Report finds most data breaches are 'utterly preventable'

Powered by SC Magazine
 

SQL injection attacks still a major headache.

Most security breaches are caused by malware, an SQL injection attack or the exposure of remote access credentials such as a VPN password, according to a report by Verizon Business.

Verizon's 2009 Supplemental Data Breach Investigations Report, released today, said that malware such as keyloggers and spyware were responsible for the majority of data breaches.

Mark Goudie, managing principal at Verizon Business, told iTnews that the biggest surprise was that SQL injection attacks - which he described as "utterly preventable" - were still responsible for causing so much damage.

"This is an utterly preventable security flaw," he said. "You can get freeware scanners that will look for a SQL injection vulnerability."

But simply realising that a dangerous flaw existed wasn't enough to make organisations plug the security hole, he said.

"Over half of those cases had highlighted SQL injections in the scan reports as the only high risk vulnerability or exposure - and [yet] they had done nothing about it," said Goudie.

Shared or default remote access credentials also caused havoc, according to Goudie, who said "44 percent of the cases we investigated had a partner asset or connection involved in a data breach."

This means VPN credentials trusted to a third party were stolen or compromised and they were then used to remotely access the victim's network.

"Organisations were using common credentials across multiple organisations and certainly across multiple sites. They were breaking some of the basic rules of information security," said Goudie.

Preventing the majority of the security breaches described in the report would have been neither expensive or difficult, Goudie said.

"In 53 percent of cases we investigate, the [actions] that would have prevented the compromise, are simple or cheap. In only 13 percent of cases, victims would have needed difficult or expensive counter measures to prevent the breach," he said.


Report finds most data breaches are 'utterly preventable'
 
 
 
Top Stories
Change is the only constant at iiNet
iiNet's Matthew Toohey is trialling IBM's Watson - between preparing for an acquisition and making sure Netflix doesn't swamp the network.
 
Why straight-through processing is the holy grail for banks
Big benefits from stripping away human intervention and digitising processes.
 
CBA sued over frozen millions in IT bribery scandal
Eric Pulier's not-for profit lodges lawsuit in US.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Should Optus make a bid for iiNet?

   |   View results
Yes
  44%
 
No
  56%
TOTAL VOTES: 673

Vote