The state of IT Security

1
The State of IT Security
www.promisec.com
PROMISEC
2
OVERVIEW
In the eight years that Verizon has been tracking
data breaches, more than 2000 breaches and 1
billion compromised records have been
investigated.
How do breaches occur?
What commonalities Exist?
81 Form of hacking
79 Victims were targets of opportunity
96 Attacks were not highly difficult
69 Malware
94 Data Compromised involved servers
10 physical attacks
85 Breaches took weeks to discover
7 Social tactics
5 Privilege misuse
97 of breaches were avoidable by simple controls
PROMISEC
3
Who is Behind data breaches
98 external agents
58 Tied to activist groups
4 Implicated Internal employees
lt1 committed by business partners
PROMISEC
www.promisec.com
4
Origin of external agents
PROMISEC
www.promisec.com
5
The Victims
While organizations of all sizes were included in
the 855 incidents of 2011, smaller organizations
represented q majority of the victims.
Industry groups represented by percent of breaches
54 Accommodation and food services
10 Finance and Insurance
20 Retail trade
7 Health care and social assistance
3 Information
6 other
PROMISEC
www.promisec.com
6
Organizational size by number of breaches
PROMISEC
www.promisec.com
7
where should mitigation efforts be focused?
The Verizon report's recommendations for
organizations
Smaller Organizations
Larger Organizations
Implement a firewall or ACL on remote access
services.
Eliminate unnecessary data and keep tabs on
what's left.
Ensure essential controls are met and regularly
check that they remain so.
Change default credentials of POS systems and
other Internet-facing devices.
Evaluate threat landscape to prioritize your
treatment strategy
If a third party vendor, make sure they've
actually done them.
PROMISEC
www.promisec.com
8
Costs
How much do breaches cost?
This is difficult to estimate, since most
companies don't publish financial loss data,
according to Verizon. However, the report does
say that while some companies estimated that they
lost hundreds of millions of dollars, most didn't
even report a fraction of that amount. Verizon
estimates that most were at best inconvenienced
and likely returned to normal operations rather
quickly.
PROMISEC
www.promisec.com
9
CONTACT US
Support_at_promisec.com
www.promisec.com
_at_Promisec_IT
PROMISEC