Since organizations face unique security risks, an efficient and effective information security program cannot be achieved through a one-size fits all approach, concludes a follow-up report from the Verizon Business Risk Team.
The team released today its “2008 Verizon Data Breach Investigations Supplemental Report,” which examines trends in breaches for four industries — financial services, technology services, food and beverage, and retail. It is intended to clarify the findings in the company's “2008 Verizon Data Breach Investigations Report," published in June.
Across industries, cybercriminals utilize entirely different attack strategies, and companies have varying underlying vulnerabilities and exposures, Bryan Sartin, director of investigative response for Verizon Business, told SCMagazineUS.com Thursday.
Information from 500 data-breach cases worked on by the Verizon Business Investigative Response team from 2004 to 2007 was the basis for both the original study and the supplemental report.
“There are completely different types of attacks and attack strategies across industries, from one industry to the next,” Sartin said.
The supplemental report says that though no industries are immune from significant data breaches, security in the financial service industry is more advanced than the others. Firms in that space face a far greater risk from insiders, and attacks tend to take longer and are more sophisticated.
In the high-tech services industry, hacking is a significant problem and consistent and comprehensive patch deployment was found to be lacking.
The retail industry represented the greatest portion of the cases analyzed, and many of the attacks studied involved exploiting remote access connections and wireless networks.
In the food-and-beverage industry, while breaches are declining, attacks relied on poor security configurations. Intrusions were found to be highly repeatable and many involved spreading malware throughout store chains.
Most breaches involved data found in online servers, databases and applications, and payment card data was the predominant target across industries.
Sources originating outside of the organization were found to be the main cause of breaches overall — more than internal sources and third-party vendors.
Sartin said breaches involving third-party vendors are on the rise and by 2009, may take over as the dominant source of breaches. He also said that breaches in the hospitality sector are growing.
