In preparation for this publication, Verizon reviewed more than
100,000 incidents (reported by a plethora of technology companies,
law firms, government agencies, and insurance companies, as well as
through its own investigations), of which 3,141 were confirmed data
breaches.
The report yielded several interesting trends. Not surprisingly,
most data breaches are about money — thieves stealing data
because of its value.
Sixty-three per cent of confirmed data breaches involved leveraging
weak, default, or stolen passwords, proving that data thieves will
exploit vulnerabilities to take the easiest route.
Phishing continues to trend upward. People seemingly just can't
help clicking on authentic-sounding "click here to reset your
banking password" e-mails. For example, Verizon found 30 per
cent of phishing messages were opened, unfortunately an increase
from 23 per cent in 2014. Twelve per cent then proceeded to open
the malicious attachment or click the link, no doubt to their
peril.
Overall, 95 per cent of breaches, and 86 per cent of incidents across all industries, predictably fell into nine identified patterns:
- miscellaneous errors (17.7 per cent),
- insider and privilege misuse (16.3 per cent),
- physical theft and loss (15.1 per cent),
- denial of service (15 per cent),
- crimeware (12.4 per cent),
- web app attacks (8.3 per cent),
- point-of-sale intrusions (0.8 per cent),
- cyber-espionage (0.4 per cent),
- and payment card skimmers (0.2 per cent).
- The bucket "everything else" category covered 13.8 per cent.
Interestingly, many of the data breaches reported were not
caused by super-secret and sophisticated Mission
Impossible-style attacks involving hacking or the wearing of
black ninja gear while scaling walls. Instead, many breaches fall
into what I think of as the "people are people" category
— highlighting human greed/avarice and our basic capacity to
make dumb mistakes.
Consider the classic data breaches caused by disgruntled insiders
or by "that guy you fired but forgot to disable his remote
access" (as Verizon charmingly put it) but also by organized
crime soliciting insiders to provide banking information.
Insider and privilege misuse incidents can be deadly because they
are often the hardest and take the longest to detect of all data
breaches (involving months and years). Verizon found almost a third
of these insiders were found to be end users who have access to
sensitive data as a requirement to do their jobs, with only a small
percentage (14 per cent) in leadership roles (executive or other
management) or in roles with elevated access privilege jobs such as
system administrators or developers.
Companies should thus worry less about job titles but more about
the level of access their employees have. Money appears again to
the prime motivator (34 per cent) for these inside jobs, although
one quarter of these breaches can be linked with espionage and
theft of intellectual property. The health care and public sector
industries are particularly vulnerable.
Privilege misuse involves accessing data to gain information for
alternative and unsanctioned uses, everything from mailing
sensitive information or uploading to a sharing service to
uploading data to unapproved hardware such as USB drives or
hand-held skimmers (used by food servers to capture diners'
payment card data).
Think of snooping bank tellers or those hospital workers who sell
celebrity medical records for cash.
To prevent against insider and privilege misuse, Verizon recommends
entities have a robust understanding of who has access to sensitive
data and where the data actually resides.
Access should be limited to a need-to-know basis. Subject to
employment law considerations, companies should also track their
employees' systems usage —particularly access to data
that can be used for financial gain. Access should also be revoked
immediately when contractors and employees leave their
organizations.
Leaving aside the malicious employees, one should also not discount
the impact of "miscellaneous errors," unintentional
actions, or mistakes that compromise security, including loss of
assets.
For example, 40 per cent of the incidents tracked in the report
were caused by shortages in server capacity when non-malicious
spikes in web traffic overwhelmed systems and caused key
applications to crash through no personal fault.
But what about the 26 per cent of miscellaneous errors caused by
individuals sending e-mails or documents to the wrong recipients?
Having a bad day and inadvertently publishing confidential
information to the entire Internet? And, of course, the
newspaper-worthy errors involving improper disposal of documents
(digital or otherwise) or failing to wipe hard drives before they
are trashed or resold, resulting in the sale of hardware containing
personal information or other sensitive data.
Painful as it may be, companies should keep a record of common
errors that can be used for training purposes and put in place more
effective internal controls to ensure, for example, that hardware
is not resold without confirming that necessary data wiping
occurred.
While Verizon classified "physical theft and loss"
separately, I saw it as a close cousin to the "miscellaneous
errors" school of forgetfulness and human error.
Think about incidents involving laptops left in parked cars or left
behind in public parks. Some incidents still involve malice, i.e.
physical theft remains common — 39 per cent of theft is from
the victim's own work area and 34 per cent from employees'
personal vehicles.
The research shows, however, that items such as laptops are lost
100 times more frequently than stolen.
At a minimum, companies should always encrypt their devices so if
they do get lost or stolen it will be more difficult for hackers to
access lost data. Additional training should also be given to
employees/contractors involving physical security of corporate
assets to make this and other best practices regarding the
importance of security stick (i.e. cars are never appropriate
places to leave corporate laptops).
Also, companies should resist the urge to print out and transport
all of their sensitive data to avoid such data being lost, stolen,
or compromised.
What are the quick takeaways? Verizon offered a summary of
common-sense, practical points intended to help mitigate/prevent
data breaches. These include:
- Be vigilant: Log files and change management systems can give you early warning of a breach.
- Make people your first line of defence: Train staff to spot the warning signs.
- Only keep data on a need-to-know basis: Only staff who need access to systems to do their jobs should have it.
- Patch promptly: This could guard against many attacks.
- Encrypt sensitive data: Make your data next to useless if it is stolen.
- Use two-factor authentication: This can limit the damage that can be done with lost or stolen credentials; and<</li>
- Don't forget physical security: Not all data theft happens online.
I applaud Verizon for producing this useful and practical report, but absent radical changes in human behaviour, I remain skeptical as to whether there will be much improvement seen in next year's publication. Fingers crossed.
Originally published by Canadian Lawyer Online - IT Girl Column
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.