Australia may be relatively small by population but it has the most information-security breaches in the Asia-Pacific region, according to new research that has applied a standard metric as a way to compare the relative frequency and severity of security breaches.
The continuously-updated Breach Level Index (BLI) – which was used to characterise the threat level during the first half of this year in the newly released Breach Level Index 1H 2016 report – assigns each breach a score between 1 and 10 and as formulated by security firm Gemalto “to give a bit more of a feeling of how important a breach is, either for us as consumers or as businesses who trade with other businesses,” Gemalto ANZ regional director Graeme Pyper told CSO Australia.
The report counted 974 breach incidents during the first half of the year, accounting for over 550 million records – including 29 incidents that each involved more than 1 million records and 52 percent of incidents whose size was unknown.
These figures – which put the security industry on track to see more than 1 billion records stolen by the end of this year – represented a 15 percent increase over the second half of 2015 and a sharp increase from the results of the first half of 2015.
While the number of records breached is one metric of the severity of the cybersecurity climate, the BLI reflects the relative importance of the data that is stolen: confidential medical details, for example, would be considered more serious than simple name-and-password combinations.
On this basis, the highest-scoring breaches this year were the 40m records – including email, addresses, plain-text passwords, usernames, IP addresses and date of birth records – stolen from Fling.com, which scored a BLI of 9.8; the 30m records stolen from 17 Media, with a BLI of 9.7; and the 55m-record breach of the Philippines' Commission on Elections, which scored 9.6.
Malicious outsiders were blamed for the most breaches – 69 percent of the total – well ahead of losses to accidental loss (18 percent), malicious insiders (8.5 percent), hacktivists (3 percent), and nation-state actors (1.4 percent).
The significant reduction in losses to malicious insiders – which dropped from 126 breaches involving 62.8m records in 2H2015 to just 83 breaches and 13.5m records in 1H2016 – continued a steady decline in such losses that began in Gemalto's 2H2014 survey, and may reflect steadily improving internal controls within businesses clamping down on users access to sensitive information.
Based on current trends, extrapolating the numbers to the end of the year revealed a surprise, Pyper said: “I assumed the second half of 2016 would see an increase in breaches but what I actually came up with was the fact that we would actually be about 18 percent lower in terms of the number of breaches than in 2015,” he said.
“From that I do take a bit of comfort that we are getting better at doing this – and in actually letting people know that something has happened.”
Australia, however, had a strong showing in terms of the number of breaches: while Asia-Pacific organisations reported just 8 percent of the overall breaches noted in the report, 22 of these occurred in Australia – compared with 13 in India, 7 in Japan, 7 in New Zealand, 5 in Hong Kong and South Korea, and just 1 in Singapore.
“Either we're a juicy target because we're actively doing things and have a stronger economy and are forging ahead,” Pyper speculated while noting that breaches in New Zealand are down considerably, “or we're just being a little more open about the breaches because of the privacy regulations that we have.”
Pending breach notification legislation – which has been recommended by the Office of the Australian Information Commissioner – will formalise a practice already being commendably practiced by the likes of Kmart Australia and is “clearly going to lead to a spike in terms of the number of incidents that will be reported,” Pyper said.
Some 79 percent of the incidents in the current report occurred in North America and 94 percent of those were from the USA, he noted – but this is likely to change as Australia and others follow that country's lead in mandating breach reporting. “Our model follows that in the USA,” he said, “but the difference is that they have the breach notification rules and we do not.”
Straw polls at candid customer sessions have this year shown that around half of audiences had had a breach this year, he added. “To have that kind of a high-level response did give me a feeling that there is a lot more that we should be doing as a collective to be able to protect information and to stop the bad guys getting access to it.”
The numbers are about more than just scaring IT and business executives into action, however: this approach effectively gives members of crucial supply chains a metric of information-security trustworthiness by which to evaluate their relationships.
In this way, organisations can evaluate their current or potential partners in terms of the information-security risk a relationship with them would present. This capability has become critical as supply-chain partners emerge as a significant vector for attack, with the 2013 Target breach notoriously attributed to an HVAC contractor and concerns mounting that similar vulnerabilities are rife across all industries. Such concerns recently led US authorities to begin sharing classified supply-chain threat reports with industry figures in a move that reflects today's deeply enmeshed supply chains and the risk that poor cybersecurity practices pose to critical trade networks.