Top Banner
2015 Data Breach Investigations Report Suzanne Widup
48

Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Aug 20, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

2015 Data Breach Investigations Report

Suzanne Widup

Page 2: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

2015 DBIR

Page 3: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

http://www.veriscommunity.net

Actor – Who did it?

Action – How’d they do it?

Asset – What was affected?

Attribute – How was it affected?

Vocabulary for Event Recording and Incident Sharing (VERIS) is an open framework designed to provide a common language for describing security incidents (or threats) in a structured and repeatable manner.

The VERIS Framework

Page 4: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

VERIS Community Site – JSON Schema – All VERIS definitions – Case examples from popular

movies

http://www.veriscommunity.net

GitHub Repository – Over 5,00 publicly disclosed

data breaches, and growing – Coded using VERIS – Available as JSON files – Includes URL references to

incidents

VERIS in Action

http://www.vcdb.org

Page 5: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Publicly Disclosed Data Breaches

http://vcdb.org/explore.html

Page 6: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

VCDB.org – Be a Security Super hero!

We need volunteers to help • Find data breach articles • Code articles into VERIS

format

Page 7: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

DBIR Overview

Page 8: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Incidents vs Breaches

Page 9: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Which industries exhibit similar threat profiles?

Page 10: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Healthcare

Page 11: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Breach Trends

Threat Actors

External

Internal

Page 12: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Breach Trends

Credentials

RAM Scrapers

Spyware/Keyloggers

Phishing

Threat Actions Significant threat actions over time by percent

Page 13: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Overall trends are still pretty depressing

Smallest detection deficit on

record

Time to compromise

Time to discovery

The Detection Deficit

Page 14: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Smallest detection deficit on

record

Discovery Timeline

Page 15: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Breach Impact

Page 16: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Groundbreaking Research by Verizon

We analyzed real cyber-claims data from nearly 200 incidents and developed a new breach impact estimation model that goes

beyond simple cost-per-record average formulas.

The Impact of Breaches

Page 17: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Our model – using only record counts – describes over 50% of the reasons that make up the cost of a breach and we are working on developing the model further with key

insurance partners with the goal of publishing an academic paper on it this year.

The Impact of Breaches

Page 18: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

The Impact of Breaches In the beginning, there was record count

Page 19: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

The Impact of Breaches

Ponemon model Log-log regression model

$0.58 per record model

Page 20: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Estimate of Impact

Page 21: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Impact

.

Verizon Breach Impact Model

Page 22: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

The Incident Patterns

Page 23: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

The Nefarious Nine 96% of all incidents could be described with these 9 patterns

Page 24: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Just the Breaches, Ma’am 96% of all incidents could be described with these 9 patterns

Page 25: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

All Incidents (Graphics are Fun)

Web Apps

Priv Misuse

Point of Sale

Skimmers

Errors

Lost/Stolen

Crimeware

Page 26: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Just Breaches (Graphics are Really Fun)

Errors

Web Apps

Misuse

Point of Sale

Skimmers Lost/Stolen

Crimeware

Espionage

Page 27: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Pew pew pew!!!

Web Apps

Misuse

Point of Sale

Skimmers

Errors

Lost/Stolen

Crimeware

Espionage

Page 28: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Impact

.

Actors and the Nine Patterns

Page 29: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Impact

.

Breaches by Industry

Page 30: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Point of Sale Industries Most Affected

Accommodation, Entertainment, Retail

Page 31: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Crimeware Industries Most Affected

Public, Finance, Mfg, Educational

Page 32: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Cyber-espionage Industries Most Affected

Manufacturing, Public, Professional

Page 33: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Insider and Privilege Misuse Industries Most Affected

Mining, Administrative, Healthcare, Other Services

Page 34: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Web App Attacks Industries Most Affected

Information, Finance, and Administrative

Page 35: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Miscellaneous Errors Industries Most Affected

Healthcare, Administrative, Educational

Page 36: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Lost/Stolen Devices Industries Most Affected

Public Sector, Healthcare and Financial Services

15% of incidents still take days to discover. Ensure your process for reporting lost and stolen devices is

easy to follow and incentivize your employees to report these incidents quickly

Page 37: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Payment Card Skimmers Industries Most Affected

Finance and Retail

Page 38: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Denial of Service Industries Most Affected

Public Sector, Retail and Financial Services

Page 39: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Before and Beyond the Breach

Page 40: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Threat Intelligence

(Indicators of Compromise)

Looked at over time, major public threat feeds have less than 3% overlap across all of them.

Enterprises either need to use all the feeds from

all the providers (impossible) or implement intelligent & targeted application of the feeds.

Page 41: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Threat Intelligence (Indicators of Compromise)

75% of attacks spread from Victim 0 to Victim 1 within one day (24 hours), meaning we need to close the gap between sharing

speed and attack speed

Page 42: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Phishing

150,000 phishing e-mails analyzed from

campaigns by two DBIR partners.

23% of recipients open phishing messages. 11% of recipients click on attachments.

82 seconds from start of campaign to first bite.

Page 43: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

200 million+ successful exploitations across 500+ vulnerabilities

from over 20,000 enterprises in more than 150 countries All About the Vulns

10 CVEs account for 97% of the exploits seen in 2014

Page 44: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

From Pub to Pwn

Page 45: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Mobile Malware Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets)

Virtually NO iOS (iPhone) malware detected (i.e. Android “wins”)

Page 46: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Incident Patterns

CSC Description Percentage Category

13-7 2FA 24% Visibility/Attribution

6-1 Patching Web Services 24% Quick Win

11-5 Verify need for Internet-facing devices 7% Visibility/Attribution

13-6 Proxy outbound traffic 7% Visibility/Attribution

6-4 Web application testing 7% Visibility/Attribution

16-9 User lockout after multiple failed attempts 5% Quick Win

17-13 Block known file xfer sites 5% Advanced

5-5 Mail attachment filtering 5% Quick Win

11-1 Limiting ports and services 2% Quick Win

13-10 Segregation of Networks 2% Configuration/Hygiene

16-8 Password complexity 2% Visibility/Attribution

3-3 Restrict ability to download s/w 2% Quick Win

5-1 Anti-virus 2% Quick Win

6-8 Vet security process of vendor 2% Configuration/Hygiene

Page 47: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

• Download DBIR – www.verizonenterprise.com/dbir • Learn about VERIS - www.veriscommunity.net and

http://github.com/vz-risk/veris

• Explore the VERIS Community Database: http://www.vcdb.org • Ask a question – [email protected]

• Read our blog - http://www.verizonenterprise.com/security/blog/

• Follow on Twitter - @vzdbir and hashtag #dbir

Additional Information

http://www.verizonenterprise.com/dbir
http://www.veriscommunity.net/
http://github.com/vz-risk/veris
http://github.com/vz-risk/veris
http://github.com/vz-risk/veris
http://www.vcdb.org/
mailto:[email protected]
http://www.verizonenterprise.com/security/blog/
Page 48: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

2015 Data Breach Investigations Report

Email: [email protected] Twitter: @SuzanneWidup


Related Documents
Metamorphic Malware 1 Metamorphic Malware Research.

Metamorphic Malware 1 Metamorphic Malware Research.

Category: Documents
Reversing malware analysis training part8 malware memory forensics

Reversing malware analysis training part8 malware memory...

Category: Technology
Advanced malware analysis training session6 malware sandbox analysis

Advanced malware analysis training session6 malware sandbox....

Category: Technology
Analisis dan Deteksi Malware Menggunakan Metode Malware ...

Analisis dan Deteksi Malware Menggunakan Metode Malware ...

Category: Documents
Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z....

Category: Documents
Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware...

Category: Documents
Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

Introduction to Mobile Malware. Outline ➢ Introduction ➢...

Category: Documents
Malware in IEEE 802.11 Wireless Networks

Malware in IEEE 802.11 Wireless Networks

Category: Documents
An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

An Introduction To Keyloggers, RATS And Malware€¦ ·...

Category: Documents
Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Malware - Northern Kentucky University · Malware...

Category: Documents
Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”.

Malware, Malware y más Malware ¿Cómo me puedo proteger?.....

Category: Documents
Modelling the Spread of Botnet Malware in IoT-Based ...downloads.hindawi.com/journals/scn/2019/3745619.pdf · Modelling the Spread of Botnet Malware in IoT-Based Wireless Sensor Networks

Modelling the Spread of Botnet Malware in IoT-Based...

Category: Documents