Report shows more insiders involved in cyber crime

Organised criminal groups were behind the majority of last year's cbyer thefts

The 2010 Verizon Data Breach Investigations report, based partly on information provided by the US Secret Service, has found that data breaches in 2009 involved more insider threats, greater use of social engineering and the continued strong involvement of organised criminal groups.

Stolen credentials were the most common way of gaining unauthorised access to organisations last year, highlighting insufficient security practices for individuals and organisations. Organised criminal groups were responsible for 85 per cent of all stolen data last year, the report said.

It also stated that most breaches could have been avoided if basic security measures had been in place. Only four per cent of breaches required difficult and expensive protective measures.

Matthijs van der Wel, managing principal for the forensics team at Verizon, explained how an organisation can detect breaches.

"You find the breaches in the log files," said van der Wel. "Typically where there's a data breach, the number of log lines in the file increases significantly. Or the log lines themselves get much longer, [showing that] someone is attempting an SQL injection."

An SQL or sequel injection occurs when someone maliciously inputs a command into a webform, which could ask the database for a list of usernames and passwords. A poorly written webform will send this command directly to the database where it will be executed.

Van der Wel had the following advice for organisations looking to secure their data from attack:

• Restrict and monitor privileged users. They should only have access to information where there is a business need. Criminals are increasingly using privileged user information in their attacks, which is hard to trace.
• Take minor policy violations seriously. Typically in a serious case of insider cyber theft, the insider has a long history of minor violations. This can lead to more serious crimes.
• Be efficient in removing access privileges from accounts which have been compromised, or where the user has left.
• Consider newer technology. There is no reason to be working with usernames and passwords in 2010. Two-factor authentication offers a more secure alternative for sensitive information.