Cybercriminals are exploiting human nature as they rely on familiar attack patterns such as phishing, and increase their reliance on ransomware, finds the Verizon 2016 Data Breach Investigations Report.
This year’s report points to repeating themes from prior-year findings and storylines that continue to play off of human frailty, including:
- 89 percent of all attacks involve financial or espionage motivations
- Most attacks exploit known vulnerabilities that have never been patcheddespite patches being available for months, or even years. In fact, the top 10 known vulnerabilities accounted for 85 percent of successful exploits
- 63 percent of confirmed data breaches involve using stolen, default orweak passwords
- 95 percent of breaches and 86 percent of security incidents fall into nine patterns
- Ransomware attacks are on the rise
- Basic defenses continue to be sorely lacking in many organizations.
Phishing tops the list of increasing concerns
One area that has picked up dramatically over the prior year is phishing where end users receive an email from a fraudulent source. Alarmingly, 30 percent of phishing messages were opened – up from 23 percent in the 2015 report – and 13 percent of those clicked to open the malicious attachment or nefarious link, causing malware to drop and a foothold gained by cybercriminals.
In prior years, phishing was a leading attack pattern for only cyber-espionage and has now spread to seven of the nine incident patterns in the 2016 report. This technique is amazingly effective and offers attackers a number of advantages such as a very quick time to compromise and the ability to target specific individuals and organizations.
Adding to the list of human errors are those perpetrated by the organizations themselves. Labeled ‘miscellaneous errors,’ this incident pattern group takes the No. 1 spot for security incidents in this year’s report. In fact, 26 percent of these errors involve sending sensitive info to the wrong person. Other errors in this category include: improper disposal of company information, misconfiguration of IT systems, and lost and stolen assets such as laptops and smartphones.
“You might say our findings boil down to one common theme – the human element,” said Bryan Sartin, executive director of the Verizon RISK team. “Despite advances in information security research and cyber detection solutions and tools, we continue to see many of the same errors we’ve known about for more than a decade now. How do you reconcile that?”
Of increasing concern to Verizon’s security researchers is the speed in which cybercrime is committed. In 93 percent of cases, it took attackers minutes or less to compromise systems and data exfiltration occurred within minutes in 28 percent of the cases.
As with the 2015 report, compromises of mobile and Internet of Things devices are not a significant factor in the 2016 DBIR. However, the report notes that proof of concept exploits are real and it’s only a matter of time before a large scale breach impacts mobile and IoT devices, which means organizations should continue to be vigilant about protecting smartphones and IoT devices.
Also worth noting from the report is that web application attacks climbed to the #1 spot for data breaches, and that 95 percent of web app breaches were financially motivated.
The rise of the three-pronged attack
This year’s report calls out the rise of a new three-pronged attack that is being repeated with great regularity. Many organizations are falling prey to these attacks that include:
- Sending a phishing email with a link pointing to the malicious website or mainly a malicious attachment
- Malware is downloaded onto an individual’s PC that establishes the initial foothold, and additional malware can be used to look for secrets and internal information to steal (cyberespionage) or encrypt files for ransom. Many times the malware steals credentials to multiple applications through key logging.
- Use of the credentials for further attacks, for example, to log into third party websites like banking or retail sites.
2016 report reiterates the need for the basics
The researchers note that basic, well-executed measures continue to be more important than complex systems, and include:
- Know what attack patterns are most common for your industry. Utilize two-factor authentication for your systems. Encourage users to utilize two-factor when logging into into popular social networking apps.
- Patch promptly.
- Monitor all inputs: Review all logs to help identify malicious activity.
- Encrypt your data: If stolen devices are encrypted, it’s much harder for attackers to access the data.
- Train your staff: Developing security awareness within your organization is critical especially with the rise in phishing attacks.
- Know your data and protect it accordingly. Also limit who has access to it.
“As the Verizon DBIR 2016 shows, companies get breached for two reasons: legacy authentication mechanisms (by that I mean username and passwords) and a lack of vulnerability management. I see breaches continue and even grow as attackers get better, while the majority of defenders stay at about the same level. We, the security industry, need to make these two pain points easier to solve. For vulnerability management, that means that we have to make it more accessible and enable the defenders to accurately know this inventory and pinpoint the most critical vulnerabilities,” said Wolfgang Kandek, CTO at Qualys.