2011
Data Breach
Investigations Report
A study conducted by the Verizon RISK Team with cooperation fromthe U.S. Secret Service and the Dutch High Tech Crime Unit.
2011 Data Breach Investigations Report
LEAD ANALYSTS/AUTHORS:
Wade BakerAlexander HuttonC. David HylenderJoseph Pamula, Ph.D.Christopher PorterMarc Spitler
AUTHORS
Andy BonilloBen van Erck Mark GoudieJelle NiemantsverdrietChristopher Novak Rafael PerelsteinMike RosenBryan SartinPeter Tippett, M.D., Ph.D.J. Andrew ValentineMen and women of theU.S. Secret ServiceMen and women of theDutch High Tech Crime Unit
CONTRIBUTORS:
Steve Adams Thijs BosschertEric BrohmCalvin ChangRon DormidoKylee EvansJason FisherEric GentryJohn GrimClarence HillKenny LeeWayne LeeKevin LongDavid OstertagMatthew SpeicherEnrico TelemaqueYuichi UzawaNicolas VillattePaul Wright
SPECIAL THANKS TO:
Christopher AbodBrianna BoyleMike BrubakerAnita Fortunato
And our continued gratitudeto all those we’ve named before and haven’t yet
TABLE OF CONTENTS
Executive Summary 2Year in Review, 201042010: The US Secret Service Perspective62011 DBIR: Methodology 7Verizon Data Collection Methodology7USSS Data Collection Methodology 8NHTCU Data Collection Methodology 8Classifying Incidents Using VERIS9 Turning the Incident Narrative into Metrics10A Word on Sample Bias 11Results and Analysis 11Demographics 122010 Threat Event Overview 15 Threat Agents 17Breach Size by Threat Agents19External Agents20Internal Agents 22Partner Agents 23 Threat Actions24Malware27Hacking 31Social 36Misuse 38Physical 40Error 42Environmental42Assets and Attributes43Compromised Data 47Attack Diculty 51Attack Targeting52Unknown Unknowns 53 Timespan of Attack54Breach Discovery Methods58Anti-Forensics 60PCI DSS Compliance 62Conclusions and Recommendations 65Appendix A: Case Statistics from the Dutch High Tech Crime Unit 68Appendix B: Project Taurus and the Bredolab Takedown 71About Verizon Investigative Response71About the United States Secret Service72About the Dutch National High Tech Crime Unit 72
For additional updates and commentary, please visit
For inquiries directed to the United States Secret Service, contact
2
2011 Data Breach Investigations Report (DBIR)
Executive Summary
361 million
>>
144 million
>>
4 million
. Thus goes the tally of total records compromised across the combined caseloadof Verizon and the United States Secret Service (USSS) over the last three years. After four years of increasing losses culminatingin 2008’s record-setting 361 million, we speculated whether 2009’s drop to 144 million was a uke or a sign of things to come.2010’s total of less than four million compromised records seems to suggest it was a sign. But of what? And is it a permanentchange in direction or a temporary detour? To help us answer that, we are very glad to have the United States Secret Service (USSS) back with us for the 2011 DBIR.Additionally, we have the pleasure of welcoming the Dutch National High Tech Crime Unit (NHTCU) to the team. Through thiscooperative eort, we had the privilege—and challenge—of examining
about 800 new data compromise incidents sinceour last report
(with 761 of those for 2010). To put that in perspective, the entire Verizon-USSS dataset from 2004 to 2009numbered just over 900 breaches. We very nearly doubled the size of our dataset in 2010 alone!It is fascinating from a research standpoint that the all-time lowest amount of data loss occurred in the same year as the all-time highest amount of incidents investigated. In addition to being the largest caseload ever, it was also extremely diverse inthe threat agents, threat actions, aected assets, and security attributes involved. We witnessed highly automated and prolicexternal attacks, low and slow attacks, intricate internal fraud rings, country-wide device tampering schemes, cunning socialengineering plots, and much more. Some of the raw statistics may seem to contradict this claim of diversity (e.g., the percentof breaches attributed to external agents is more lopsided than ever), but one must consider the change in scale. Whereas“10%” used to mean approximately 10-15 breaches across an annual caseload averaging 100-150, it now means 75 breachesin the context of the 2010 caseload. Consider that fact as you digest and ponder results from this year’s report.With the addition of Verizon’s 2010 caseload and data contributed from the USSS and NHTCU, the DBIR series now spans7 years, 1700+ breaches, and over 900 million compromised records. We continue to learn a great deal from this ongoingstudy and we’re glad to have the opportunity once again to share these ndings with you. As always, our goal is that the dataand analysis presented in this report prove helpful to the planning and security eorts of our readers. As usual, we begin witha few highlights below.
Who is behind data breaches?
92
%
stemmed from external agents (
+22%
)If you’ve followed these numbers over the years, you may bethinking we change our position more than a professionalcontortionist We’ll admit to a fair share of head scratchingamong the RISK team as we tried to interpret what they weretelling us In 2009, breaches involving insiders shot up due toincorporating the USSS data, but returned again to pre-USSSlevels in 2010 (even though they’re still with us) Read thereport for the full scoop on this, but it basically boils down toa HUGE increase in smaller external attacks rather than adecrease in insider activity Oh, and partner-caused breachescontinued their steady decline
17
%
implicated insiders (
-31%
)
<1
%
resulted from business partners (
-10%
)
9
%
involved multiple parties (
-18%
)
Search History:
Result 00 of 00
00 results for result for
p.
Verizon Data Breach 2011
U.S. Secret Service investigation reveals thieves increasingly use physical skimmers on ATMs to steal money from bank accounts. See pages 40-41 of report.
917
Reads
0
Readcasts
0
Embed Views
Get Scribd Mobile
To get Scribd mobile enter your number and we'll send you a link to the Scribd app for iPhone & Android.We've sent a link to the Scribd app. If you didn't receive it, try again.
We'll never share your phone number.
More From This User
Notes
Load more
