This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →

Security risks are most often tied to services exposed in the Internet zone (DMZ), an extranet, or anything connected to the Internet. However, even though there are risks in those environments, the number of incidents associated with them is reputed to be lower than the incidents that happen in "secure" zones such as the intranets and extranets of companies and governments.

The famous "80% of attacks come from the inside" is not a figure I like to quote, because even though plenty of people use it, there is little evidence that it is real! So, rather than writing an article that wrongly cites the rule saying 80% of attacks come from the inside, here are some concrete examples and statistics showing the attack vectors from 2009 to 2011.

The reality is that roughly 40 to 50% of attacks happen from the inside. But when we talk about attacks, human errors that could have been prevented with better security measures, such as better access rights, are included in those percentages. The 80% rule comes from the fact that, as everyone knows, most of the time when a problem occurs it is not disclosed or is simply handled internally, so the statistics can't easily account for it. And that is how 50% becomes 80%.

All of this was probably quite plausible more than 5 years ago, but today the types of attacks and how easy they are to pull off have completely changed the numbers.

Right now, if we look at the statistics gathered by Verizon and the American and German secret services, we see a completely different trend. In 2009-2010, about 50% of attacks involved insiders, and the main attack vectors were the use of excessive or even misconfigured privileges (48%*), hacking (40%) and malware (38%).  In 2011 the trend changed. In recent months we have seen attacks by groups such as Anonymous and LulzSec that consist of stealing information and leaking it. The trend among these groups, most of whom use SQL Injection attacks (so, Hacking) to leak confidential information, has blown the statistics up in the opposite direction.

2011 boils down to 92% of attacks coming from the outside, with only 17% benefiting from help on the inside. The attack vectors shifted to 50% hacking and 49% malware.

Without doing a more exhaustive analysis (I'll let you look at the documents below), we can see that the context of the attack types and of who carries them out can change quickly, but the attack vectors stay pretty much the same. Also, don't forget that a certain percentage of attacks (about 15%) involve partners. So always keep in mind, just like with data validation during a source code audit, that every input, every kind of link between companies and between partners, as well as employees, can bring some percentage of risk and security problems into our organization. That's why we must always set up our security to manage all of these links and entry points, whatever they may be.

Sources:

*: The percentages are not cumulative; each one represents the share of the total number of incidents in which that factor was involved.