DBIR 2014 significance?

Hello everyone,

Just a short post on the Verizon Data Breach Investigation Report 2014.  Verizon has done an exceptional job at improving the overall content of their report from the volume side of the house and make no exception the report captures client and other added cohort details.

So what pressing in Verizon's 2014 report?  Why read it, why bother and what's the significance.  The report is chock filled with numerous charts of the garden variety trying to tell the breach story and what some may say is the "same old story".  Just more Verizon investigation numbers added to the base.  

If you just landed on earth and were concerned about security and then focused in on cyber security you might want to scratch your head.  Why?  Well, frankly Verizon has been publishing what some say is in theory the same report year over year (different numbers, greater volume, prettier charts, greater diversity)  but all in all, the same report.

At the end of the day we turned to the recommendations of the report and find that if we looked back five or ten ago nothing much has changed.  

So for 2014 our advice is to look back at the 2009 or 2004 reports and follow the security advice....if for some reason you can't follow the advice, wait another five to ten years and trust me, you'll be hearing the same thing all over again.

For 2014 a ho hum report, pretty cover, nice charts but significance is lost unless your head has been buried in the sand.  In that case, its time to wake up - read and follow the recommendations.  Here are   some classic recommendations, if you see something new and astonishing let me know:

The DBIR is packed with more detailed information and recommendations. But seven common themes are clear:
• Be vigilant.  Organizations often only find out about security
breaches when they get a call from the police or a customer. Log
files and change management systems can give you early warning.

• Make your people your first line of defense.Teach staff about the
  importance of security, how to spot the signs of an attack, and
  what to do when they see something suspicious.
  
• Keep data on a‘need to know basis’. Limit access to the systems
  staff need to do their jobs. And make sure that you have processes
  in place to revoke access when people change role or leave.
  
• Patch promptly. Attackers often gain access using the simplest
  attack methods, ones that you could guard against simply with a
  well-configured IT environment and up-to-date anti-virus.
  
• Encrypt sensitive data.Then if data is lost or stolen, it’s much
  harder for a criminal to use.
  
• Use two-factor authentication.  This won’t reduce the risk of
  passwords being stolen, but it can limit the damage that can be
  done with lost or stolen credentials.
  
• Don’t forget physical security.  Not all data thefts happen online.
  Criminals will tamper with computers or payment terminals or steal boxes of printouts. 

Let me know your thoughts, but it seems like nothing much has changed and next years we'll be reading about more breaches.

More reading>>>>>>>

http://www.csoonline.com/article/2157453/data-protection/needed-detection-correction.html