2024 Verizon Data Breach Investigation Report [pdf]
verizon.com
verizon.com
It does not include the vast majority of breaches that happen every year and are reported to federal and state regulatory bodies or as posted to cybercrime / ransomware sites.
One of the coolest things is that this process though flawed is transparent and semi-open to the public.
The dataset and the underlying process for which events are selected takes place in the open on GitHub.
Kudos to their commitment to open source.
From the title, it seemed that Verizon had published a postmortem of a recent data breach incident they had
https://web.archive.org/web/20240504053821/https://www.veriz...
I wonder if the do some kind of DCMA thing automatically for urls on their website, to have them removed from the wayback machine?
DCMA would not work here since they are hosting a copy of it for archival purposes, and not claiming copyright. The original public URL is included.
Archive.org does respect robots.txt tho. It is possible to completely delete a site's history on Archive.org by modifying the robots.txt (at least in the past, not sure if that is the case now)
So the link really does seem to have flip-flopped between working and non-working a few times.
Sound like some kind of weirdness in the archive.org infrastructure might be causing it.
Well, I'm cancelling my services with them. This is disgusting.
Won't do much but make me feel better, and save money. With the internet I never use my phone. Time to deal with the liability I guess.
It could be considered situational irony for a company reporting on industry data breaches to expect readers to disclose personal information as one would expect them to display sensitivity to unnecessary capture of precisely this kind of data.
Please at least click the link before making snarky comments or your snarky comments will be misinformed.
https://www.verizon.com/about/news/2024-data-breach-investig...
Page 11: "Hello, friends, and welcome to the “Results and analysis” section."
Page 15: "Hey, you, don’t skip this section this year! We know we keep repeating, “It’s always external criminals wanting your money” alongside dated pop culture references, but we have some interesting data points to discuss this year. Does this mean External actors are not the most prevalent? No, of course they are, silly. But since we got your attention, please read on."
Page 37: "In the cybersecurity world, or “the cyber biz,” as we call it, we certainly love our catchy terminology. Terms such as whaling, smishing, quishing, tishing, vishing, wishing, pharming, snowshoeing and plain old phishing are ever-present in the Social Engineering pattern. This makes sense because there are a lot of vectors on which we need to educate our employees and end users, and we’re positive that in another five years, there will be new ones that we will have to add to our list."
As someone who works in the "cyber biz", I don't think we really do like all of these supposedly catchy terms that are just more specific ways to describe the same thing. All it does is confuse end users with more jargon.
I worked for a large telco for many years with a lot of history and people honestly hated the company, even if they came in store and had a flawless experience many of them couldn't be curbed.
You have everyday people using mobile and internet services that operate in the background that impact people heavily if they go down or their experience is poor. Then the process for them to get it remediated is speaking with service staff that often don't have the ability to actually fix the problem if it is infrastructure related.
Especially when internet services and speeds around a decade ago were/are struggling to keep up with basic internet usage.
As an employee I had gone above and beyond for many customers and had experienced some crazy stories where the customer was simply horrible.
Until then, it's a great way to squeeze crypto out of some company to make up for the fact that your country is under sanctions tied to the US Dollar, and since it's hard to prove to the bean counters that an attack will happen with reasonable certainty on a given system in the next quarter, good luck getting resources and priority for mitigations beyond the usual.
False.
Companies are now liable to report breaches to the SEC and steps taken to remediate.
As I've mentioned several times on HN before, heads do roll and C-Suite does care about security posture now that liability and insurance payouts are on the line.
The annoying thing is HNers will never see the actual successes (because these are obviously kept private) and only see a couple glaring failures.
Furthermore, this report is an advertisement for Verizon's MSSP division (Verizon Business), which companies pay to manage their security posture - all telcos have had an MSSP BU since the 1980s (ATT Global Business Services being the market leader)
You'll see a lot of BS like this for the next 2 months because RSA is in 2 weeks and AWS Re:Invent in a month. It's conference season (great time to stock up on free tshirts and drink Blanton's on the corporate tab)
I'm looking at UnitedHealth's stock price over the last year. The theft happened in February. There was a dip; it's already recovering from that.
The market doesn't particularly care about those disclosures, it would seem.
Go on LinkedIn and take a look at who's on the CISO org and below at UHG and Optum today - in 6 months 60% of them will no longer list either as their employer.
UHG the organization will continue to exist, but the people who make up that organization will have their heads roll.
There is no Mr UHG the 3rd running stuff there or in the majority of F1000s - it's professional managers who climb up and down the ladder.
Not everything is some sort of conspiracy with mustachioed men and DEI puppets parroting Milton Friedman and Ronald Regan like the HN hivemind loves to think.
Security incidents will often directly impact platform and infrastructure teams, who's leadership and EMs heads roll as well.
If there is a very public breach, literally everyone director upwards will inevitably get purged over the 12 months post breach.
I've worked on enough cases like this to see it happen.
Personal responsibility as conducted through firings means more for the rank-and-file than for directors and above. It's not about what you've done as much as who you know in those levels.
TL;DR: I'll believe it when I see it.
1. Liability
2. Insurance Premiums
3. Regulation
1 and 2 are already in place, and 3 is currently working it's way over the next couple years.
> TL;DR: I'll believe it when I see it.
Cynicism is valid, but at some point it's just unfounded nihilism, and you as an individual IC will never publicly see these changes as they are well above your pay grade (and you sure as hell won't hear about it publicly)
> Being dragged in front of Congress on anything related to a computer is not a big deal
It is when you are on the hook for that federal bailout to prevent the entire healthcare system from collapsing [0] caused by incompetence surrounding credential management
[0] - https://www.wsj.com/articles/calls-mount-for-government-help...
Weird comment, are we supposed to trade the unfounded nihilism for unfounded optimism? Apparently accountability and transparency[1] are widely available.. behind closed doors.
[1]: yep, transparency is kinda required for having effective insurance, regulation, or liability.
We used to hang thieves. We still had theft.
T-Mobile (2021), AT&T (2024), Verizon (2024)