Cyberespionage is now the most common type of attack seen in manufacturing, the public sector and now education, warns the Verizon 2017 Data Breach Investigations Report. Much of this is due to the high proliferation of propriety research, prototypes and confidential personal data, which are hot-ticket items forcybercriminals. Nearly 2,000 breaches were analyzed in this year’s report and more than 300 were espionage-related many of which started life as phishing emails.
In addition, organized criminal groups escalated their use of ransomware to extort money from victims: this year’s report sees a 50 percent increase in ransomware attacks compared to last year. Despite this increase and the related media coverage surrounding the use of ransomware, many organizations still rely on out-of-date security solutions and aren’t investing in security precautions. In essence, they’re opting to pay a ransom demand rather than to invest in security services that could mitigate against a cyberattack.
“Insights provided in the DBIR are levelling the cybersecurity playing field,” said George Fischer, president of Verizon Enterprise Solutions. “Our data is giving governments and organizations the information they need to anticipate cyberattacks and more effectively mitigate cyber-risk. By analyzing data from our own security team and that of other leading security practitioners from around the world, we’re able to offer valuable intelligence that can be used to transform an organization’s risk profile”.
This year’s DBIR – the keystone report’s 10th anniversary edition – combines up-to-date analysis of the biggest issues in cybersecurity with key industry-specific insights, putting security squarely on the business agenda. Major findings include:
“Cyber-attacks targeting the human factor are still a major issue,” says Bryan Sartin, executive director, Global Security Services, Verizon Enterprise Solutions. “Cybercriminals concentrate on four key drivers of human behavior to encourage individuals to disclose information: eagerness, distraction, curiosity and uncertainty. And as our report shows, it is working, with a significant increase in both phishing and pretexting this year.”
Business sector insights give real-life customer intelligence
This year’s report provides tailored insights for key business sectors, revealing specific challenges faced by different verticals, and also answering the “who? what? why? and how?” for each. Key sector-specific findings include:
“The cybercrime data for each industry varies dramatically,” comments Sartin. “It is only by understanding the fundamental workings of each vertical that you can appreciate the cybersecurity challenges they face and recommend appropriate actions.”
The most authoritative data-driven cybersecurity report around
Now in its tenth year, the “Verizon 2017 Data Breach Investigations Report” leverages the collective data from 65 organizations across the world. This year’s report includes analysis on 42,068 incidents and 1,935 breaches from 84 countries. The DBIR series continues to be the most data-driven security publication with the largest amount of data sources combining towards a common goal – slicing through the fear, uncertainty and doubt around cybercrime.
“We started the DBIR series with one main contributor – ourselves”, comments Sartin. “Our vision is to unite industries with the end goal of confronting cybercrime head-on– and we are achieving this. The success of the DBIR series is thanks to our contributors who support us year after year. Together we have broken down the barriers that used to surround cybercrime – developing trust and credibility. No organisation has to stand in silence against cybercrime – the knowledge is out there to be shared.”
Get the basics in place
With 81 percent of hacking-related breaches leveraging either stolen passwords and/or weak or guessable passwords, getting the basics right is as important as ever before. Some recommendations for organizations and individuals alike include:
“Our report demonstrates that there is no such thing as an impenetrable system, but doing the basics well makes a real difference. Often, even a basic defense will deter cybercriminals who will move on to look for an easier target," concludes Sartin.