Hackers and mobsters aren't innovating to steal more data and crack into more networks, because they don't have to -- there is still low-hanging fruit to be harvested in the data security orchard, according to the "2011 Verizon Data Breach Investigations Report."

"We are not seeing James Bond or Star Trek type attacks or anything we haven't seen before," says Dave Ostertag, Verizon Enterprise Solutions global investigations manager. "The bad guys are using the same techniques as five to eight years ago."

The report found an astounding increase in the number of data breaches reported, but a decline in the amount of data stolen. Just over 760 data breaches were reported in 2010, compared to 900 total in the six previous years. But only 4 million records were compromised -- that's a lot, but a lot less than the 144 million compromised in 2009.

That seeming disconnect is the result of a couple of trends: Security systems are protecting large-scale data networking operations, driving the bad guys to go after smaller, unprotected operations such as mom-and-pop retailers. And a growing amount of what's being stolen today is intellectual property that can be used to damage a business, but isn't measured in number of data records.

"That kind of data theft involves only one buyer -- someone who can use information about business processes, corporate earnings or some other intellectual property to damage a business," Ostertag says.

Other notable trends:

The "inside" job isn't: More than 90 percent of attacks were by outside sources.

There is growing physical theft, much of it by device, such as those put on ATMs or gas pump credit cards. That kind of breach doubled in 2010 and is tied to organized crime.

Businesses still need to do the basics, like strengthening and changing passwords, limiting and controlling "privileged" users, actually studying event logs for anomalies and paying closer attention to physical access points.

Why this matters
Verizon's annual report gives enterprises a road map for how to spend their limited corporate dollars to reduce vulnerability to security breaches, based on what current attacks look like. Ostertag also used the report to warn enterprises that a new cycle of large-scale attacks -- those designed to capture a large volume of credit card numbers or other monetizable data -- may start soon, and the industry needs to be prepared.

For more
Managed security remains a sweet spot for service providers. Here's a look at some recent announcements in this realm:

BT Launches Managed, Secured Messaging

XO Lands Cloud Security Partner

Bad Economy Good for Managed Services Sales

Verizon Aims for 'Everything as a Service'

MegaPath Chases Managed Security

Cox Enhances HSD for SMBs

Developers Get Choosy About Mobile App Platforms — Carol Wilson, Chief Editor, Events, Light Reading