Verizon issued this morning its 2014 Data Breach Investigations Report (DBIR) that covers over 63,000 security incidents in 2013 from 50 global participating organizations spanning 95 countries. The top-line finding is that 92% of all security incidents in the past ten years fit into nine categories: POS Intrusion, Web App Attack, Insider Misuse, Theft/Loss, Misc. Error, Crimeware, Payment Card Skimmer, Denial of Service, Cyber Espionage and Everything Else.
Based on the 2013 data, public institutions dominate the list of breach or security incidents with nearly 47,500 security incidents, far dominating any other industry, mostly due to the nature of U.S. public agency reporting requirements (see table below, which I created and sorted in Excel).
But filtering out for only those incidents that involved confirmed data loss, the picture looks quite different (again, a sorted table I created in Excel).
Financial institutions rate number one in terms of incidents that feature data loss, with 465 such incidents, followed then by public institutions (175), retail (148), accommodation (137), unknown (126) and utilities (80).
The table above, straight from the report, lists the frequency of type of incidents per victim industry and shows what the graphic at the top of this post more succinctly illustrates - namely that the biggest threats vary from industry to industry. For 2013, 69% of the threats faced by utilities came in the form of web app attacks or crimeware. Over half of the attacks (54%) for manufacturing came from cyber-espionage or DOS. Nearly half of the security incidents for healthcare (46%) came from one category: theft or loss.
In reviewing the past year, Verizon notes a shift in cyber incidents that occurred in 2013, with a well-publicized trend emerging toward attacks on payment systems and away from geopolitical incidents. "2013 may be remembered as the 'year of the retailer breach,' but a comprehensive assessment suggests it was a year of transition from geopolitical attacks to large-scale attacks on payment card systems.'
0 comments:
Post a Comment
Note: Only a member of this blog may post a comment.