News

Report: Cybercriminals organizing, functioning like legitimate businesses

April 22, 2016

Trustwave has issued its "2016 Trustwave Global Security Report," which details the top cybercrime, data breach and security threat trends from 2015.

The new report highlights a troubling trend in criminal operations, according to a Trustwave press release.

"Cybercriminals have been congregating and organizing for years, but 2015 showed a marked increase in the behavior we would normally associate with legitimate businesses," Trustwave President and CEO Robert J. McCullen said in the release. "[O]ur 2016 Trustwave Global Security Report shows businesses how and where these sophisticated criminal organizations are most likely to attack, and more importantly, how to defend their assets."

The reports addresses:

• application security — almost all (97 percent) applications tested by Trustwave in 2015 had at least one vulnerability; 10 percent of the vulnerabilities discovered were rated as critical or high risk. The median number of vulnerabilities discovered per application was 14.
• locations of security incidents — of data breach investigations conducted by Trustwave, 35 percent occurred in North America, 21 percent were in the Asia-Pacific Region, 12 percent were in Europe, the Middle East and Africa, and 10 percent were in Latin America and the Caribbean.
• businesses targeted —retail was the most compromised industry, making up 23 percent of investigations, followed by hospitality at 14 percent and food and beverage at 10 percent.
• data targeted —In 60 percent of investigations, attackers were after payment card data. This was split about evenly between card track data (31 percent of incidents), mainly from POS environments, and card-not-present data (29 percent), which mostly came from e-commerce transactions.
• detection of breaches — The majority of victims (59 percent) did not detect breaches themselves. Self-detection increased from 19 percent in 2014 to 41 percent in 2015. In 2015, a median of 15 days elapsed from intrusion to containment of self-detected breaches. For breaches detected by an external party, a median of 168 days elapsed from intrusion to containment.

The report is available as a free download.