Technology

What Can Your Company Learn from the 2019 Data Breach Investigations Report?

After analyzing more than 40,000 security incidents over the last year, Verizon released and updated its Data Breach Investigations Report (DBIR), which revealed some startling trends in cybersecurity threats.

Move over organized crime; new threats are emerging from sophisticated state-run attacks and insider breaches.

In previous years, organized crime accounted for roughly 80% of breaches in the 2018 report, but only accounted for half of all breaches in the 2019 report. However, while organized crime rates decreased, the number of incidents from sophisticated state-affiliated attacks increased nearly 10%.

Another surprising statistic was the number of incidents directly attributed to individuals inside an organization, whether accidental or intentional, accounting for nearly 20% of all breaches in the 2019 report.

Healthcare, financial services, information and the public sectors are still top targets for attackers… and watch out what Word docs you open.

The 2019 report does a nice job of breaking out attack, motivation and other interesting statistics based on sector, which is worth checking out for your industry. For example, in the financial services sector, 96.8% of malware was delivered via email, nearly 75% of which contained malicious Microsoft Office Word documents.

Cybercriminals’ primary motivation remains financial gain, which explains why ransomware and wire fraud continue to be epidemics facing corporate security teams.

Don’t sleep on BEC.

Attackers are predominately using phishing and stolen credentials as initial access mechanisms into organizations, which should put Business Email Compromise (BEC) solutioning on all organizations’ radar screens. Stepping up security training for employees never hurts either.

In this particular race, the tortoise won’t win. Attacks happen fast and IT teams find them slowly.

History repeats itself with forensic timelines showing that, on average, attackers compromise systems within a matter of minutes. In 2018, over 85% of the time, it took mere minutes for cybercriminals to compromise their victims’ networks, yet nearly 70% of confirmed breaches took months (or longer) to discover.

This reinforces that key cybersecurity hygiene is needed in organizations to detect and prevent breaches. Basic cybersecurity best practices should be implemented:

• Cybersecurity awareness training
• Least privilege access
• Prompt operating system and third-party application patching
• Multi-factor authentication for sensitive and public-facing systems
• Risk assessment and management
• Encryption of sensitive data

Our cybersecurity team has the experience and cutting-edge knowledge to dig into how these trends might be affecting your business. We solve cybersecurity problems from the server to the cloud. Contact JT Gaietto to get your cybersecurity road map and to improve your security posture.