Networking

08:00 AM
Connect Directly
RSS
E-Mail
50%
50%

Criminals Cast Wide Net: Verizon Reports More Numerous But Smaller Breaches

Cyber criminals have apparently switched gears dramatically, eschewing big data breaches in favor of more low-risk attacks against poorly defended targets. The 2011 Verizon Data Breach Investigations Report shows a precipitous drop in the number of records stolen--from 141 million in 2009 to 4 million in 2010, even as the caseload of breaches investigated increased more than six-fold.

Cyber criminals have apparently switched gears dramatically, eschewing big data breaches in favor of more low-risk attacks against poorly defended targets. The 2011 Verizon Data Breach Investigations Report shows a precipitous drop in the number of records stolen--from 141 million in 2009 to 4 million in 2010, even as the caseload of breaches investigated increased more than six-fold.

"We're seeing a retooling by the folks who are behind this," says Chris Novak, global forensics investigator for Verizon. "We're not seeing them target large-scale data breaches; they're hitting smaller scale organizations." Novak cites successful arrest and prosecution in the criminal underground as a factor. Criminals are shying away from high-risk "big jobs" and picking on smaller targets, where security is likely to be weaker.

Most of these attacks, 83%, are classified as opportunistic rather than targeted against particular organizations, indicating the use of automated weapons and snatch-and-run tactics rather than long-term intrusions in which criminals continue to exfiltrate records undetected over long periods of time. Malware was a factor in almost half the breaches, an increase from 38% in 2009, which may also indicate a trend to automation and a lower chance of getting caught.

"When we have an opportunity to interview perpetrators, the common thread is that they rarely know who they hacked into," Novak says. "They don't care what the sign on the outside of the building says; cash is cash. Why go after Fort Knox when I run a much better risk of getting caught, when I can knock over a bunch of liquor stores? The job is easier to pull off, and the risk is a lot less."

There may also be a glut of personally identifiable information (PII), credit card numbers and other mass-volume information, Novak says. The value may have decreased as the criminal market reaches a saturation point, so records that may have fetched $30, $50 or $100 at one time may be worth only cents on the dollar. However, payment card information is still a popular target, he says, because it is the easiest to monetize, and randomly stolen intellectual property has no value unless the thief is in a position to use it.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Cartoon
Slideshows
Audio Interviews
Archived Audio Interviews
Jeremy Schulman, founder of Schprockits, a network automation startup operating in stealth mode, joins us to explore whether networking professionals all need to learn programming in order to remain employed.
White Papers
Register for Network Computing Newsletters
Current Issue
2014 Private Cloud Survey
2014 Private Cloud Survey
Respondents are on a roll: 53% brought their private clouds from concept to production in less than one year, and 60% ­extend their clouds across multiple datacenters. But expertise is scarce, with 51% saying acquiring skilled employees is a roadblock.
Video
Twitter Feed