When we think about crime, we often associate it as something that is violent and happens very suddenly and then the crime is over.  Take a typical bank robbery, for example.  The robbers might case the place for a while.  Sure, there might be some long thought out planning time for the “perfect job.”  Sometimes, it is a crime of opportunity with little planning.

The almost constant factor is that the commission of the crime typically takes less than a few minutes, then the bank robbers are fleeing as quickly as they can with their loot before law enforcement arrives and boxes them in.

Let’s look at the Target stores data breach.  According to various sources, about 40 million credit & debit card numbers were exposed and up to 70 million names, addresses and other personal information may have been taken (Bloomberg, 2014).  Sources familiar with the investigation said that the attackers first broke into Target’s network on Nov. 15th, 2013.  Krebs on Security first reported the breach on Dec. 18th with Target acknowledging it the next day on the 19th.

Charlie Osborne on ZDNet reports that “Most companies take over six months to detect data breaches.”  Osborn reports that a recent study pointed out that it takes an “average of 98 days for financial services companies to detect intrusion on their networks and 197 days in retail.”

These high-profile breaches get most of the media coverage and attention, but it makes one think about how often the small-to-medium sized organization is being hacked and how long the hackers are hanging around siphoning off data, especially since these organizations typically don’t have IT security staff that is looking for problems.  In many cases, these organizations don’t have any IT staff at all that would be looking for signs of a cybersecurity problem.

References:

Missed Alarms and 40 Million Stolen Credit Card Numbers: How Target Blew It. (n.d.). Retrieved March 27, 2016, from http://www.bloomberg.com/news/articles/2014-03-13/target-missed-warnings-in-epic-hack-of-credit-card-data

Krebs on Security. (n.d.). Retrieved March 27, 2016, from http://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/