The Verizon 2014 Data Breach Investigations Report

• For the whole 60 page report, you can find it here –> http://www.verizonenterprise.com/DBIR/2014/reports/rp_Verizon-DBIR-2014_en_xg.pdf.
• For the 8 page Executive Summary, you can find it here –> http://www.verizonenterprise.com/DBIR/2014/reports/rp_dbir-2014-executive-summary_en_xg.pdf

There are seven common themes:

1. Be vigilant. Organizations often only find out about security breaches when they get a call from the police or a customer. Log files and change management systems can give you early warning.
2. Make your people your first line of defense. Teach staff about the importance of security, how to spot the signs of an attack, and what to do when they see something suspicious.
3. Keep data on a ‘need to know basis’. Limit access to the systems staff need to do their jobs. And make sure that you have processes in place to revoke access when people change role or leave.
4. Patch promptly. Attackers often gain access using the simplest attack methods, ones that you could guard against simply with a well-configured IT environment and up-to-date anti-virus.
5. Encrypt sensitive data. Then if data is lost or stolen, it’s much harder for a criminal to use.
6. Use two-factor authentication. This won’t reduce the risk of passwords being stolen, but it can limit the damage that can be done with lost or stolen credentials.
7. Don’t forget physical security. Not all data thefts happen online. Criminals will tamper with computers or payment terminals or steal boxes of printouts.

I highly recommend the Executive Summary if you don’t have time for the whole report. Again, it is here http://www.verizonenterprise.com/DBIR/2014/reports/rp_dbir-2014-executive-summary_en_xg.pdf.