Report finds most data breaches are 'utterly preventable'

Powered by SC Magazine
 

SQL injection attacks still a major headache.

Most security breaches are caused by malware, an SQL injection attack or the exposure of remote access credentials such as a VPN password, according to a report by Verizon Business.

Verizon's 2009 Supplemental Data Breach Investigations Report, released today, said that malware such as keyloggers and spyware were responsible for the majority of data breaches.

Mark Goudie, managing principal at Verizon Business, told iTnews that the biggest surprise was that SQL injection attacks - which he described as "utterly preventable" - were still responsible for causing so much damage.

"This is an utterly preventable security flaw," he said. "You can get freeware scanners that will look for a SQL injection vulnerability."

But simply realising that a dangerous flaw existed wasn't enough to make organisations plug the security hole, he said.

"Over half of those cases had highlighted SQL injections in the scan reports as the only high risk vulnerability or exposure - and [yet] they had done nothing about it," said Goudie.

Shared or default remote access credentials also caused havoc, according to Goudie, who said "44 percent of the cases we investigated had a partner asset or connection involved in a data breach."

This means VPN credentials trusted to a third party were stolen or compromised and they were then used to remotely access the victim's network.

"Organisations were using common credentials across multiple organisations and certainly across multiple sites. They were breaking some of the basic rules of information security," said Goudie.

Preventing the majority of the security breaches described in the report would have been neither expensive or difficult, Goudie said.

"In 53 percent of cases we investigate, the [actions] that would have prevented the compromise, are simple or cheap. In only 13 percent of cases, victims would have needed difficult or expensive counter measures to prevent the breach," he said.


Report finds most data breaches are 'utterly preventable'
 
 
 
Top Stories
Westpac committed to core banking plan
[Blog post] Now with leadership.
 
The True Cost of BYOD - 2014 survey
Twelve months on from our first study, is BYOD a better proposition?
 
Photos: Unboxing the Magnus supercomputer
Pawsey's biggest beast slots into place.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  30%
 
Application integration concerns
  3%
 
Security and compliance concerns
  27%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1171

Vote