April 20, 2009, 10:22 AM — 2008 was a banner year for security breaches, according to new research from Verizon. And while many security vendors have been banging the drum about the threat of malicious insiders, this report indicates organizations should be more wary of outside attacks (Read Senior Editor Bill Brenner's take on the insider threat in Laid-off Workers as Data Thieves?)
The "2009 Verizon Business Data Breach Investigations Report," released this week finds that hackers continue to intensify and sharpen their efforts to steal sensitive data. In fact, more electronic records were breached in 2008 than the previous four years combined. The study's authors said the upswing is fueled by a targeting of the financial services industry and a strong involvement of organized crime. Corporations fell victim to some of the largest cybercrimes ever during 2008, noted the report (Get tips on surviving a breach investigation in 5 Ways to Survive a Data Breach Investigation).
The findings debunk the motion that insiders account for the biggest threat to security in most organizations and instead finds that 74 percent resulted from external sources. Only 20 percent were caused by insiders.
The study, the second annual conducted by Verizon, is based on data analyzed from Verizon Business' actual caseload comprising 285 million compromised records from 90 confirmed breaches. The financial sector accounted for 93 percent of breaches, and a staggering 90 percent of these records involved groups identified by law enforcement as engaged in organized crime.
The research authors also noted that the investigation found most breaches were avoidable. Nearly nine out of 10, 87 percent, were considered avoidable through simple or intermediate controls. A staggering 81 percent of victims were not Payment Card Industry (PCI) compliant.
Another finding that may surprise some is that 99.9 percent of records were compromised through servers and applications, not from user sources often associated with data leaks, such as desktop PCs and mobile phones. Highly sophisticated attacks accounted for only 17 percent of breaches and 83 percent of attacks were considered to be what Verizon termed as "not highly difficult" to pull off. However, the study authors also note that while the percentage of sophisticated attacks was small, they accounted for 95 percent of the total records breached.
