For anyone interested in security, the “2016 Data Breach Investigations Report” from Verizon Enterprise is one of the highlights of the year. Now in its ninth year, the report is more extensive than ever, combining input from 67 organizations and analyzing more than 100,000 security incidents — of which 2,260 were confirmed as actual data breaches — across 82 countries.

2016 DBIR Shows the Same Old Patterns

Many of the trends seen in previous years continued in 2016. Organizations are still at a disadvantage, with attackers continuing to exploit systems in just minutes while defenders take weeks or more to discover their deeds. That is, if they are able to detect them at all: Breaches are often reported by customers or law enforcement — not the organization that suffered the attack. One of the main conclusions from this fact is that basic security defenses are sorely lacking in many organizations.

Security incidents and breaches fall into the same nine patterns outlined in previous reports. Similarly, persistent vulnerabilities are exploited. The top 10 known vulnerabilities accounted for 85 percent of successful exploits despite the fact that patches have been available for months or even years. Zero-day attacks are seen much less frequently.

To protect your organization, know your users and your data

Web application attacks continue to be the top threat vector and increased by 33 percent over 2015. Organizations need to be constantly vigilant, monitoring all inputs to identify malicious activity. They need to know what data they have, identify its sensitivity and location and apply protections accordingly.

Encryption should be liberally applied to make life for cybercriminals as hard as possible. This is especially important given that 89 percent of attacks involve financial or espionage-related motivations.

Humans Are the Weakest Link

The outstanding theme throughout the report is that humans are the weakest link. Phishing is still a prime attack vector: 30 percent of phishing emails are opened — up from 23 percent last year — with a portion of those users then opening malicious attachments or clicking on tainted links.

Phishing is being used in a wider range of attack types and now spreads to seven of the nine main incident patterns identified. The three-pronged attack is one the rise, for example. It routinely starts with a phishing attack, and then the malware downloaded onto devices looks to steal credentials from multiple applications through keylogging.

The use of two-factor authentication is vital to save users from themselves. Obtaining passwords makes life far easier for cybercriminals; in fact, 63 percent of the confirmed data breaches involving a weak, default or stolen password. Ransomware is also on the rise, especially campaigns targeting specific individuals within an enterprise.

Miscellaneous errors, which are also a human factor and do not include lost devices, are so important that they are grouped into a category of their own. They are particularly seen in the public, information and health care sectors. Wrongful delivery of information is particularly prevalent in this category, both in paper and electronic form. Humans all too often hit the reply all button and share data.

Education is key. Employees are making too many mistakes and familiar attack patterns such as phishing remain effective. Organizations must do all they can to raise awareness of the dangers. The fact that old vulnerabilities continue to be exploited shows that IT departments are not paying close enough attention to their systems and access is still not sufficiently limited. If the 2016 DBIR were a report card, many organizations would be receiving a failing grade.

Take a Closer Look at Your Industry

One of the key takeaways from the 2016 DBIR is that knowing what attack patterns are most common for a particular industry can be a major advantage. To help with this, analysis is provided for financial services, health care, hospitality, public sector, retail and technology verticals in summaries that are quick to read and easy to digest.

To protect your organization, know your users and your data

More from Risk Management

Third-Party App Stores Could Be a Red Flag for iOS Security

Even Apple can’t escape change forever. The famously restrictive company will allow third-party app stores for iOS devices, along with allowing users to “sideload” software directly. Spurring the move is the European Union’s (EU) Digital Markets Act (DMA), which looks to ensure open markets by reducing the ability of digital “gatekeepers” to restrict content on devices. While this is good news for app creators and end-users, there is a potential red flag: security. Here’s what the compliance-driven change means for…

Defensive Driving: The Need for EV Cybersecurity Roadmaps

As the U.S. looks to bolster electric vehicle (EV) adoption, a new challenge is on the horizon: cybersecurity. Given the interconnected nature of these vehicles and their reliance on local power grids, they’re not just an alternative option for getting from Point A to Point B. They also offer a new path for network compromise that could put drivers, companies and infrastructure at risk. To help address this issue, the Office of the National Cyber Director (ONCD) recently hosted a…

Too Much Caffeine? Phishing-as-a-Service Makes Us Jittery

Recently, investigators at Mandiant discovered a new software platform with an intuitive interface. The service has tools to orchestrate and automate core campaign elements. Some of the platform’s features enable self-service customization and campaign tracking. Sounds like a typical Software-as-a-Service (SaaS) operation, right? Well, this time, it’s Caffeine, the latest Phishing-as-a-Service (PhaaS) platform. A basic subscription costs $250 a month; all you need is an email to sign up. How Caffeine PhaaS is Different PhaaS vendors advertise and sell their…

Everyone Wants to Build a Cyber Range: Should You?

In the last few years, IBM X-Force has seen an unprecedented increase in requests to build cyber ranges. By cyber ranges, we mean facilities or online spaces that enable team training and exercises of cyberattack responses. Companies understand the need to drill their plans based on real-world conditions and using real tools, attacks and procedures. What’s driving this increased demand? The increase in remote and hybrid work models emerging from the COVID-19 pandemic has elevated the priority to collaborate and…