of-sale attacks, which have been in the news of late, are actually on the wane in terms of volume, the DBIR notes.

Verizon issues its annual DBIR in part to highlight its own Verizon Managed Security Services which delivers, among many other things, two-factor authentication capabilities.

— Carol Wilson, Editor-at-Large, Light Reading

(2)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
Carol Wilson
50%
50%
Carol Wilson,
User Rank: Blogger
4/22/2014 | 3:22:35 PM
Re: Social Engineering
One of the DBIR's findings this year is that many data breaches go unnoticed for a substantial period of time. 

Certainly that was the case with many of the retail breaches this year, like the Target and Lord&Taylor incidents. Information gathering can be done over a long period of time, which means the impact of the breach is much greater. 

That puts a premium on not only trying to prevent breaches but on identifying them more quickly, which I think depends more on the ongoing analysis and tracking of LAN and WAN activity. 
danielcawrey
50%
50%
danielcawrey,
User Rank: Light Sabre
4/22/2014 | 3:18:32 PM
Social Engineering
Getting stolen or hacked passwords probably comes from phishing attempts. It would seem, in my estimation, one of the easiest ways to procure authentication information. 

Social engineering is a bit different in that oftentimes a user doesn't realize they have been hacked for a long time. This type of intrusion can go unnoticed for a lengthy amount of time, and can reap a treasure trove of information for malicious actors. 
Educational Resources
sponsor supplied content
Educational Resources Archive
Flash Poll
From The Founder
Network architects aiming to upgrade their networks to support agile, open, virtualized services in the 21st century need to consider new criteria when choosing between technology suppliers.
Live Streaming Video
BTE 2015 Sponsor Keynote: HP
Dr. Prodip Sen, CTO, Network Functions Virtualization, HP
LRTV Documentaries
IoT in Action

6|30|15   |   1:39   |   (2) comments


Two co-workers discuss the benefits of IoT technology.
LRTV Interviews
Ericsson Opens Up on OPNFV

6|30|15   |   14:16   |   (0) comments


Martin Bäckström, VP and head of industry area Datacom at Ericsson, talks to Light Reading founder and CEO Steve Saunders about the emergence of OPNFV, the importance of standards and Ericsson's OPNFV plans.
LRTV Custom TV
NetNumber Founder Discusses NFV/SDN Impact on SP Networks

6|26|15   |   4:15   |   (0) comments


NetNumber Founder Doug Ranalli examines why SPs need a new network infrastructure for service agility. While NFV and SDN are the tools, the old ways of thinking about signaling control are inhibitors. Doug provides his recommendations.
LRTV Custom TV
Orchestrating NFV vCPE Services Across Multivendor Networks

6|26|15   |   5:46   |   (0) comments


Nirav Modi provides an overview of vCPE, the fastest-growing NFV use case, showing how Cyan's Blue Planet orchestrates vCPE services across a multivendor infrastructure to rapidly deliver new managed services for business customers.
LRTV Custom TV
ZTE at LTE Summit Amsterdam 2015

6|26|15   |     |   (0) comments


As one of the leading global telecommunications providers, ZTE presented its cutting-edge technology at LTE World Summit 2015 in Amsterdam. On display at ZTE's booth were the latest R&D achievements in wireless, 5G development, HetNet, deep convergence of FDD and TDD, and RCS/IMD/iSDN/vCN.
LRTV Documentaries
OPNFV Director Opens Up on Women in Tech

6|25|15   |   3:25   |   (0) comments


Heather Kirksey, the director of the OPNFV, gets real about the gender disparity in open source and standards and discusses how we can change both the conversation and the gender dynamics.
LRTV Custom TV
Symantec's Service Provider Security Strategy

6|24|15   |   7:06   |   (0) comments


Didi Dayton explores Symantec's emerging enterprise security strategies for service providers. Highlights include 'killing the password,' self-defense, advanced analytics and adaptive response in a service provider architecture.
Between the CEOs
Debating Network Evolution With Cisco's Cedrik Neike

6|23|15   |   12:54   |   (2) comments


Cedrik Neike, SVP of Global Service Provider, Service Delivery, at Cisco, talks to Light Reading founder and CEO Steve Saunders about solving service provider customer problems in a virtualized, DevOps world, including multivendor support and the future of network procurement.
LRTV Documentaries
Vodafone: What's Good for Moms Is Good for Business

6|23|15   |   3:04   |   (3) comments


Megan Doberneck, the general counsel for Vodafone Americas, discusses her company's progressive maternity policy, explains why promoting women in tech is good business and offers some some good advice for any women in the industry.
LRTV Interviews
NFV: Ready for Prime Time

6|23|15   |   05:09   |   (1) comment


At BTE 2015, Vip mobile CTO Dejan Kastelic talks about how NFV is ready for the real world and how Telekom Austria is introducing centralized resources for its group operations.
LRTV Documentaries
Tykes Talk Tech

6|22|15   |   02:30   |   (9) comments


What does optical fiber look like? When will 5G arrive? What's the WiFi password at Ikea? Light Reading sat down with three 8-year-olds to answer some of the communications industry's most burning questions...
LRTV Huawei Video Resource Center
Huawei Partners With TDC for World's First Early DOCSIS 3.1 Field Test

6|22|15   |   3:06   |   (0) comments


In a move to enhance user experience, Denmark's TDC aims to become an early adopter of DOCSIS 3.1. In partnership with Huawei, TDC recently ran the world's first field tests on its coax network that reached speeds nearing 1 Gbit/s.
Upcoming Live Events
September 16-17, 2015, The Westin Galleria Dallas, Dallas, TX
September 29-30, 2015, The Westin Grand Müchen, Munich, Germany
October 6, 2015, The Westin Peachtree Plaza, Atlanta, GA
October 6, 2015, Westin Peachtree Plaza, Atlanta, GA
October 14-15, 2015, New Orleans Ernest N. Morial Convention Center, New Orleans, LA
All Upcoming Live Events
Infographics
Hot Topics
Staying Productive With My Office-in-a-Bag
Mitch Wagner, West Coast Bureau Chief, Light Reading, 6/25/2015
WiFi Calling Catches on Globally
Sarah Thomas, Editorial Operations Director, 6/23/2015
Who's Feeding Fiber to LinkNYC Hotspots?
Mari Silbey, Senior Editor, Cable/Video, 6/29/2015
Verizon Closes AOL, Hints at Summer Launch
Mari Silbey, Senior Editor, Cable/Video, 6/23/2015
Like Us on Facebook
Twitter Feed
Webinar Archive
BETWEEN THE CEOs - Executive Interviews
Casa Systems has been going from strength to strength over the last couple of years. In 2013, it became the first vendor to ship an integrated CCAP device -- the ...
Cedrik Neike, SVP of Global Service Provider, Service Delivery, at Cisco, talks to Light Reading founder and CEO Steve Saunders about solving service provider customer problems in a virtualized, DevOps world, including multivendor support and the future of network procurement.
Cats with Phones