News

Study: Nearly all cyber attacks in 2011 were avoidable

March 28, 2012

A Verizon study released last Thursday said that 97 percent of the cyber attacks on FIs and other companies last year were carried out using fairly simple methods and easily could have been foiled with basic or intermediate controls, said a story in the CUNA.org newsletter.

"Target selection is based more on opportunity than on choice," the Verizon  2012 Data Breach Investigations Report said. "Most victims fell prey because they were found to possess an (often easily) exploitable weakness rather than because they were pre-identified for attack."

Last year marked the second highest data loss since Verizon initiated its annual tracking study in 2004. Of 855 data breaches affecting 174 million records, about 81 percent used basic hacking; 69 percent incorporated malicious software or malware; and 10 percent involved physical attacks.

Hacking into most victims' programs was relatively easy, the report said. However, after hackers gained entry, they used sophisticated tools to install malware, set up backdoors, enable remote control and seek sensitive data, while staying hidden on the network and covering their tracks.
 
Among other observations in the report:

• 96 percent of victims subject to PCI DSS were not in compliance with the standards;
• 94 percent of all data compromised involved servers;
• 92 percent of the incidents were discovered by a third party;
• 85 percent of breaches took weeks or more to discover.

More than half the data breaches occurred among hotel and food services providers; 20 percent targeted the retail trade; 10 percent affected finance and insurance providers (down from 22 percent in 2010). However among the largest organizations, Finance and insurance accounted for the most records breached — 28 percent.

Payment card numbers/data (48 percent) and authentication credentials (42 percent) such as user names and passwords, accounted for the highest percentages of stolen data.

The Verizon  2012 Data Breach Investigations Report was compiled with help from law enforcement agencies in the U.S. — including the Secret Service — and four other countries.

For more information on this topic, visit our security research center.