Cyberespionage is now the most common type of attack seen in manufacturing, the public sector and now education, according to the Verizon 2017 Data Breach Investigations Report. Much of this is due to the high proliferation of propriety research, prototypes and confidential personal data, which are hot-ticket items for cybercriminals, as the cyber security product firm puts it. Nearly 2,000 breaches were analysed in this year’s report and more than 300 were espionage-related many of which started life as phishing emails.
Organised crime groups escalated their use of ransomware to extort money from victims: this year’s report sees a 50 percent increase in ransomware attacks compared to last year. Despite this increase and the related media coverage surrounding the use of ransomware, many organizations still rely on out-of-date IT security it is claimed and aren’t investing in security precautions. In essence, they’re opting to pay a ransom demand rather than to invest in security services that could mitigate against a cyberattack.
George Fischer, president of Verizon Enterprise Solutions said: “Insights provided in the DBIR are levelling the cybersecurity playing field. Our data is giving governments and organizations the information they need to anticipate cyberattacks and more effectively mitigate cyber-risk. By analysing data from our own security team and that of other leading security practitioners from around the world, we’re able to offer valuable intelligence that can be used to transform an organization’s risk profile.”
This year’s DBIR – the report’s tenth edition – offers analysis of issues in cybersecurity with industry specifics. Its findings include:
Malware is big business: Fifty-one (51) percent of data breaches analyzed involved malware. Ransomware rose to the fifth most common specific malware variety. Ransomware – using technology to extort money from victims – saw a 50 percent increase from last year’s report, and a huge jump from the 2014 DBIR where it ranked 22 in the types of malware used.
Phishing is still a go-to technique: In the 2016 DBIR, Verizon flagged the growing use of phishing techniques linked to software installation on a user’s device. In this year’s report, 95 percent of phishing attacks follow this process. Forty-three percent of data breaches utilized phishing, and the method is used in both cyber-espionage and financially motivated attacks.
Pretexting is on the rise: Pretexting is another tactic on the increase, and the 2017 DBIR showed that it is predominantly targeted at financial department employees – the ones who hold the keys to money transfers. Email was the top communication vector, accounting for 88 percent of financial pretexting incidents, with phone communications in second place with just under 10 percent.
Smaller organisations are also a target: Sixty-one (61) percent of victims analyzed were businesses with fewer than 1,000 employees.
Bryan Sartin, executive director, Global Security Services, Verizon Enterprise Solutions, said: “Cyber-attacks targeting the human factor are still a major issue. Cybercriminals concentrate on four key drivers of human behavior to encourage individuals to disclose information: eagerness, distraction, curiosity and uncertainty. And as our report shows, it is working, with a significant increase in both phishing and pretexting this year. No organisation has to stand in silence against cybercrime – the knowledge is out there to be shared.”
Visit http://www.verizonenterprise.com/verizon-insights-lab/dbir/2017/.
