May 18, 2016 By Fran Howarth 3 min read

For anyone interested in security, the “2016 Data Breach Investigations Report” from Verizon Enterprise is one of the highlights of the year. Now in its ninth year, the report is more extensive than ever, combining input from 67 organizations and analyzing more than 100,000 security incidents — of which 2,260 were confirmed as actual data breaches — across 82 countries.

2016 DBIR Shows the Same Old Patterns

Many of the trends seen in previous years continued in 2016. Organizations are still at a disadvantage, with attackers continuing to exploit systems in just minutes while defenders take weeks or more to discover their deeds. That is, if they are able to detect them at all: Breaches are often reported by customers or law enforcement — not the organization that suffered the attack. One of the main conclusions from this fact is that basic security defenses are sorely lacking in many organizations.

Security incidents and breaches fall into the same nine patterns outlined in previous reports. Similarly, persistent vulnerabilities are exploited. The top 10 known vulnerabilities accounted for 85 percent of successful exploits despite the fact that patches have been available for months or even years. Zero-day attacks are seen much less frequently.

To protect your organization, know your users and your data

Web application attacks continue to be the top threat vector and increased by 33 percent over 2015. Organizations need to be constantly vigilant, monitoring all inputs to identify malicious activity. They need to know what data they have, identify its sensitivity and location and apply protections accordingly.

Encryption should be liberally applied to make life for cybercriminals as hard as possible. This is especially important given that 89 percent of attacks involve financial or espionage-related motivations.

Humans Are the Weakest Link

The outstanding theme throughout the report is that humans are the weakest link. Phishing is still a prime attack vector: 30 percent of phishing emails are opened — up from 23 percent last year — with a portion of those users then opening malicious attachments or clicking on tainted links.

Phishing is being used in a wider range of attack types and now spreads to seven of the nine main incident patterns identified. The three-pronged attack is one the rise, for example. It routinely starts with a phishing attack, and then the malware downloaded onto devices looks to steal credentials from multiple applications through keylogging.

The use of two-factor authentication is vital to save users from themselves. Obtaining passwords makes life far easier for cybercriminals; in fact, 63 percent of the confirmed data breaches involving a weak, default or stolen password. Ransomware is also on the rise, especially campaigns targeting specific individuals within an enterprise.

Miscellaneous errors, which are also a human factor and do not include lost devices, are so important that they are grouped into a category of their own. They are particularly seen in the public, information and health care sectors. Wrongful delivery of information is particularly prevalent in this category, both in paper and electronic form. Humans all too often hit the reply all button and share data.

Education is key. Employees are making too many mistakes and familiar attack patterns such as phishing remain effective. Organizations must do all they can to raise awareness of the dangers. The fact that old vulnerabilities continue to be exploited shows that IT departments are not paying close enough attention to their systems and access is still not sufficiently limited. If the 2016 DBIR were a report card, many organizations would be receiving a failing grade.

Take a Closer Look at Your Industry

One of the key takeaways from the 2016 DBIR is that knowing what attack patterns are most common for a particular industry can be a major advantage. To help with this, analysis is provided for financial services, health care, hospitality, public sector, retail and technology verticals in summaries that are quick to read and easy to digest.

To protect your organization, know your users and your data

More from Risk Management

Working in the security clearance world: How security clearances impact jobs

2 min read - We recently published an article about the importance of security clearances for roles across various sectors, particularly those associated with national security and defense.But obtaining a clearance is only part of the journey. Maintaining and potentially expanding your clearance over time requires continued diligence and adherence to stringent guidelines.This brief explainer discusses the duration of security clearances, the recurring processes involved in maintaining them and possibilities for expansion, as well as the economic benefits of these credentialed positions.Duration of security…

Remote access risks on the rise with CVE-2024-1708 and CVE-2024-1709

4 min read - On February 19, ConnectWise reported two vulnerabilities in its ScreenConnect product, CVE-2024-1708 and 1709. The first is an authentication bypass vulnerability, and the second is a path traversal vulnerability. Both made it possible for attackers to bypass authentication processes and execute remote code.While ConnectWise initially reported that the vulnerabilities had proof-of-concept but hadn’t been spotted in the wild, reports from customers quickly made it clear that hackers were actively exploring both flaws. As a result, the company created patches for…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today