Welcome to Scribd, the world's digital library. Read, publish, and share books and documents. See more ➡
Standard view
Full view
of .
Add note
Save to My Library
Sync to mobile
Look up keyword or section
Like this
P. 1
Verizon Data Breach 2011

Verizon Data Breach 2011

Ratings: (0)|Views: 1,075|Likes:
Published by pwissel3066
U.S. Secret Service investigation reveals thieves increasingly use physical skimmers on ATMs to steal money from bank accounts. See pages 40-41 of report.
U.S. Secret Service investigation reveals thieves increasingly use physical skimmers on ATMs to steal money from bank accounts. See pages 40-41 of report.

More info:

Published by: pwissel3066 on Sep 19, 2011
Copyright:Attribution Non-commercial


Read on Scribd mobile: iPhone, iPad and Android.
download as PDF, TXT or read online from Scribd
See More
See less





Data Breach
Investigations Report
A study conducted by the Verizon RISK Team with cooperation fromthe U.S. Secret Service and the Dutch High Tech Crime Unit.
2011 Data Breach Investigations Report
Wade BakerAlexander HuttonC. David HylenderJoseph Pamula, Ph.D.Christopher PorterMarc Spitler
Andy BonilloBen van Erck Mark GoudieJelle NiemantsverdrietChristopher Novak Rafael PerelsteinMike RosenBryan SartinPeter Tippett, M.D., Ph.D.J. Andrew ValentineMen and women of theU.S. Secret ServiceMen and women of theDutch High Tech Crime Unit
Steve Adams Thijs BosschertEric BrohmCalvin ChangRon DormidoKylee EvansJason FisherEric GentryJohn GrimClarence HillKenny LeeWayne LeeKevin LongDavid OstertagMatthew SpeicherEnrico TelemaqueYuichi UzawaNicolas VillattePaul Wright
Christopher AbodBrianna BoyleMike BrubakerAnita Fortunato
 And our continued gratitudeto all those we’ve named before and haven’t yet 
Executive Summary 2Year in Review, 201042010: The US Secret Service Perspective62011 DBIR: Methodology 7Verizon Data Collection Methodology7USSS Data Collection Methodology 8NHTCU Data Collection Methodology 8Classifying Incidents Using VERIS9 Turning the Incident Narrative into Metrics10A Word on Sample Bias 11Results and Analysis 11Demographics 122010 Threat Event Overview 15 Threat Agents 17Breach Size by Threat Agents19External Agents20Internal Agents 22Partner Agents 23 Threat Actions24Malware27Hacking 31Social 36Misuse 38Physical 40Error 42Environmental42Assets and Attributes43Compromised Data 47Attack Diculty 51Attack Targeting52Unknown Unknowns 53 Timespan of Attack54Breach Discovery Methods58Anti-Forensics                                                                 60PCI DSS Compliance                                                           62Conclusions and Recommendations 65Appendix A: Case Statistics from the Dutch High Tech Crime Unit 68Appendix B: Project Taurus and the Bredolab Takedown 71About Verizon Investigative Response71About the United States Secret Service72About the Dutch National High Tech Crime Unit                                   72
For additional updates and commentary, please visit
For inquiries directed to the United States Secret Service, contact
2011 Data Breach Investigations Report (DBIR)
Executive Summary
361 million
144 million
4 million
. Thus goes the tally of total records compromised across the combined caseloadof Verizon and the United States Secret Service (USSS) over the last three years. After four years of increasing losses culminatingin 2008’s record-setting 361 million, we speculated whether 2009’s drop to 144 million was a uke or a sign of things to come.2010’s total of less than four million compromised records seems to suggest it was a sign. But of what? And is it a permanentchange in direction or a temporary detour? To help us answer that, we are very glad to have the United States Secret Service (USSS) back with us for the 2011 DBIR.Additionally, we have the pleasure of welcoming the Dutch National High Tech Crime Unit (NHTCU) to the team. Through thiscooperative eort, we had the privilege—and challenge—of examining
about 800 new data compromise incidents sinceour last report
(with 761 of those for 2010). To put that in perspective, the entire Verizon-USSS dataset from 2004 to 2009numbered just over 900 breaches. We very nearly doubled the size of our dataset in 2010 alone!It is fascinating from a research standpoint that the all-time lowest amount of data loss occurred in the same year as the all-time highest amount of incidents investigated. In addition to being the largest caseload ever, it was also extremely diverse inthe threat agents, threat actions, aected assets, and security attributes involved. We witnessed highly automated and prolicexternal attacks, low and slow attacks, intricate internal fraud rings, country-wide device tampering schemes, cunning socialengineering plots, and much more. Some of the raw statistics may seem to contradict this claim of diversity (e.g., the percentof breaches attributed to external agents is more lopsided than ever), but one must consider the change in scale. Whereas“10%” used to mean approximately 10-15 breaches across an annual caseload averaging 100-150, it now means 75 breachesin the context of the 2010 caseload. Consider that fact as you digest and ponder results from this year’s report.With the addition of Verizon’s 2010 caseload and data contributed from the USSS and NHTCU, the DBIR series now spans7 years, 1700+ breaches, and over 900 million compromised records. We continue to learn a great deal from this ongoingstudy and we’re glad to have the opportunity once again to share these ndings with you. As always, our goal is that the dataand analysis presented in this report prove helpful to the planning and security eorts of our readers. As usual, we begin witha few highlights below. 
Who is behind data breaches?
stemmed from external agents (
)If you’ve followed these numbers over the years, you may bethinking we change our position more than a professionalcontortionist We’ll admit to a fair share of head scratchingamong the RISK team as we tried to interpret what they weretelling us In 2009, breaches involving insiders shot up due toincorporating the USSS data, but returned again to pre-USSSlevels in 2010 (even though they’re still with us) Read thereport for the full scoop on this, but it basically boils down toa HUGE increase in smaller external attacks rather than adecrease in insider activity Oh, and partner-caused breachescontinued their steady decline
implicated insiders (
resulted from business partners (
involved multiple parties (

You're Reading a Free Preview

/*********** DO NOT ALTER ANYTHING BELOW THIS LINE ! ************/ var s_code=s.t();if(s_code)document.write(s_code)//-->