Trustwave Report Reveals Global Data Breach And Security Trends
Trustwave SpiderLabs uncovers new attack targets, warns that franchises and chain stores most at risk
Trustwave, a leading provider of information security and compliance solutions, recently published the Trustwave 2012 Global Security Report, a reflection and analysis of investigations, research and client engagements conducted in 2011. The report's findings are based on more than 300 data breach investigations and 2,000 penetration tests performed worldwide last year by SpiderLabs, the advanced security team within Trustwave focused on forensics, ethical hacking and application security testing.
For the second year in a row, the report shows the food and beverage industry is the top target for cybercriminals. Additionally, more than a third of Trustwave SpiderLabs 2011 investigations occurred in afranchise business, and Trustwave researchers expect industries with franchise models will be most at risk in 2012. The report also unveils surprising findings about the most common password used by global businesses and the riskiest time of day to open an email attachment.
"We believe the Trustwave Global Security Report is the most comprehensive report on cybercrime and data breach trends, new and evolving threats, and recommendations of best security practices for organizations," said Nicholas J. Percoco, senior vice president and head of Trustwave SpiderLabs. "In 2011, we performed 42 percent more data breach investigations and assembled a thorough study on business password practices. The information we have gathered highlights security trends and risks that businesses should address in 2012."
Key Report Findings
Customer records remain a valuable target for attackers, making up 89 percent of breached data investigated. While trade secrets or intellectual property followed at a distant six percent, highly targeted attacks designed to go after that type of data remain a growing concern, as their success rate is extremely high.
Top Strategic Security Recommendations for 2012
To improve security posture, Trustwave recommends six focus areas for organizations in 2012:
- Education of Employees – The best intrusion detection systems are neither security experts nor expensive technology, but employees. Security awareness education for employees is the first line of defense.
- Identification of Users – Focus on achieving a state where every user-initiated action in your environment is identifiable and tagged to a specific person.
- Homogenization of Hardware and Software – Fragmentation of enterprises' computing platforms is an enemy to security. Reducing fragmentation through standardization of hardware and software, and decommissioning old systems, will create a more homogenous environment that is easier to manage, maintain and secure.
- Registration of Assets –A complete inventory or registry of valid assets can provide the insight needed to identify malware or a malicious attack.
- Unification of Activity Logs – Combining the physical world with the digital affords organizations with new ways to combine activities and logs to identify security events more quickly.
- Visualization of Events – Log reviews alone are no longer sufficient. Visualizing methods to identify security events within the organization better narrows security gaps.
"Any organization can be a target, but as detailed in our report findings, those most susceptible are businesses that maintaincustomer records or that consumers frequent most, including restaurants, retail stores and hotels," added Percoco. "We advise organizations review our strategic recommendations for 2012 and take steps toward employing better security across their organizations."
Download a complimentary copy of the Trustwave 2012 Global Security Report at: https://www.trustwave.com/GSR.
The Trustwave 2012 Global Security Report features data correlations and analysis from numerous sources including the results of more than 300 incident response and forensic investigations and analysis of more than 2,000 manual penetration tests globally. The report also includes trends from 16 billion emails analyzed from 2008 to 2011, and data from more than one million network and application vulnerability scans. To view a complete list of sources, see the full report.
Trustwave is a leading provider of on-demand and subscription-based information security and payment card industry compliance management solutions to businesses and government entities throughout the world. For organizations faced with today's challenging data security and compliance environment, Trustwave provides a unique approach with comprehensive solutions that include its flagship TrustKeeper compliance management software and other proprietary security solutions including SIEM, WAF, EV SSL certificates and secure digital certificates. Trustwave has helped hundreds of thousands of organizations-ranging from Fortune 500 businesses and large financial institutions to small and medium-sized retailers-manage compliance and secure their network infrastructures, data communications and critical information assets. Trustwave is headquartered in Chicago with offices throughout North America, South America, Europe, Africa, Asia and Australia. For more information, visit https://www.trustwave.com.