The financial industry was the hardest hit by online security breaches, revealed a new report by Verizon Business.
The sector accounted for 93 percent of the 285 million compromised records last year. Ninety percent of these involved groups suspected of organized crime.
According to the 2009 Verizon Business Data Breach Investigations Report, the “big money” in cybercrimes resides in the theft of personal identification number (PIN) information together with associated debit and credit cards.
In 2008, Verizon Business witnessed an explosion of attacks targeting PIN data.
Hackers use the PIN to withdraw cash directly from the victim’s account so it becomes harder for the person to prove that the transactions are fraudulent.
Seventy-four percent of the data breaches discovered last year were caused by external sources while 32 percent involved business partners.
“The compromise of sensitive information increased dramatically in 2008 and it’s past time to be vigilant about enterprise security,” said Dr. Peter Tippett, vice president of research and intelligence for Verizon Business Security Solutions.
“This report should serve as another wake-up call that good security and a proactive approach are paramount to running a business in this day and age -- particularly since the economic crisis is likely to trigger a further increase in criminal activity,” said Dr Tippett.
Sixty-four percent of the breaches were attributed to hackers who used a combination of methods. In most instances, the hacker exploited a mistake committed by a victim, hacked into the system and installed malware to collect data.
Almost 70 percent of these breaches were discovered by a third party rather than the victim.
Verizon said that nine out of 10 breaches could have been prevented if basic security procedures had been followed.
The Verizon Business RISK team offered the following suggestions on how enterprises can improve data security:
- Change Default Credentials
- Avoid Shared Credentials
- Review User Accounts
- Employ Application Testing and Code Review
- Patch Comprehensively
- Assure HR Uses Effective Termination Procedures
- Enable Application Logs and Monitor
- Define “Suspicious” and “Anomalous” (then look for whatever “it” is).
|
