Verizon Breach Shows How No One Is Immune from an Attack

Study Pinpoints IT Security’s Top Data Security Concerns

Everyone is susceptible to a data breach, even the companies that provide the rest of us with warnings and advice about why and how breaches happen and what we should be doing to better protect ourselves.

The Verizon Data Breach Investigations Report is perhaps the most thorough examination of cyber threats conducted each year. I know I refer to it over and over again. When I first started getting emails about the Verizon breach, I honestly thought it was about this year’s report. I was wrong. These alerts were about an attack on Verizon Enterprise Solutions that compromised approximately 1.5 million customers. According to eWeek:

Attackers used a flaw in the company’s Web portal for enterprise customers to steal data on its clients, Verizon said. . . . While Verizon did not confirm that 1.5 million customers were impacted, a spokesperson stressed that consumer data was not part of the breach.

According to Brian Krebs, who broke the story, the information was being sold for $100,000 for the entire package or $10,000 for chunks of 100,000 records. The records were contact information of enterprise customers which, as Dodi Glenn, vice president of cyber security at PC Pitstop told me in an email comment, is considered a lot less valuable than customer proprietary network information. However, Glenn added this thought:

… this should be a concern for many, since the breach happened to a company that is known for helping out other companies during data breaches. Additionally, a lot of Fortune 500 companies use Verizon Enterprise Solutions – makes you wonder if some of those who purchased the data may have plans to use the information to start phishing attacks, since it contains information from companies with lots of money.

Chris Wysopal, CTO with Veracode, told me via email that the Verizon breach is a good example of why application security needs to be a priority, especially managing the web perimeter, as this is almost always the easiest way to gain access to a company. Wysopal added:

The issue for most companies is the lack of insight into how large their perimeter actually is. In fact, over the last two years, we’ve found more than 350,000 websites that our customers didn’t even know they owned. Most companies have a very difficult time managing this issue as it generally falls somewhere between the web team, marketing, regional teams and the security team … and that basically means no one is looking after it.

This breach goes to show that no matter how aware you are, your data and network are always at some risk. Bad guys are good at finding their way in if you leave your guard down just the smallest bit.

Sue Marquette Poremba has been writing about network security since 2008. In addition to her coverage of security issues for IT Business Edge, her security articles have been published at various sites such as Forbes, Midsize Insider and Tom’s Guide. You can reach Sue via Twitter: @sueporemba