Data breaches rocket, as Verizon report highlights tardy detection #DBIR

The collection of breached records increased from four million to 174 million in a year, with 97 per cent of them described as "avoidable".

According to the 2012 Verizon data breach investigations report, 97 per cent of breaches were avoidable without the desire for organisations to resort to difficult or expensive countermeasures.

Talking to SC Magazine, Wade Baker, Verizon's director of risk intelligence, said: “Often the attacks haven't been the foremost sophisticated, and really often that's what is successful.”

Baker said that as 174 million records were analysed from 855 data breaches â€" the second one highest detection of information loss recorded by Verizon because it began collecting data in 2004 â€" this was "way up", but for the figure to be greater than 100 million was "not that uncommon".

The report said 58 per cent of knowledge stolen in 2011 was attributed to hacktivism. It also claimed that 98 per cent of attacks were due to outsiders â€" including organised criminals, activist groups, former employees, lone hackers or even organisations sponsored by foreign governments.

Baker said: “It is dependent upon what you're looking at. For instance, in the event you examine intellectual property theft, then the insider threat goes up. i've only ever seen one data theft that involved an insider.”

In this year's report, only four per cent of attacks implicated internal employees.

In terms of ways breaches occur, 81 per cent used some kind of hacking, 69 per cent involved malware and ten per cent involved physical attacks. Seven per cent employed social engineering tactics and five per cent resulted from privilege misuse.

The report also said that during 54 per cent of cases, the time to discovery of attack was in months, and in 29 per cent was in weeks. Only two per cent of these attacked discovered the breach within an issue of hours. Within larger organisations, 39 per cent discovered in months, 27 per cent in days and 24 per cent in weeks.

In terms of knowledge exfiltration, 38 per cent of respondents were privy to this in minutes, while 25 per cent were aware within days.