Most Businesses Unaware Of Data Breach, Survey Warns

Most enterprises lack visibility into their IT environments, after an analysis of data breaches by Trustwave found that just 9 percent of breaches were uncovered internally by the companies themselves.

According to the study of more than 200 data breaches that occurred in 2009, Trustwave found that the vast majority (80 percent) were actually discovered by credit card companies with access to the breached organisation’s data. According to security pros, the reasons for this vary, but it comes down to the ability of businesses to understand and correlate the massive amounts of data at their fingertips.

The Trustwave study echoes the findings of Verizon’s “2009 Data Breach Investigations Report,” which reported roughly 70 percent of breaches were found by third parties. To Avivah Litan, an analyst with Gartner, credit card companies have the most incentive to uncover breaches because if financial information is stolen, they are often the ones that get stuck with the bill.

“When there is a breach against the retailer or processor, they don’t suffer direct losses; they only suffer losses after the card companies discover who they are and then force them to pay them back,” Litan said.

Still, cyber-criminals are clever, and many pieces of malware continue to slip by enterprise radars, she said.

“There are too many false-positives in the system, so they don’t get noticed,” she said, adding that the analytical and predictive modeling capabilities of many intrusion prevention, database monitoring and security information event management tools are weak. “It’s kind of like when alarms go off in the parking lot. People just say, ‘Ah it’s another alarm.’ … The vendors in the security area have a lot to learn from the financial services vendors, mainly the fraud detection vendors. They are many, many years ahead in terms of predictive modelling and scoring.”

Dwayne Melancon, vice president of strategy for Tripwire, agreed that enterprises have such a large volume of data to grapple with that it can be hard to know what to pay attention to in terms of risk. In addition, many businesses operate without automated, policy-based security controls and lack the ability to enforce configuration standards they decide upon.

“That means they are relying on ‘a guy paying attention,’ which is not consistent or scalable, and will inevitably lead to undetected security issues,” he said. “There are best known methods for securing most IT assets, but many organisations are not employing these best known methods, operate with no documented configuration standards, and/or have no means to systematically evaluate their configurations against those standards. The result is lots of configuration variance, which increases risk, increases management costs and decreases security effectiveness.”