????又是一年春來到，黑脈金斑蝶開始向北遷徙，威瑞森（Verizon）的數據泄露報告又出臺了，使全球各地已經深陷恐慌的企業信息安全總監們又恐慌了一次。

????威瑞森的年度報告調查分析了全球約50家企業的63000多起信息安全事件（以及1300多起已經得到確認的數據泄露事件）。今年這篇長達60頁的報告一共歸納了九種攻擊模式，包括對零售終端的入侵、拒絕服務攻擊以及網絡間諜活動等等。據威瑞森公司表示，在2013年發生的全部信息安全性事件中，有94%都可以歸入這九大類。

????下面我們將各大企業面臨的九大最緊迫的信息安全威脅簡要總結如下：

????1. 網絡應用襲擊

????它是數據泄露最常見的形式之一。據威瑞森公司的報告指出，網絡應用依舊是“眾所周知的互聯網沙袋”。那么壞人們是怎樣發動襲擊的？答案是通過釣魚技術、安裝惡意軟件，再就是猜中你們設置的那些過于簡單的密保問題，比如你的第一個玩具娃娃叫什么名字、你表哥的眼睛是什么顏色、你六年級時的昵稱是什么。不過威瑞森也指出，現在已經有了更好的方法來防范網絡應用襲擊，第一步就是采用雙因子驗證。

????2. 網絡間諜活動

????2013年，與國家行為有關的未經授權的網絡或系統訪問行為激增了三倍。威瑞森公司表示，網絡間諜活動所展示出的“威脅舉動”的方法超過了其它任何一種襲擊模式，發動襲擊者一旦獲取了訪問權限，就會在系統中為所欲為，進行從掃描整個網絡到輸出數據的各種活動。威瑞森公司警告稱，我們在這個問題上不能總是譴責中國——至少是不能光是譴責中國。有記錄的網絡間諜活動中，現在約有21%是從西歐國家發動的。

????3.?入侵零售終端

????最典型的例子就是最近塔吉特百貨（Target）數據泄露的案例，黑客侵入塔吉特百貨的系統之后，獲取了大約4000萬名顧客的信用卡號。入侵零售終端似乎已經成了近期流行的一種襲擊方式。不過威瑞森公司指出，入侵零售終端系統的活動與前幾年相比實際呈下降趨勢。這份報告的作者寫道：“最近被廣泛報道的幾家大型零售商的泄密事件把POS系統推到了風口浪尖上，但是事實上，這個問題已經存在好幾年了。”但不管怎樣，零售企業和酒店等還是要特別關注這種襲擊模式。只需要一次大型的零售終端入侵事件就足以嚇跑顧客和投資人——塔吉特百貨就是個活生生的例子。

????4. 支付卡套卡機

????盜刷支付卡的行為主要發生在ATM機和加油站，而且它是一種相對粗糙的入侵形式，需要一臺盜刷設備（即俗稱的“套卡機”）與機器進行連接才能實現盜刷。這已經不是什么新招術了，但是如今黑客收集被“盜刷”的卡片數據的方式卻又“花樣翻新”了。過去犯罪分子必須要親自回收“套卡機”，但現在他們可以利用藍牙或者其它無線通訊技術收集卡片的數據。雖然如今更加現代化的ATM機在設計上已經可以抵御套卡盜刷，但是它在全球其他一些地方仍然是個大問題，比如保加利亞和亞美尼亞等國家。

????5. 內部濫用

????光看標題你可能還不清楚這部分講的是什么。大家可以想想斯諾登的爆料，或者任何未經批準而惡意使用一個組織的資源的例子。最常見的情況就是企業內部員工利用明令禁止的設備（比如USB存儲設備）或服務把情報資源發送到他們自己的個人賬戶——又或者是假裝成另一名用戶發送信息，好讓某個同事被公司炒魷魚。據威瑞森公司表示，從事這些犯罪活動的人中有很多是支付鏈上的人員或者終端用戶，但前幾年也有不少企業高管干這種事。教訓是：不要相信任何人。

????6. 犯罪軟件

????這個類別包括除了間諜行為或入侵零售終端行為以外的任何惡意軟件事件。犯罪軟件的目的一定是為了進行某種非法活動，比如竊取用戶的網絡銀行證書等。大多數惡意軟件都是從下載或者所謂的“偷渡式感染”開始的，也就是說病毒可能是在用戶不自覺地點擊了一個隱藏彈窗時被下載到了電腦上。那么企業應該如何對抗這種類型的攻擊呢？首先要及時更新瀏覽器等軟件。

???

????It's that time of year again: Spring is in the air, Monarch butterflies are traveling north, and Verizon's (VZ) data breach report is making the rounds, freaking out already freaked-out chief information security officers around the globe.

????The annual report compiles and analyzes more than 63,000 security incidents (as well as 1,300 confirmed data breaches) from about 50 companies worldwide. This year's 60-page document identified nine main patterns of attack, including point-of-sale intrusions, denial-of-service attacks and acts of cyberespionage. According to Verizon, 94% of all security incidents in 2013 can be traced to these nine basic categories.

????(As for the other 6% of threats facing corporate America, well, ignorance is bliss, right?)

????Here, our summary of the most pressing security threats for major companies:

????1. Web app attacks

????Hands down, this is the most common type of data breach. According to Verizon's report, web applications remain the "proverbial punching bag of the Internet." How do the bad guys do it? Phishing techniques, installing malware, and, yes, correctly guessing the name of your firststuffed animal, your oldest cousin's eye color and your nickname in sixth grade. There are ways to better protect Internet-facing applications, Verizon insists, and it starts with two-factor authentication.

????2. Cyberespionage

????Incidents of unauthorized network or system access linked to state-affiliated actors have tripled -- that's right, tripled -- over the last year. Espionage exhibits a wider variety of "threat actions" than any other attack pattern, Verizon says, which means that once intruders gain access, they're making themselves comfortable and partaking in all sorts of activities, from scanning networks to exporting data. Verizon warns that we can't keep blaming China, though -- at least not just China. About 21% of reported incidents are now being instigated from Eastern Europe.

????3. Point-of-sale intrusions

????Given the recent high-profile Target (TGT) breach, in which hackers gained access to the credit card numbers of some 40 million customers, this may seem like the attack pattern du jour. But Verizon claims point-of-sale intrusions have actually been trending down over the last several years. "Recent highly publicized breaches of several large retailers have brought POS compromises to the forefront," the report's authors write. "But at the risk of getting all security-hipster on you -- we've been talking about this for years." Still, retailers and hotel companies in particular need to be concerned about this kind of attack. It only takes one massive point-of-sale intrusion to scare away customers and investors -- just ask Target.

????4. Payment card skimmers

????Skimming mainly affects ATMs and gas pumps, and is a relatively crude form of attack that requires a skimming device to be physically added to a machine. It's hardly a new tactic, but what's different today is the way that the data from "skimmed" payment cards is collected. Before, a criminal had to retrieve the skimming device; now, a thief can remotely collect the data using Bluetooth or other wireless technologies. More modern ATMs are designed to be relatively tamper-free, but this is still a big problem in some parts of the world, such as Bulgaria and Armenia.

????5. Insider misuse

????Not sure what falls under this category? Imagine someone akin to the rebel NSA defense contractor Edward Snowden, or pretty much any unapproved or malicious use of organizational resources. The most common examples of this are employees using forbidden devices (e.g. USB drives) or services to send intellectual property to their personal accounts -- or, more deliberately, posing as another user and sending messages aimed at getting a colleague fired. According to Verizon, many of the people committing these crimes are payment chain personnel and end users, but C-suite managers were more to blame in prior years. Bottom line: Trust no one.

????6. Crimeware

????This category includes any malware incident that doesn't fit into the espionage or point-of-sale buckets. The goal is always some kind of illicit activity, such as stealing users' online banking credentials. Most forms of crimeware start with web activity such as downloads or so-called drive-by infections, where a virus can be downloaded when a user unknowingly clicks on a deceptive pop-up window. What can corporations do to combat these types of attacks? Keep software such as browsers up to date.?