Newsletter Sign-up

That's the message from security technology company McAfee Inc. in a report released in August.

"Cybercriminals prosper because they have very little reason to fear the consequences," said Jeff Green, senior vice president of McAfee Labs.

As Wade Baker, one of the authors of Verizon's study, wrote on his blog: "We're big proponents of the belief that you can't manage what you can't measure and so are always looking for better ways to measure factors critical to managing security."

The McAfee report is based on strategies compiled by international experts.

Some recommendations from McAfee include:

-- Use hacker techniques: Data loss is accelerating at an alarming rate, as there were 222 million records lost in 2009 in the United States. Organizations should use hacker techniques such as fuzzing (a form of fault testing) and penetration testing to find bugs within their own products and address the issues.

-- Provide data to help prosecute cybercriminals: A major component for combating spam lies in the hands of ICANN (the Internet Corporation for Assigned Names and Numbers), as it accredits the registrants that sell the domains used by cybercriminals to host malicious sites. Working with the security industry, ICANN should take a stronger stance against cybercrime.

-- Share information with trusted security vendor. In turn the security vendors should cooperate in live metadata sharing. Legislators should take these issues into account when drafting laws within their respective countries.

The Verizon report, meanwhile, provides a look at data breaches in 2009 and for the first time includes data from the United States Secret Service.

Some findings include:

-- The majority of breaches and almost all data stolen in 2009 were still the work of outside criminals. The report showed 70 percent resulted from external agents, while 48 percent were caused by insiders.

-- Breaches occur as a result of privilege misuse, hacking and malware. Hacking and malware were responsible for more than 95 percent of all data compromised. Cases involving the use of social tactics more than doubled.

-- Financial institutions, hospitality and retail remained the key targets, with 33 percent, 23 percent and 15 percent of the breaches, respectively.

-- The largest and smallest companies had the fewest breaches. Companies with more than 100,000 employees had only 2 percent of the breaches and companies with one to 10 employees had just 9 percent. The middle segment, with 11 to 100,000 employees, was the most vulnerable.

Both reports provide the information security people with a lot of food for thought.

"If we want to stop being victims, then the good guys need to advance security efforts as threats evolve," said David Marcus, director of security research and communications for McAfee Labs.

PATRICIA VOWINKEL has worked for national media outlets for more than 20 years.

October 1, 2010

Copyright 2010© LRP Publications