Return to the list of client alerts
Takeaways from the Verizon Data Breach Report
Verizon is a multi-faceted company. One thing they do is data breach investigation – a lot of it. Here are 6 results to take away from their analysis of 150,000+ incidents:
- Phishing and stolen credentials (which is the result from phishing) is the most common way to breach an organization. This means you should be doing very active phishing of your own troops.
- User error is the fastest growing cause of breaches. That is a pretty big category to include not password protecting data in the cloud to clicking on a link. But what this means is that the bad guys don’t have to work very hard to steal your stuff.
- Insider threat is a problem, but 70% of breaches are caused by outsiders. So yes, you should be concerned about insider attacks, but more than twice as concerned about outsider attacks.
- 86% percent of the attacks were financially motivated and 55% carried out by organized crime. That means that, almost all attacks are designed to make the crooks rich.
- Defense in depth works. The overwhelming majority of the breaches they studied took less than 5 steps total to own your junk.
- Web applications. Web applications. Web applications. 9 out of 10 hacks involved web applications and 43% of all breaches involved web applications (the second number is so low because developers and IT leave so much data completely unprotected). Even so, 43% is double the number from last year. If you are not doing web application penetration testing on a frequent basis, you are inviting the bad guys in.
- Ransomware (BEFORE ransomware 2.0 was so popular) is not that big in malware type rankings. Social engineering/credential theft and looking for unlocked doors is easier. Still, this year (after the report was done) is seeing a large uptick in ransomware 2.0 because there is no good after-the-fact response that is effective other than paying off the mafia – if that even works. You have to keep them out.
For a lot more information, see the SC Magazine article, the Threatpost blog and, of course, the actual report from Verizon.
