Data Breaches Made Possible By Incompetence, Carelessness

Eighty-seven percent of data breaches could have been prevented with reasonable security precautions, according to a study of over 500 forensic investigations conducted by Verizon Business Security Solutions.

Verizon's study of actual data breach investigations from 2004 through 2007 suggests that incompetence and carelessness represents the greatest threat to business information.

The study found that breaches were attributable a combination of events more frequently than a single action, including: a significant error (62%), hacking and intrusions (59%), malicious code (31%), an exploited vulnerability (22%), and physical threats (15%).

But for 90% of the known vulnerabilities exploited, patches were available for at least six months prior to the attack. This data point alone suggests that installing software patches as soon as they're made available will significantly reduce the chance of a data breach.

"We're seeing more and more examples of security breaches and compromises taking the path of least resistance," said Bryan Sartin, VP of investigative response at Verizon.

Fifty-two percent of attacks were rated as having a "low" difficulty level, according to the report. And only 15% of attacks were fully targeted. The remaining attacks were directed but opportunistic (46%) or randomly opportunistic (39%). An example of such an attack might be a hacker scanning the Web for sites running a particular vulnerable software application.

Based on the cases investigated, the type of data compromised falls into the following categories: payment card data (84%), personally identifiable information (32%), non-sensitive data (16%), authentication credentials (15%), other sensitive data (10%), intellectual property (8%), corporate financial data (5%), and medical/patient data (3%).

The study found that those responsible for data breaches were: external sources (73%), insiders (18%), business partners (39%), and multiple parties (30%). While insiders accounted for the smallest percentage of breaches, the breaches traced to them involved more than ten times as many records (375,000) as breaches traced to outsiders (30,000) and about twice as many records as breaches traced to partners (187,500).

Calculating risk by multiplying the likelihood of involvement times the number of records affected, the study concludes that business partners represent the greatest threat, followed closely by insiders.

"The most insidious breaches these days involve partial insiders, contractors, and third-parties who have ability misuse access," said Sartin.

Ignorance makes such incidents possible. Verizon's study found that 66% of the cases involved data that the victim did not know was on the system. Even more alarming, it found that 75% of the breaches were not discovered by the victim and that in 63% of cases, months or years passed between the initial breach and discovery.

"We find this statistic to be astounding," the study says and offers two likely explanations: "Firstly, and perhaps most obviously, criminals do not want to be discovered. They have great financial incentive to retain access to corporate systems for as long as possible and will go to great lengths to ensure their activities remain under the radar. Secondly, and perhaps most importantly, organizations simply are not watching."

Verizon recommends aligning policy with actual business processes, focusing on essentials to avoid becoming low-hanging fruit for hackers, making sure security controls extend to partners, creating a data retention plan to understand what data is where, actually monitoring network event logs, creating an incident response plan, and conducting mock incident testing.

According to the Identity Theft Resource Center, there were 446 data breaches publicly reported in 2007, 312 in 2006 and 158 in 2005. Verizon's report says that the more than 500 cases its investigators looked at include about one-third of the publicly disclosed data breaches in 2005 and a quarter of the publicly disclosed data breaches in 2006 and in 2007.

But according to Sartin, the publicly reported breaches are "just the tip of iceberg." He said that less than 5% of the more than 500 cases covered in the Verizon study involved some form of disclosure.

Though states have been passing data breach disclosure laws, he said that there are actually fewer data breaches being disclosed now than in the past. The reason, he said, is that each state has a different take on disclosure requirements and other countries often have no disclosure rules.

"Until there is a real consensus-based focus on how to do this right, you're going to see more and more companies find unique ways to sidestep their legal obligations," Sartin said.