If you have been following Verizon’s annual data breach investigation reports like I have over the years, you get excited when the new one comes out. If you have never read the report, now’s your chance, as the 2021 report was just released.
Although chock-full of information, the Verizon Data Breach Investigations Report (DBIR) is always written in an understandable way, and provides important information to help stay current on threat actors’ schemes and scams so the information can be shared with employees to prevent them from becoming a victim.
This year’s DBIR is 119 pages long, so take your time. It defines words in an accurate way (like “incident” and “breach,” which I appreciate), and outlines the conclusions in an organized manner.
Here is a brief summary of important considerations for cyber risk management strategy:
- Social engineering is the most successful attack
- The top hacking vector in breaches is web application servers
- Denial of service is the most frequent way incidents occur
- 85 percent of breaches involved a human element
- Financially-motivated attacks are the most common
- Organized crime continues to be the number one attacker
- External cloud assets were compromised more than on-premises assets
- Older vulnerabilities that haven’t been patched are being exploited by attackers
- Credentials remains one of the most sought-after data types, followed by personal information
- Employees continue to make mistakes that cause incidents and breaches
- Devices continue to be lost or stolen
- Privileges are misused
- Business Email Compromises were the second most common form of social engineering
- The majority of social engineering incidents were discovered externally
In addition, phishing continues to be one of the top causes of data breaches, followed by use of stolen credentials and ransomware, with the notable change in the past year of how threat actors “will first exfiltrate the data they encrypt so that they can threaten to reveal it publicly if the victim does not pay the ransom. We are not sure if this breach double-dipping is permitted in the Threat Actor Code of Conduct, but there has been no evidence that they have one anyway.”
The DBIR discusses the importance of building a culture of cybersecurity vigilance, the difficulties of patching, the new complexities of attacks, which involve numerous steps, and web application attacks.
I will be spending more time with the DBIR as it is hefty reading, but it is well worth the time and energy to stay current on cyber risks and patterns.