Biz & IT —

Blame the victim: Report shows fifth of breaches caused by “miscellaneous errors”

Verizon annual report finds breaches happening faster and taking longer to be detected.

This breach was likely not caused by a default password. But too many data breaches in 2015 were.
This breach was likely not caused by a default password. But too many data breaches in 2015 were.

The number of reported breaches of organizations' data has been growing hyperbolically over the past few years, based on data in Verizon's 2016 Data Breach Investigations Report (DBIR). And a major reason for that is that many organizations are still doing security like they were decades ago. The leading cause of reported data breaches, as documented by Verizon, is "miscellaneous errors"—mistakes made by employees—that open the door to attackers.

For those who've followed the recent chain of crypto-ransomware attacks at hospitals around the country, this finding will come as no surprise. Issues such as system misconfiguration, end users sending sensitive data out of the network by mistake, or users clicking on stuff they shouldn't be clicking on were among the errors made by organizations that led to about 18 percent of the data breaches documented in 2015—and were likely the leading contributor to the many incidents that went unreported.

In 63 percent of "confirmed" breaches, attackers took advantage of weak password credentials, default passwords left in place, or passwords that were stolen through phishing attacks or other means. In other words, if organizations were using something other than just usernames and passwords as credentials to gain access to systems, more than half of the data breaches that happened in 2015 would not have occurred.

For all the talk in the security market about improving the speed with which breaches are detected, attackers are apparently well outpacing defenders—and more often than not, companies only find out about breaches when someone else tells them about it. According to Verizon, 82 percent of system compromises happen within minutes of the beginning of an attempt, while only 3 percent of breaches are detected in that timeframe; for the vast majority, the timeframe for detection is counted in weeks. Less than 25 percent are detected in "days or less."

Internal detection of breaches has actually gotten worse over time, with the vast majority of breaches being found by outsiders—law enforcement, credit card companies' fraud detection units, and other third parties. The 2015 numbers from Verizon were distorted a bit by law enforcement notifications resulting from botnet takedowns.

In cases where malware or hacking was used to get in the door, "zero day" vulnerabilities played a microscopic role. The vast majority of breaches involving exploiting bugs in software went after known vulnerabilities—and just 10 vulnerabilities accounted for 85 percent of exploit attacks (though the list of top vulnerabilities has been called into question by some observers).

Adobe Flash and Acrobat vulnerabilities, based on data provided by Kenna Security, were most quickly exploited by attackers—the majority of exploits appearing days or weeks after being revealed. Microsoft vulnerabilities were exploited a little more slowly on average, while Apple exploits appeared about 150 days after announcement and Mozilla exploits more than 200 days afterward.

Part of the reason for that variation in timing is simply economics—attackers gain a much wider reach by targeting Adobe and Microsoft than Apple and Mozilla, and therefore potentially can attack more victims using those exploits. Patching within the first few days of a security update could put a significant dent in "drive-by" malware attacks and reduce the risk posed by users clicking on a malicious link in an e-mail.

However, some of the systems hit hardest by exploits were ones out of the control of the victims. Point of sale (POS) systems, particularly at hotel chains in 2015, were often hit last year through the POS vendor—and not through bad configuration by the victim, as was prevalent a few years ago (such as Subway's POS hack in 2011).

The advice given by Verizon's DBIR is, not surprisingly, much like the same advice offered over the past nine years that the report has been produced. It's hard to tell whether organizations are taking that advice to heart or whether the problems and costs associated with improving credential management and patch management are simply insurmountable for many of them. Based on anecdotal evidence from some of the more newsworthy breaches of 2015, it’s probably a bit of both—organizations struggling to overcome security inertia with limited (or poorly managed) resources while whistling to themselves to drown out warnings of impending doom.

Channel Ars Technica