Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently read an article that said there was not much data on which authentication threat vectors were actually being exploited in the real world. Eg what percent of password theft was by shoulder-surfing vs brute-force-trying vs keylogging?

Does anyone know where I could find any data, anecdotal or statistical?

Could we reverse engineer at least some data from known malware or other data we do have such as network traffic? Is there any way to share this kind of data anonymously (since attribution of "you've been hacked" seems to be a major reason data is not shared).

share|improve this question
Shoulder surfing for PIN is common with ATM card skimming, keylogging requires maleware on the target machine and so is only common in Zeus like attacks and then session hijack is often just as easy, offline bruteforce/dictionary is only if one already has a copy of the password database, online bruteforce is common in script kiddie attack tools against ssh and the like. Ultimately they are all different attacks for use in different situations. – ewanm89 Sep 20 '12 at 13:22
up vote 2 down vote accepted

I think if you have a need to work in this area, that the best bet is to start doing incident detection on your own network, and work on building coalitions that help you get NDA-level information with your peers.

There is no one right answer across the board. The "total # of shoulder surfing attacks" vs. "total # of brute force passwords" is going to be pretty diffcult to get hard statistics numbers. This is not an area that a researcher can address with a Gallup poll, since if you call an IT security professional and ask, they will either hang up or report YOU as the security incident.

Add to it that industries will vary widely - there are some common threats out there, but the scope of attacks CAN target different entities or industries.

I'll say that this fits closely with the IT areas of Incident Detection, Respose and Prevention. Large scale systems tend to use some COTS based solution to detect the kind of attacks you mention - either network stats like bruteforce password attempts, or signs of the outcomes of social engineering. In a mature system, they don't just respond to the crisis, but ask "how can we do better?", so they aggregate and compare the data in some way. How exactly is the secret sauce that won't cross security barriers without some well-understood agreements.

The best data I've seen comes from pay-for services - my favorite is the ACSC - the Advanced CyberSecurity Center - where member banks do share this sort of information. There's Gartner and Forrester, too, who are less specific, less easy to get detailed info from and less fully targeted at security.

There's not much public info I'd be trusting in this area - my first questions would be "how did you collect it?", "from who?" and "what where they measuring?"

This is definitely a case where how you ask the question will influence the answer.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.