The recent report provided by Verizon, “Data Breach Investigation Report – 2014” gives us a lot of useful and very clear analysis of data breaches that occurred in 2013.
It goes without saying that it is a report based on what could be collected from organizations, meaning that it does not represent the reality, but it seems to be very close to it, if we consider the very large amount of data that has been collected.
One key point of this report is that 94% of data breaches that occurred in 2013 can be described by only 9 patterns. And guess what, the number #1 pattern, with 35% is Web Application Attacks.
Other patterns are POS intrusions, Insider Misuse, Physical theft/loss, Miscellaneous errors, Crimeware, Card skimmers, DoS attacks, cyber-espionage.
If we look at how things evolve over time, we see that, unfortunately, the percent of web application attacks as a vector is growing.
The reason why web applications attacks is the number one vector might seem obvious: web applications can be target from anywhere, a lot of companies have web applications, and the vast majority of them is vulnerable.
One other key output of the report is the frequency of incident classification patterns per victim industry.
Because all industries do not necessarily rely on web applications in their business and because all industries do not attract attackers as much as some others do, web application attacks are not always the number one pattern.
As we can see here, in some industries web app attacks are the vector in more than one third of reported incidents, and some other industries do not face any web app attack.
What is your industry?