2011 Data Breach Investigations Report released
Wade BakerApril 19th, 2011
Here we are again – our fourth installment of the DBIR series (sixth if you count the ’08 and ’09 mid-year supplementals). To our readers, it may seem like the 2010 DBIR published ages ago. To us, it feels more like yesterday. The expanding scope and increasing depth of the report makes it almost one continuous effort throughout the year. It is, however, a labor of love and we’re very glad to be sharing our research into the world of data breaches with you once again.
We are also very glad to have the USSS back with us for the 2011 DBIR. Additionally, we have the pleasure of welcoming the NHTCU to the team. Through this cooperative effort, we had the privilege – and challenge – of examining about 800 new data compromise incidents since our last report. To put that in perspective, the entire Verizon-USSS dataset from 2004 to 2009 numbered just over 900 breaches. We very nearly doubled the size of our dataset in 2010 alone!
With the addition of Verizon’s 2010 caseload and data contributed from the USSS and NHTCU, the DBIR series now spans 7 years, 1700+ breaches, and over 900 million compromised records. We continue to learn a great deal from this ongoing study and we’re glad to have the opportunity once again to share these findings with you. As always, our goal is that the data and analysis presented in this report prove helpful to the planning and security efforts of our readers. We also hope you just enjoy reading it.
Tags: breach, Data Breach Report, Data Breaches, DBIR, incidents, security, VERIS
Awesome, frustrating, and surprising all at the same time. Great work once again.
So what are the “essential controls” that should be implemented “across the entire organization without exception”?
Posted by: Carl Weston on April 19th, 2011 at 5:10 pmCarl,
Thanks for the kind words.
That’s a big question. Which controls depend upon the situation. what we often find is that the org has a policy to do “x” and for the most part, they do it. Unfortunately, for the most part isn’t always good enough. The classic example of an “essential control” that is often neglected is changing default credentials. We’ve been citing this for several years now and everyone receives that like “duh – of course we do that.” However, the fact of the matter remains that it was the #1 method of intrusion in 2008, top 5 in 2009, and #1 in 2010. Taking these “no brainers” and making sure implemented with “no exceptions” can be monotonous and boring work, but we’ve come to believe it pays off.
Posted by: Wade Baker on April 22nd, 2011 at 3:14 am