Annual Security Reports, Part 2

7 Safe UK Breach Investigations Report

As reported by The H Security, this report confirms the Verizon 2009 Data Breach Report, that the majority of attacks come from external sources (80%). Of all the successful breaches that were detected and analyzed (since even security experts can’t be 100% sure what kind of data was stolen) 85% were Payment Card Information.

Check out the full report here.

---

Verizon 2009 Data Breach Investigations Supplemental Report

This supplemental report was released in the 2nd week of December 2009 and describes the Top 15 threats along with real world examples. Indicators and Countermeasures (or Mitigators) were also included.

The Top 15 Threats from the report were:
1. Keyloggers and Spyware
2. Backdoor or Command/Control
3. SQL injection
4. Abuse of system access/privileges
5. Unauthorized access via default credentials
6. Violation of Acceptable Use and other policies
7. Unauthorized access via weak or misconfigured ACLs
8. Packet Sniffer
9. Unauthorized access via stolen credentials
10. Pretexting (Social Engineering)
11. Authentication bypass
12. Physical theft of asset
13. Brute-force attack
14. RAM scraper
15. Phishing (and endless *ishing variations)

I really like the Indicators and Mitigators sections of the Threat Action Catalogue, since they can be easily integrated into a technical Security Awareness Program.

Check out the report here.

If you’d like to access the the Verizon 2009 Data Breach Investigations Report, released back in April 2009, click here. The summary of which can be found here.

Advertisement