In my last blog post, I discussed the increase in reported breaches caused by insiders. What I didn't tell you was that the loss from those breaches was primarily (49%) embezzlement and related fraud. Only 3% of the records breached were from inside attacks.
This is important to note. The controls you need in place to prevent embezzlement, skimming and other types of fraud may be different than those you need to protect static database records or file type data. Understanding where your attacks are coming from and the target of those attacks can be very useful in selecting and placing controls.
On the flip side, 98% of the records compromised (customer, patient, etc.) were from external sources. Of this, 85% of the records were attributed to organized crime. WOW! I knew the number was high but that was surprising to me.
Makes me second guess my career choice. Here I am tracking organized crime for a living and I don't even get to carry a gun. All kidding aside though. This too should be a wake up call. Knowing where our attacks are coming from is important. Organized crime has the resources, capital and manpower to do significant damage when they want to. The days of implementing simple security controls which are not interconnected and sharing information will come to an end. As the attacks get more complex so must our defenses.
Don't read too much into all of this though. As pointed out in the report, 96% of all breaches were unsophisticated. Start small and work you way into a robust risk management and security program. Like the old addage goes...you only have to be faster than the slowest gazelle. That's if there's only one lion.
At the last ISSA meeting in Des Moines, we reviewed the 2010 Data Breach Investigations Report published by the Verison RISK Team in cooperation with the US Secret Service (USSS). This was the first year the USSS provided data for the report. The additional information expands the scope of the report and only helps to add credibility. Not that the report wasn't credible in the past, but Verizon's client base is going to favor those larger clients who can pay for their services. The USSS data helps to broaden the scope.
Two things caught my eye this year. The first was the 26% increase in breaches caused by insiders. The addition of USSS data helps reveal what we've known for a long time. Inside threats are very real and we must be prepared to prevent or detect them.
The second interesting fact was that 96% of all breaches were avoidable through simple or intermediate contols. This means it's not difficult or expensive to stop this epidemic. Why does it continue?
I believe the biggest reason is risk management. IT leaders are not proving their case well enough. When asking for budgets to mitigate risk we're not providing the detail or clearly communicating the risk. I'll bet if you asked every executive involved in that 96% of breaches if they would rather have paid for the controls up front you'd get a 100% affirmation rate.
This week make a concerted effort to ensure you are clearly communicating risk to the organization. Don't pull a "chicken little" routine but spend the time to have facts and numbers which show the entire picture to your management. You might be surprised how quickly they respond.
I'll add some additional thoughts on the report next week. If you are local to central Iowa and are interested in joining us at the next ISSA meeting, plesae check out our website at www.issa-desmoines.org
ISSA Des Moines Chapter Meeting
TIME: 11:30 (Please RSVP for a box lunch - cost $9.00)
LOCATION: BCSSI West Des Moines (www.issa-desmoines.org for directions)
TOPIC: "Oracle Security Risks" by Stephen Kost, CTO Integrigy Corporation
For most IT security professionals, the Oracle Database is a security challenge due to the complexity of the database and lack of database experience, especially as these databases often contain an organizations most critical data. This presentation will focus on a few of the highest risk and most difficult to solve security risks in an Oracle Database environment including security vulnerabilities, password weaknesses, and generic privileged access. To highlight the unrealized risk of security vulnerabilities in the database, a number of actual patched and un-patched security issues will be demonstrated. In order to mitigate these risks, resources and best practices for securing an organization's database will be discussed.
Stephen Kost is the Chief Technology Officer for Integrigy Corporation. He has been writing about and presenting on Oracle security and auditing for the past 11 years. He has worked with Oracle products since 1994 in many roles including database administrator, technical architect, IT security auditor, and applications administrator.