Reviewing the 2017 Verizon DBIR - Robert Hurlbut...What is the Verizon DBIR? The Verizon Data Breach...

Reviewing the 2017 Verizon DBIR

Amherst Security Group May 10, 2017

Robert Hurlbut RobertHurlbut.com • @RobertHurlbut

Robert Hurlbut

Software Security Consultant, Architect, and Trainer

Owner / President of Robert Hurlbut Consulting Services Microsoft MVP – Developer Security 2005-2009, 2015, 2016 (ISC)2 CSSLP 2014-2017 Co-host with Chris Romeo – Application Security Podcast

Contacts Web Site: https://roberthurlbut.com Twitter: @RobertHurlbut, @AppSecPodcast

Disclaimer

I am not an employee of Verizon or their affiliates. All views, opinions, and biases are representative of my own independent research of the 2017 Verizon DBIR, unless noted.

What is the Verizon DBIR?

The Verizon Data Breach Investigations Report (DBIR) was first released in 2008 with data breach data from one organization: Verizon. Since then, this report has been released annually for 10 years.

What is the Verizon DBIR?

The latest report (released April 27, 2017) represents aggregated data breach data from 65 contributing organizations.

Definitions (from report)

Incident A security event that compromises the integrity, confidentiality or availability of a information asset.

Breach An incident that results in the confirmed disclosure—not just potential exposure—of data to an unauthorized party.

Definitions (from the report)

VERIS Vocabulary for Event Recording and Incident Sharing (VERIS) is a set of metrics designed to provide a common language for describing security incidents in a structured and responsible manner.

Incident/breach eligibility

The incident must have at least seven enumerations (e.g. threat actor variety, threat action category, variety of integrity loss and so on) across 34 fields OR be a DDoS attack. Exceptions are given to confirmed data breaches with less than seven enumerations. The incident must have at least one known VERIS threat action category (hacking, malware and so on).

Incident Classification Patterns

1.  Denial of Service 2.  Privilege Misuse 3.  Lost and Stolen Assets 4.  Everything Else 5.  Point of Sale 6.  Miscellaneous Errors 7.  Web App Attacks 8.  Crimeware 9.  Payment Card Skimmers 10. Cyber-Espionage

Verizon 2017 DBIR, page 5

ESP = Espionage motive OR state-affiliated OR nation-state actors FIG = Fun, Ideology, Grudge motives FIN = Financial motivation OR organizational criminal group actors C2 = Stolen credentials Note: Financial motivations and espionage account for 93% of breaches analyzed.

Key Industries

Accommodation and Food Services Educational Services Financial and Services Healthcare Information Manufacturing Public Administration Retail

Incidents (left) vs Breaches (right) counts by Industry

Incidents (left) vs Breaches (right) by Industry

Example: Financial threat actions

Example: Financial recommendation

Example: Healthcare

Summary of Industry Findings

The top three industries for data breaches were: financial services (24%), health care (15%), public sector (12%).

For financial services, the top two motives were: financial gain (72%) and espionage (21%)

The motives were flipped for the public sector, with: espionage (64%) and financial gain (20%)

Social attacks - Phishing for data

Incident Classification Patterns

Recommendations (summaries from “Things to Consider”)

Use two-factor authentication across all websites and privileged access to sensitive internal systems Change default passwords and use strong passwords Ensure DoS protection of external websites

Recommendations (summaries from “Things to Consider”) Insider Threats:

Periodically monitor employee activities Don’t give more permissions to employees than then need Disable accounts upon employee departure Use “warning banners” on systems so employees are aware of policies and ensure employees are aware that their activities are being monitored

Miscellaneous errors: Have second person sign off on publishing content to websites or changes Have a good policy for data handling and disposal of sensitive data (such as data stored on hard drives or printed on paper). Encrypt laptops (use whole disk encryption) and mobile devices Backup systems routinely

Recommendations (summaries from “Things to Consider”)

Have good business continuity and disaster recovery plans for your critical systems and applications. Keep software up to data (OS, web apps, plug-ins). Segregate networks based on data sensitivity (such as retail POS or customer database systems from rest of internal network). Monitor egress points to prevent data loss.

Look at nomoreransomware.org

Extra: DRAFT NIST 800-63-3 Digital Identity Guidelines Some password security recommendations: Remove periodic password change requirements Drop the algorithmic complexity song and dance Require screening of new passwords against lists of commonly used or compromised passwords https://pages.nist.gov/800-63-3/

Resources

Verizon 2017 Data Breach Investigations Report (DBIR)

https://www.verizonenterprise.com/resources/reports/rp_DBIR_2017_Report_en_xg.pdf

Verizon 2017 Data Breach Digest – RSA Conference 2017

https://www.rsaconference.com/writable/presentations/file_upload/lab4-r12_data-breach-digest-perspectives-on-the-human-element_copy1.pdf

VERIS Resources

http://veriscommunity.net Features information on the framework with examples and enumeration listings

https://github.com/vz-risk/veris Features the full VERIS schema

https://github.com/vz-risk/vcdb Provides access to database on publicly disclosed breaches, the VERIS Community Database

Questions?

Contacts

Web Site: https://roberthurlbut.com Twitter: @RobertHurlbut, @AppSecPodcast Email: robert at roberthurlbut.com

Reviewing the 2017 Verizon DBIR - Robert Hurlbut...What is the Verizon DBIR? The Verizon Data Breach...

Documents

The Human Firewall is on fire – Anatomy of an email-based · 2020. 6. 10. · 1 Verizon Data Breach Report 2016 | 2 Wired 2015 | 3 Verizon Data Breach Report 2017 | 4 FBI, Public

2018 Top 10 Cyber Threats Event... · 2020. 1. 11. · • Verizon 2017 DBIR, • Ponemon/IBM 2017 Cost of a Data Breach Report 2017 • Accenture/Ponemon Cost of Cyber crime Study

Managing Risk and Staying Safe Online - University of Toronto › wp-content › ... · EDUCATION AND AWARENESS • The 2018 Verizon Data Breach Investigations Report (DBIR) found

Know Your Enemy: Verizon Data Breach Report

U. S. Secret Service Electronic Crimes Task Force Bulletin · On May 8, 2019, Verizon released the 2019 edition of their annual Data Breach Investigations Report (DBIR). This is the

Cyber Insurance: Global developments, claim examples and ...events.globalreinsurance.com/dwic/wp-content/uploads/2018/07/CLY… · Verizon DBIR (2016 data breach investigation report

Breach Prevention: The Root Cause of the Data Breach Epidemic€¦ · Breach Prevention: The Root Cause of the Data Breach Epidemic According to the 2012 Verizon Data Breach Investigations

Raid08 dbir

E-MAIL SECURITY MITIGATION€¦ · Source: Gartner Information Security, Worldwide Source: 2018 Verizon DBIR 2016 –2022, 1Q 2018 update (2018 forecast) Network 61% Endpoint 19%

2017 Data Breach Investigations Report - Social …...Welcome to the 10th anniversary of the Data Breach Investigations Report (DBIR). We sincerely thank you for once again taking

Self-governing compliance doesn’t work here anymore...Verizon Data Breach Investigations Report 2015 Confirmed Serious Incidents With Card Losses Verizon Data Breach Investigations

Breach Investigations Report - SOVA · Verizon 2016 Data Breach Investigations Report 6 Breach trends Playing a part on the blue team in information security can, to a very small

DBIR-Italian media event (WITHOUT NOTES) Event.… · Netflow Honey nets, Honey Pots ... Demographics Industries. Confidential and proprietary material for authorized Verizon Business

2016 Data Breach Investigations Report (DBIR) & Cybersecurity on SlideShare

Secure Browsing – powered by Citrix XenApp, Citrix ...€¦ · 2016 Verizon Data Breach Investigations Report (DBIR) that opens with the above quote report notes that, as in all

Whitepaper PRIORITIZING VULNERABILITY REMEDIATION€¦ · goodies,” reads Verizon’s 2016 Data Breach Investigations Report (DBIR). “Hackers use what works and what works doesn’t

Evolution of the Verizon Data Breach Investigations Report (2008-2016)

Verizon Data Breach Digest 2016

DBIR INDUSTRY SNAPSHOT: RETAIL TRADE - Verizon Enterprise

2017 Data Breach Investigations Report...Welcome to the 10th anniversary of the Data Breach Investigations Report (DBIR). We sincerely thank you for once again taking time to dig into