internet security tHreAt rePOrt GOVernMent 2013

p. 17
Symantec Corporation
Internet Security Threat Report 2013 :: Volume 18
TaRgETEd aTTaCkS, haCkTIVISM, aNd daTa bREaChES
Targeted attack Recipients by Role in 2012
Source: Symantec
2011
2012 % CHANGE
Chief Exec. or Board Level
PR and Marketing
Personal Assistant
Research & Development
Human Resources
Sales
Senior Management
Shared Mailbox
info@, sales@, etc.
DDoS Used as a Diversion
-15% -10% -5 0 5 10 15 20 25 30%
In September, the FBI issued a warning to financial institutions
that some DDoS attacks are actually being used as a “distraction.”
These attacks are launched before or after cybercriminals engage
in an unauthorized transaction and are an attempt to avoid
discovery of the fraud and prevent attempts to stop it.
In these scenarios, attackers target a company’s website with
a DDoS attack. They may or may not bring the website down,
but that’s not the main focus of such an attack; the real goal is
to divert the attention of the company’s IT staff towards the
DDoS attack. Meanwhile, the hackers attempt to break into the
company’s network using any number of other methods that may
go unnoticed as the DDoS attack continues in the background. 5
Data Breaches
The overall number of data breaches is down by 26 percent,
according to the Norton Cybercrime Index, 6 though over 93
million identities were exposed during the year, a decrease of 60
percent over last year. The average number of identities stolen
is also down this year: at 604,826 per breach, this is significantly
smaller than the 1.1 million per breach in 2011.
In 2012, the most frequently
targeted job role was in R&D,
which accounted for 27
percent of attacks (9 percent
in 2011). The second most
notable increase was against
sales representatives, probably
because their contact details
are more widely available in the
public domain, with 24 percent
of attacks in 2012 versus 12
percent in 2011. In 2011,
C-level executives were the most
targeted, with 25 percent, but
this number fell to 17 percent
in 2012.
So why are the number of breaches and identities stolen down in
2012? For starters, there were five attacks in which more than 10
million identities were stolen in 2011. In 2012 there was only one,
which results in a much smaller spread from the smallest to the
largest data breach. However, the median number—the midpoint
of the data set—increased by 3.5 times in 2012, from 2,400 to
8,350 per breach. Using the median is a useful measure because
it ignores the extremes, the rare events that resulted in large
numbers of identities being exposed, and is more representative
of the underlying trend.
Part of the wide difference between data breaches in 2011 and
2012 is likely down due to a concerted effort by the notorious
hacker groups Anonymous and LulzSec to publicize hacks
during 2011—something that was not seen to the same extent in
2012. It’s possible that companies are paying more attention to
protecting customer databases or that hackers have found other,
more valuable targets, or that they are still stealing the data but
not being detected.