Verizon Unveils VERIS Information-Sharing Website to Advance Knowledge of Security Incidents

BASKING RIDGE, N.J., Nov. 11, 2010 /PRNewswire/ -- One of the most persistent and critical issues affecting the information security community is a lack of data about security incidents.  To help advance understanding of information security risk industrywide, Verizon is launching the VERIS community website, which is designed to collect and share information about security incidents that are voluntarily and anonymously reported by participating organizations around the globe.

Organizations and individuals can now share their data by using a new online application for collecting, classifying, analyzing and comparing security incident information.  Each person who submits data will receive a customized mini "Data Breach Investigations Report" that analyzes the incidents and compares them with similar incidents that occurred at other participating organizations.  

The VERIS website will also feature easy access to other tools such as the VERIS Wiki, example incidents, white paper, user guide, sample report and a link to the "2010 Data Breach Investigations Report."

"With the VERIS Project, Verizon is publicly sharing data that we have spent years gathering through our data breach caseload," said Peter Tippett, vice president of technology and innovation, Verizon Business. "We are sharing the aggregate data -- and encouraging other companies to anonymously share their security-event data -- to promote more dialogue and understanding of security incidents.  The collective sharing of in-the-trenches security events offers us the opportunity to fundamentally change how we all manage risk."

The VERIS Project was introduced in March (news release available here) when Verizon Business publicly released the research framework used for the company's landmark "Data Breach Investigations Reports."   The framework, which has since been publically vetted by the security community, was pivotal in introducing a common language and structured, repeatable process to allow organizations to objectively classify security incidents.  The common language is critical, as there is currently no universal language that describes security incidents or an accepted industry standard for the development of risk metrics.

VERIS Participation Is Simple and Practical

Participating organizations can gain great benefit from the VERIS online application.  Through VERIS, organizations can regularly generate incident reports that can be distributed and analyzed within their organization, while maintaining their privacy.

For example, participating enterprises will know whether their incident was a rare event or one commonly experienced by others, and such information can help enterprises decide what, if anything, should be done to prevent similar events in the future.

All participating organizations need to do is complete the online form, which consists of the following areas:

• Demographics -- Submitters describe (but do not identify) the entity affected by the incident to enable comparative analytics.
• Incident classification --Describes the role of the threat agent, the agent's actions and their impact on the information assets.
• Discovery and Mitigation: Focuses on events immediately following the incident, as well as lessons learned from the response process.
• Impact Classification: The submitter provides a description and measures the consequences of the incident on the impacted organization.

This project is a joint effort of the Verizon RISK Team and ICSA Labs, an independent division of Verizon Business that performs third-party security testing and certification.   For more than 20 years, ICSA Labs has facilitated data sharing and collaboration within the security industry.  ICSA Labs' facility and network will provide the backbone for the VERIS Project.

"The VERIS application is a smart way for Verizon Business to crowd-source breach data collection, and giving back to the data-starved security community makes it even more valuable," said Wendy Nather, senior security analyst, The 451 Group.

About Verizon Business

Verizon Business, a unit of Verizon Communications (NYSE, Nasdaq: VZ), is a global leader in communications and IT solutions. We combine professional expertise with one of the world's most connected IP networks to deliver award-winning communications, IT, information security and network solutions.  We securely connect today's extended enterprises of widespread and mobile customers, partners, suppliers and employees – enabling them to increase productivity and efficiency and help preserve the environment.  Many of the world's largest businesses and governments – including 96 percent of the Fortune 1000 and thousands of government agencies and educational institutions – rely on our professional and managed services and network technologies to accelerate their business. Find out more at www.verizonbusiness.com.

VERIZON'S ONLINE NEWS CENTER: Verizon news releases, executive speeches and biographies, media contacts, high-quality video and images, and other information are available at Verizon's News Center on the World Wide Web at www.verizon.com/news.  To receive news releases by e-mail, visit the News Center and register for customized automatic delivery of Verizon news releases.

SOURCE Verizon Business