Verizon 2019 Data Breach Report

Data breaches continue to make headlines around the world. Seemingly, no matter what defensive measures security professionals put in place, attackers are able to circumvent them.  

Nearly 70% of cyber-attacks are perpetrated by outsiders but 345 of these attacks involve internal employees/staff and almost 40% involve criminal groups and some 23% involve Nation States.

However, the C-suite, who have access to a company’s most sensitive information, are now the major focus for social engineering and cyber-attacks.

No organisation is too large or too small to fall victim to a data breach. Having a sound understanding of the threats you and your peer organisations face, how they have evolved over time, and which tactics are most likely to be utilised can prepare you to manage these risks more effectively and efficiently.

The Verizon Data Breach Investigations Report (DBIR) provides, an important, perspectives on threats that organisations face. The 12th DBIR is built on real-world data from 41,686 security incidents and 2,013 data breaches provided by 73 data sources, both public and private entities, spanning 86 countries worldwide.

Key Takeaways

Senior Executives:  C-level executives were twelve times more likely to be the target of social incidents and nine times more likely to be the target of social breaches than in years past. To further underline the growth of financial social engineering attacks, both security incidents and data breaches that compromised executives rose from single digits to dozens in this report.

Cloud Hacking: As companies continue to transition to more cost- efficient cloud-based solutions, their email and other valuable data migrate along with them. Criminals simply shift their focus and adapt their tactics to locate and steal the data they find to be of most value.

Consequently, there’s been a corresponding increase in hacking cloud-based email servers via the use of stolen credentials. This is not an indication that cloud- based services are less secure, however. It is simply that phishing attacks, credential theft and configuration errors are a natural by-product of the process.

Payment Card Breaches:  Payment card web application compromises are well on their way to exceeding physical terminal compromises in payment card-related breaches. Data from one of our contributors, the National Cyber- Forensics and Training Alliance (NCFTA), substantiates this shift appears to have already occurred, and our larger data set is also trending that way.

Ransomware:  Ransomware attacks are still going strong, and account for nearly 24 percent of incidents where malware was used. Ransomware has become so commonplace that it is less frequently mentioned in the specialized media unless there is a high-pro le target in the mix.

However, it is still a serious threat to all industries. Meanwhile, some other threats that are frequently hyped, such as crypto-mining (2% of malware), occur very infrequently in our data set.
 
Chip and Pin: The number of physical terminal compromises in payment card-related breaches is decreasing when compared to web application compromises. This may be partly due to the implementation of chip and pin payment technology starting to show progress.

HR Improvements:  Interestingly, attacks on Human Resource personnel have decreased from last year. Our data set showed 6x fewer Human Resource personnel being impacted this year compared to last. This correlates with W-2 tax form scams almost disappearing entirely from the DBIR data set.

Click- Through Rates: Click-through rates on phishing simulations for data partners fell from 24% to 3% during the past seven years. But 18% of people who clicked on test phishing links did so on mobile devices.

Research shows mobile users are more susceptible to phishing, probably because of their user interfaces and other factors. This is also the case for email-based spear phishing and social media attacks.

Verizon

You Might Also Read:

SMEs Risk Costs Of Up To $2.5m Following A Breach:

 

 

« ‘Chinese Spies’ Had NSA Cyber Weapons Before The Shadow Brokers Leak
Hackers Don't Only Target Big Business »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Panzura

Panzura

Panzura optimizes enterprise data storage management and distribution in the cloud, making cloud storage simple and secure.

TrustArc

TrustArc

TrustArc provide privacy compliance and risk management with integrated technology, consulting and TRUSTe certification solutions – addressing all phases of privacy program management.

NetDiligence

NetDiligence

NetDiligence is a privately-held cyber risk assessment and data breach services company.

Micro Strategies Inc.

Micro Strategies Inc.

Micro Strategies provides IT solutions that help businesses tackle digital transformation in style.

PROOF

PROOF

PROOF is a Brazilian leader in cybersecurity. Our goal is to assist our Customers in managing security efficiently and in tune with business needs.

Corsa Security

Corsa Security

Corsa Security is leading the transformation of network security with a private cloud approach that helps scale network security services with unwavering performance and flexibility.

Exponential-e

Exponential-e

Exponential-e provide Cloud and Unified Communications services and world-class Managed IT Services including Cybersecurity.

Voodoo Security

Voodoo Security

Voodoo Security is a specialized information security consulting firm focused on security assessments, risk and compliance analysis, and cloud security.

IT-Seal

IT-Seal

IT-Seal GmbH specializes in sustainable security culture and awareness training.

Trusted Technologies and Solutions (TTS)

Trusted Technologies and Solutions (TTS)

TTS is a security consulting company specialised on business continuity and crisis management, information security management, information risk management and identity and access management.

Halborn

Halborn

Elite blockchain cybersecurity. Award-winning ethical blockchain hackers to secure your stack end-to-end. Far beyond smart contracts.

GoPro Consultants

GoPro Consultants

GoPro Consultants is an IT Consultancy and IT Managed services provider Globally with immeasurable expertise of IT professionals in Hardware/Support & Consultancy and Project Planning.

Synoptek

Synoptek

Synoptek is a global systems integrator and managed IT services provider (MSP). We offer comprehensive IT management and consultancy services to organizations worldwide.

Guardz

Guardz

Guardz helps small and growing businesses to go from zero or low cyber protection to having comprehensive security – in the quickest and most straightforward way.

Lab 1

Lab 1

Lab 1 turns criminal data breaches and attacks into insights. Get alerts of data breaches or ransomware attack incidents as they happen.

Hetz Ventures

Hetz Ventures

Hetz Ventures is a global-facing VC investing in highly talented and ambitious Israeli founders who operate at the cutting edge of deep technology.

FutureRange

FutureRange

Specialising in IT Managed Services, Cybersecurity and Digital Transformation, FutureRange experts provide professional IT services for clients throughout Ireland and beyond.