• Home

  • Documents

  • Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware...
48
2015 Data Breach Investigations Report Suzanne Widup

Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

  • Upload
    others

  • View
    0

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

2015 Data Breach Investigations Report

Suzanne Widup

Page 2: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

2015 DBIR

Page 3: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

http://www.veriscommunity.net

Actor – Who did it?

Action – How’d they do it?

Asset – What was affected?

Attribute – How was it affected?

Vocabulary for Event Recording and Incident Sharing (VERIS) is an open framework designed to provide a common language for describing security incidents (or threats) in a structured and repeatable manner.

The VERIS Framework

Page 4: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

VERIS Community Site – JSON Schema – All VERIS definitions – Case examples from popular

movies

http://www.veriscommunity.net

GitHub Repository – Over 5,00 publicly disclosed

data breaches, and growing – Coded using VERIS – Available as JSON files – Includes URL references to

incidents

VERIS in Action

http://www.vcdb.org

Page 5: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Publicly Disclosed Data Breaches

http://vcdb.org/explore.html

Page 6: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

VCDB.org – Be a Security Super hero!

We need volunteers to help • Find data breach articles • Code articles into VERIS

format

Page 7: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

DBIR Overview

Page 8: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Incidents vs Breaches

Page 9: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Which industries exhibit similar threat profiles?

Page 10: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Healthcare

Page 11: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Breach Trends

Threat Actors

External

Internal

Page 12: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Breach Trends

Credentials

RAM Scrapers

Spyware/Keyloggers

Phishing

Threat Actions Significant threat actions over time by percent

Page 13: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Overall trends are still pretty depressing

Smallest detection deficit on

record

Time to compromise

Time to discovery

The Detection Deficit

Page 14: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Smallest detection deficit on

record

Discovery Timeline

Page 15: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Breach Impact

Page 16: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Groundbreaking Research by Verizon

We analyzed real cyber-claims data from nearly 200 incidents and developed a new breach impact estimation model that goes

beyond simple cost-per-record average formulas.

The Impact of Breaches

Page 17: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Our model – using only record counts – describes over 50% of the reasons that make up the cost of a breach and we are working on developing the model further with key

insurance partners with the goal of publishing an academic paper on it this year.

The Impact of Breaches

Page 18: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

The Impact of Breaches In the beginning, there was record count

Page 19: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

The Impact of Breaches

Ponemon model Log-log regression model

$0.58 per record model

Page 20: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Estimate of Impact

Page 21: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Impact

.

Verizon Breach Impact Model

Page 22: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

The Incident Patterns

Page 23: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

The Nefarious Nine 96% of all incidents could be described with these 9 patterns

Page 24: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Just the Breaches, Ma’am 96% of all incidents could be described with these 9 patterns

Page 25: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

All Incidents (Graphics are Fun)

Web Apps

Priv Misuse

Point of Sale

Skimmers

Errors

Lost/Stolen

Crimeware

Page 26: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Just Breaches (Graphics are Really Fun)

Errors

Web Apps

Misuse

Point of Sale

Skimmers Lost/Stolen

Crimeware

Espionage

Page 27: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Pew pew pew!!!

Web Apps

Misuse

Point of Sale

Skimmers

Errors

Lost/Stolen

Crimeware

Espionage

Page 28: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Impact

.

Actors and the Nine Patterns

Page 29: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Impact

.

Breaches by Industry

Page 30: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Point of Sale Industries Most Affected

Accommodation, Entertainment, Retail

Page 31: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Crimeware Industries Most Affected

Public, Finance, Mfg, Educational

Page 32: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Cyber-espionage Industries Most Affected

Manufacturing, Public, Professional

Page 33: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Insider and Privilege Misuse Industries Most Affected

Mining, Administrative, Healthcare, Other Services

Page 34: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Web App Attacks Industries Most Affected

Information, Finance, and Administrative

Page 35: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Miscellaneous Errors Industries Most Affected

Healthcare, Administrative, Educational

Page 36: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Lost/Stolen Devices Industries Most Affected

Public Sector, Healthcare and Financial Services

15% of incidents still take days to discover. Ensure your process for reporting lost and stolen devices is

easy to follow and incentivize your employees to report these incidents quickly

Page 37: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Payment Card Skimmers Industries Most Affected

Finance and Retail

Page 38: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Denial of Service Industries Most Affected

Public Sector, Retail and Financial Services

Page 39: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Before and Beyond the Breach

Page 40: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Threat Intelligence

(Indicators of Compromise)

Looked at over time, major public threat feeds have less than 3% overlap across all of them.

Enterprises either need to use all the feeds from

all the providers (impossible) or implement intelligent & targeted application of the feeds.

Page 41: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Threat Intelligence (Indicators of Compromise)

75% of attacks spread from Victim 0 to Victim 1 within one day (24 hours), meaning we need to close the gap between sharing

speed and attack speed

Page 42: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Phishing

150,000 phishing e-mails analyzed from

campaigns by two DBIR partners.

23% of recipients open phishing messages. 11% of recipients click on attachments.

82 seconds from start of campaign to first bite.

Page 43: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

200 million+ successful exploitations across 500+ vulnerabilities

from over 20,000 enterprises in more than 150 countries All About the Vulns

10 CVEs account for 97% of the exploits seen in 2014

Page 44: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

From Pub to Pwn

Page 45: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Mobile Malware Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets)

Virtually NO iOS (iPhone) malware detected (i.e. Android “wins”)

Page 46: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

Incident Patterns

CSC Description Percentage Category

13-7 2FA 24% Visibility/Attribution

6-1 Patching Web Services 24% Quick Win

11-5 Verify need for Internet-facing devices 7% Visibility/Attribution

13-6 Proxy outbound traffic 7% Visibility/Attribution

6-4 Web application testing 7% Visibility/Attribution

16-9 User lockout after multiple failed attempts 5% Quick Win

17-13 Block known file xfer sites 5% Advanced

5-5 Mail attachment filtering 5% Quick Win

11-1 Limiting ports and services 2% Quick Win

13-10 Segregation of Networks 2% Configuration/Hygiene

16-8 Password complexity 2% Visibility/Attribution

3-3 Restrict ability to download s/w 2% Quick Win

5-1 Anti-virus 2% Quick Win

6-8 Vet security process of vendor 2% Configuration/Hygiene

Page 47: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

• Download DBIR – www.verizonenterprise.com/dbir • Learn about VERIS - www.veriscommunity.net and

http://github.com/vz-risk/veris

• Explore the VERIS Community Database: http://www.vcdb.org • Ask a question – [email protected]

• Read our blog - http://www.verizonenterprise.com/security/blog/

• Follow on Twitter - @vzdbir and hashtag #dbir

Additional Information

http://www.verizonenterprise.com/dbir
http://www.veriscommunity.net/
http://github.com/vz-risk/veris
http://github.com/vz-risk/veris
http://github.com/vz-risk/veris
http://www.vcdb.org/
mailto:[email protected]
http://www.verizonenterprise.com/security/blog/
Page 48: Suzanne Widup - SNIA · Mobile Malware . Verizon Wireless gave us access to the logs of malware detections from tens of millions wireless devices (phones and tablets) Virtually NO

2015 Data Breach Investigations Report

Email: [email protected] Twitter: @SuzanneWidup


STUDYING MALWARE PROPAGATION IN WIRELESS SENSOR …cell-devs.sce.carleton.ca/publications/2020/AW20b/48_Paper.pdf · the authors model malware spreading in wireless networks. The

STUDYING MALWARE PROPAGATION IN WIRELESS SENSOR …cell-devs.sce.carleton.ca/publications/2020/AW20b/48_Paper.pdf · the authors model malware spreading in wireless networks. The

Documents
Malware & Anti-Malware

Malware & Anti-Malware

Engineering
Malware in IEEE 802.11 Wireless Networks

Malware in IEEE 802.11 Wireless Networks

Documents
Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Documents
Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Documents
Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents
Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Documents
Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Documents
Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”

Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”

Documents
Android Malware Exposed-Evolution of Android Malware

Android Malware Exposed-Evolution of Android Malware

Documents
Evaluating Open Source Malware Sandboxes with Linux malware

Evaluating Open Source Malware Sandboxes with Linux malware

Documents
Malware: A Criminal Force Malware: The Next Big Internet ...swetzel/malware/malware-all/aaas_all.pdf•FlexiSPY –Watch SMS/cell phone traffic –Remotely switch on microphone Wireless

Malware: A Criminal Force Malware: The Next Big Internet ...swetzel/malware/malware-all/aaas_all.pdf•FlexiSPY –Watch SMS/cell phone traffic –Remotely switch on microphone Wireless

Documents
Verizon DBIR 2015-Widup-5-20-2015 · 2015/5/20  · Verizon DBIR 2015 5/20/2015 Suzanne Widup, Verizon Enterprise Services 21 Threat Intelligence (Indicators of Compromise) Looked

Verizon DBIR 2015-Widup-5-20-2015 · 2015/5/20  · Verizon DBIR 2015 5/20/2015 Suzanne Widup, Verizon Enterprise Services 21 Threat Intelligence (Indicators of Compromise) Looked

Documents
Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Documents
Reversing malware analysis trainingpart9 advanced malware analysis

Reversing malware analysis trainingpart9 advanced malware analysis

Technology
Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Documents
Maximum Damage Malware Attack in Mobile Wireless Networks M.H.R Khouzani, Saswati Sarkar, Eitan Altman Present by Wayne Hsiao

Maximum Damage Malware Attack in Mobile Wireless Networks M.H.R Khouzani, Saswati Sarkar, Eitan Altman Present by Wayne Hsiao

Documents
An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Documents
Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Documents
Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Documents
Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 11: Malware Behavior

Education
Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Documents
THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Documents
Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Technology
The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Documents
Intrusion Detection and Malware Analysis - Malware collection

Intrusion Detection and Malware Analysis - Malware collection

Documents
Maximum Damage Malware Attack in Mobile Wireless Networks

Maximum Damage Malware Attack in Mobile Wireless Networks

Documents
Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Documents
Optimal Quarantining of Wireless Malware Through Reception ...swati/TACreceptiongain_cameraready.pdf · swati@seas.upenn.edu. E. Altman is with INRIA, the French national institute

Optimal Quarantining of Wireless Malware Through Reception ...swati/TACreceptiongain_cameraready.pdf · [email protected]. E. Altman is with INRIA, the French national institute

Documents
Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Documents