Verizon’s Annual DBIR and Data Breach Digest

March 2016 – At the 2016 RSA Conference in San Francisco, Verizon held their annual briefing to announce the release of their DBIR (Data Breach Investigations Report). The DBIR release has actually been pushed out a few months, and instead, they released the first Data Breach Digest (DBD). The Digest is essentially, a first hand look at cyber investigations from the perspective of the Verizon RISK Team based on the case files and the perspective of the people involved, taken from incidents in the field. The team has been busy, and in 2015 they were retained to investigate more than 500 cybersecurity incidents that took place in over 40 countries.

The digest covers the 12 dominant breach scenarios that were common over 60% of the 1175 cases that were investigated over a 3 year period. While on the victim side of the incidents, they may all seem unique, there is actually quite a bit of commonality in the attacks. The digest is kind of a “book of monsters” that puts a face and actions together with a name to define the call and type of breach. The digest contains a story that best exemplifies the scenario.

In order to explain the incidents in a concise and repeatable manner, the report and digest refer to the technical details in VERIS, the Vocabulary for Event Recording and Incident Sharing. The VERIS system provides a common language for describing security incidents. Verizon has released VERIS for free public use in order to promote the tracking and sharing of security incidents.

Following the release of the DBD (available at http://www.verizonenterprise.com/verizon-insights/data-breach-digest/2016/ ) there was a panel discussion of experts from Deloitte, Splunk, Secret Service, Cummins Engines, and a principle in a Law Firm. The opening topic was – How do we know we are doing better? The security issue is not just a CSO issue, it is systems through the whole business operation that are affected and impacted. Simulations and wargame are not enough anymore, metrics and incident planning are essential.

A second point of discussion was the use of scaremongering , resource accountability and liability as metrics for cybersecurity and breach protection. To determine who well a system is working, forensics and in-progress diagnostics are required to be part of the main flow.