Report finds most data breaches are 'utterly preventable'

Powered by SC Magazine
 

SQL injection attacks still a major headache.

Most security breaches are caused by malware, an SQL injection attack or the exposure of remote access credentials such as a VPN password, according to a report by Verizon Business.

Verizon's 2009 Supplemental Data Breach Investigations Report, released today, said that malware such as keyloggers and spyware were responsible for the majority of data breaches.

Mark Goudie, managing principal at Verizon Business, told iTnews that the biggest surprise was that SQL injection attacks - which he described as "utterly preventable" - were still responsible for causing so much damage.

"This is an utterly preventable security flaw," he said. "You can get freeware scanners that will look for a SQL injection vulnerability."

But simply realising that a dangerous flaw existed wasn't enough to make organisations plug the security hole, he said.

"Over half of those cases had highlighted SQL injections in the scan reports as the only high risk vulnerability or exposure - and [yet] they had done nothing about it," said Goudie.

Shared or default remote access credentials also caused havoc, according to Goudie, who said "44 percent of the cases we investigated had a partner asset or connection involved in a data breach."

This means VPN credentials trusted to a third party were stolen or compromised and they were then used to remotely access the victim's network.

"Organisations were using common credentials across multiple organisations and certainly across multiple sites. They were breaking some of the basic rules of information security," said Goudie.

Preventing the majority of the security breaches described in the report would have been neither expensive or difficult, Goudie said.

"In 53 percent of cases we investigate, the [actions] that would have prevented the compromise, are simple or cheap. In only 13 percent of cases, victims would have needed difficult or expensive counter measures to prevent the breach," he said.


Report finds most data breaches are 'utterly preventable'
 
 
 
Top Stories
Photos: Global Switch opens Sydney East data centre
First stage opened, to some fanfare.
 
ATO releases long-awaited Bitcoin guidance
Everyday investors escape the tax man.
 
Why the Weather Bureau’s new supercomputer is a 'gamechanger'
IT transformation starts to reap results.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  68%
 
Advanced persistent threats
  3%
 
Unpatched or unsupported software vulnerabilities
  12%
 
Denial of service attacks
  7%
 
Insider threats
  11%
TOTAL VOTES: 482

Vote