© 2010 Verizon. All Rights Reserved. PTE / DBIR

PROPRIETARY STATEMENT This document and any attached materials are the sole property of Verizon and are not to be used by you other than to evaluate Verizon’s service. This document and any attached materials are not to be disseminated, distributed, or otherwise conveyed throughout your organization to employees without a need for this information or to any third parties without the express written permission of Verizon. The Verizon and Verizon Business names and logos and all other names, logos, and slogans identifying Verizon’s products and services are trademarks and service marks or registered trademarks and service marks of Verizon Trademark Services LLC or its affiliates in the United States and/or other countries. All other trademarks and service marks are the property of their respective owners.

Data Breach Investigations Report series

2011 DBIR Contributors Verizon United States Secret Service Dutch National High Tech Crime Unit

Methodology: Collection and Analysis VERIS framework used to collect data after investigation Aggregate and anonymize the case data RISK Intelligence team provides analytics 630 threat events VERIS:

Overview – What’s New? Over 750 new breaches studied since the last report –Total for all years = Just under 4 million records confirmed compromised –Total for all years = 900+ million Euro-centric appendix from Dutch HTCU ??

Drop in Data Loss – Our Hypotheses Random caseload variation Prosecution and incarceration of “Kingpins” –Deterrence and/or scrambling among criminal groups Change in criminal tactics –Away from massive breaches to smaller, less risky heists Market forces (law of supply and demand) Targeting different (non-bulk) data types –More IP, classified data, etc stolen They’ve gotten better at evading detection –This may be true, but we don’t think it explains the drop

Agents: Whose Actions Affected the Asset?

Agents: Who were the External Agents?

Agents: Who were the Internal Agents?

Actions: What Actions Affected the Asset?

Title?

Malware – What was the Infection Vector?

Malware – What was its Functionality?

Malware – How Often was it Customized?

Hacking – What was the Type Used?

Hacking – What Path did the Agent Take? Patchable vulnerabilities: 5

Social – What was the Type Used?

Social – What Path and Target did the Agent Use?

Misuse – What was the Type Used?

Physical – What was the Type Used?

Error – Types of Causal Error Leading to Breach?

Which Assets were Affected?

Which Operating Systems were Affected?

Location (Hosting) and Management of Assets Location Management

Which Data Types were Affected?

Total Number of Records Compromised since 2004

How Difficult were these Attacks?

Were these Victims Targeted?

How Long to Compromise, Discovery & Containment?

How did the Victim Discover the Breach?

What were the Unknown Unknowns?

Conclusions Focus on detection & prevention You often have time to react before FIM Evidence of breach is in the logs Filter outbound access Look for unusual locations

Wrapping up

Conclusions & recommendations Focus on essential controls. Focus on essential controls. Many organisations make the mistake of pursuing exceptionally high security in certain areas while almost completely neglecting others. Businesses are much better protected if they implement essential controls across the entire organization without exception. Eliminate unnecessary data. Eliminate unnecessary data. If you do not need it, do not keep it. For sensitive data that must be kept, identify, monitor and securely store it. Secure remote access services. Secure remote access services. Restrict these services to specific IP addresses and networks, minimising public access to them. Also, ensure that your organisation is limiting access to sensitive information within the network. Filter outbound activity. Filter outbound activity. If the criminal cannot get the data out of your environment then the data has not been compromised. Monitor and mine event logs. Monitor and mine event logs. Focus on the obvious issues that logs pick up, not the records. Reducing the compromise-to-discovery timeframe from weeks and months to days can pay huge dividends. Look for unusual location. Look for unusual location. Criminals do not tend to attack from the same location as your usual business partner and staff traffic.

DBIR: VERIS: Blog: securityblog.verizonbusiness.com