For anyone interested in security, the “2016 Data Breach Investigations Report” from Verizon Enterprise is one of the highlights of the year. Now in its ninth year, the report is more extensive than ever, combining input from 67 organizations and analyzing more than 100,000 security incidents — of which 2,260 were confirmed as actual data breaches — across 82 countries.

2016 DBIR Shows the Same Old Patterns

Many of the trends seen in previous years continued in 2016. Organizations are still at a disadvantage, with attackers continuing to exploit systems in just minutes while defenders take weeks or more to discover their deeds. That is, if they are able to detect them at all: Breaches are often reported by customers or law enforcement — not the organization that suffered the attack. One of the main conclusions from this fact is that basic security defenses are sorely lacking in many organizations.

Security incidents and breaches fall into the same nine patterns outlined in previous reports. Similarly, persistent vulnerabilities are exploited. The top 10 known vulnerabilities accounted for 85 percent of successful exploits despite the fact that patches have been available for months or even years. Zero-day attacks are seen much less frequently.

To protect your organization, know your users and your data

Web application attacks continue to be the top threat vector and increased by 33 percent over 2015. Organizations need to be constantly vigilant, monitoring all inputs to identify malicious activity. They need to know what data they have, identify its sensitivity and location and apply protections accordingly.

Encryption should be liberally applied to make life for cybercriminals as hard as possible. This is especially important given that 89 percent of attacks involve financial or espionage-related motivations.

Humans Are the Weakest Link

The outstanding theme throughout the report is that humans are the weakest link. Phishing is still a prime attack vector: 30 percent of phishing emails are opened — up from 23 percent last year — with a portion of those users then opening malicious attachments or clicking on tainted links.

Phishing is being used in a wider range of attack types and now spreads to seven of the nine main incident patterns identified. The three-pronged attack is one the rise, for example. It routinely starts with a phishing attack, and then the malware downloaded onto devices looks to steal credentials from multiple applications through keylogging.

The use of two-factor authentication is vital to save users from themselves. Obtaining passwords makes life far easier for cybercriminals; in fact, 63 percent of the confirmed data breaches involving a weak, default or stolen password. Ransomware is also on the rise, especially campaigns targeting specific individuals within an enterprise.

Miscellaneous errors, which are also a human factor and do not include lost devices, are so important that they are grouped into a category of their own. They are particularly seen in the public, information and health care sectors. Wrongful delivery of information is particularly prevalent in this category, both in paper and electronic form. Humans all too often hit the reply all button and share data.

Education is key. Employees are making too many mistakes and familiar attack patterns such as phishing remain effective. Organizations must do all they can to raise awareness of the dangers. The fact that old vulnerabilities continue to be exploited shows that IT departments are not paying close enough attention to their systems and access is still not sufficiently limited. If the 2016 DBIR were a report card, many organizations would be receiving a failing grade.

Take a Closer Look at Your Industry

One of the key takeaways from the 2016 DBIR is that knowing what attack patterns are most common for a particular industry can be a major advantage. To help with this, analysis is provided for financial services, health care, hospitality, public sector, retail and technology verticals in summaries that are quick to read and easy to digest.

To protect your organization, know your users and your data