Verizon report notes rise in nation-state attackers, on C-suite, cloud servers, payment web apps
Social engineering attacks against C-level executives, hacks of cloud-based email servers, and compromises of payment card web apps were all notably up last year, according to the newly released 2019 Verizon Data Breach Investigations Report (DBIR).
Other key takeaways from the past year included a marked decrease in successful attacks against physical point-of-sale terminals and a sharp drop in reported W-2 scams. And despite being in an ongoing battle for popularity among cyber-criminals, ransomware beat out cryptomining programs by a wide margin in terms of the number of incidents in which they were involved.
For its report, Verizon recorded 41,686 security incidents in 86 countries during the period of 1 November, 2017 to 21 October, 2018 – nearly 12,000 fewer events than the previous annual period. Verizon also registered 2,013 data breaches versus 2,216 in the previous year. (By Verizon’s definition an incident is when data is exposed to possible harm, while a breach is when an unauthorised party is confirmed to have accessed data.)
Compared to previous years covered by the report, C-level executives last year were 12 times more likely to be the target of a social engineering incident and nine times more likely to be the target in a breach caused by social engineering.
Sam Curry, chief security officer at Cybereason, said "Much as notorious bank robber Willie Sutton was often cited as saying, you rob banks because that’s where the money is, going after the C suite makes sense. Not only does the C suite have the best business intel, insight and access, they often negotiate exceptions to security or bypass them confidently and arrogantly. They make great targets for attackers, along with privileged business super-users, admins and those who have accumulated too many rights in a career."
Brian Higgins, security specialist at Comparitech.com agrees: "I’m not at all surprised to see C-Suite attacks featuring strongly as cyber-criminal methodologies have evolved and matured over the past decade."
In emailed comments he adds: "Whereas before, a global phishing email might elicit a worthwhile haul of bank details and other criminally commoditised data, the modern cyber-crime organisation recognises the value in more targeted, high level attack."
Meanwhile, as companies continued to migrate important data and processes to the cloud, cyber-criminals naturally began seeing this trend as an opportunity. Consequently, Verizon researchers reported an increase in hacks against cloud-based email servers using stolen credentials. In fact, they found that unauthorised access of cloud-based email servers were involved in over 50 percent of breaches that involved a web application as an attack vector.
"As businesses embrace new digital ways of working, many are unaware of the new security risks to which they may be exposed," said Bryan Sartin, executive director of security professional services at Verizon said in a company press release. That’s why "Security needs to be seen as a flexible and smart strategic asset that constantly delivers to the businesses, and impacts the bottom line," he continued.
"As more and more information and data, the ‘crown jewels’ of any business, migrates to SaaS and IaaS based solutions, organisations just do not have visibility and control that they had with their traditional enterprise security capabilities," added Pravin Kothari, founder and CEO of CipherCloud, in emailed comments. "Criminals are also finding it far easier to target the cloud to utilise stolen passwords, API vulnerabilities or misconfiguration to take over accounts and access all information like an authorised user, thus bypassing all security controls."
Verizon further reported that compromises of payment card web applications are poised to soon surpass successful attacks on physical payment terminals, which have decreased in frequency potentially due to the effectiveness of chip and PIN technology, the report suggests.
The researchers also noted a major decrease in reported W-2 tax form scams, which they said almost entirely disappeared from the DBIR data set. In its report, Verizon guesses this trend could be "due to improved awareness within organisations, noting a correlation between this development and a 6x year-over-year decrease in breaches affecting human resource personnel.
Ransomware made another strong showing in this year’s report, accounting for almost 24 percent of incidents in which a malware program was used – second only to C2 communications malware. Meanwhile cryptominers didn’t even crack the top ten, only appearing in two percent of incidents.
"The numbers in this year’s data set do not support the hype" around cryptominers, the report states.
Among 21 industry categories listed in the report (including an "unknown" category), the public sector experienced the most breaches with a total of 330, followed by health care (304), "unknown" (289) and finance (207). The public sector also suffered through the highest number of incidents (23,399), followed by "unknown" (7,350) and the entertainment industry (6,299).
Other notable statistics from the report:
Perpetrators: 69 percent of breaches were executed by outsiders, including cyber-criminal groups (39 percent) and nation-state or state-affiliated actors (23 percent). Just over a third, 34 percent, involved an insider threat. (Some breaches could have involved both external and internal actors.)
Tactics: 52 percent of breaches involved hacking, 33 percent included social engineering as a component, 32 percent involved phishing, 29 percent were made possible through stolen credentials and 28 percent were malware-enabled.
Motive: 71 percent of breaches were financially motivated, while 25 percent were conducted as part of an espionage operation designed to gain a strategic advantage.
Bob Huber, CSO of Tenable noted, "While many reports will talk about nation-state hacking or advanced threats, what this year’s DBIR shows, as it has for many years now, is that the attacks that are most successful are not new or even particularly clever – they’re just effective."
"Business email compromise attacks, malware infections and… tried-and-tested credential abuse make up the report’s key findings. Translating this simply: it’s a lack of basic cyber-hygiene that is still to blame for nearly all 41,686 security incidents and 2,013 confirmed breaches."
Regarding state attack increases, Igor Baikalov, chief scientist at Securonix emailed SC Media UK to note the dramatic 74 percent increase in the number of breaches attributed to the nation-state or state-affiliated actors. "It might be explained by more aggressive attribution, since it's in line with the number of breaches associated with espionage and seems to come at the expense of a reduction in the number of breaches attributed to organised crime.
"Phishing awareness and cyber-hygiene training seem to be working, as the number of clicks on phishing emails in simulations continues its steady decline, but the concern is the three percent that still click on ANY phishing email. Internet access as well as access to sensitive data for this population has to be tightly controlled and even restricted for repeat offenders."
However, Bob Huber, CSO of Tenable noted in an email to SC Media UK: "While many reports will talk about nation-state hacking or advanced threats what this year’s DBIR shows, as it has for many years now, is that the attacks that are most successful are not new or even particularly clever - they're just effective. Business email compromise attacks; malware infections and the tried and tested credential abuse make up the reports key findings. Translating this simply - it’s a lack of basic cyber-hygiene that is still to blame for nearly all 41,686 security incidents and 2,013 confirmed breaches.
"If we're ever to see these figures decrease, organisations need to focus on doing the basics – understanding what they’ve got, what's important to the business and then making sure it's protected 24/7."
It was a view reiterated by Morey Haber, chief technology officer & chief information security officer at BeyondTrust who commented: "The results of the report make it exceedingly clear to us that organisations need to focus on security basics and be persistent with disciplines under their control."
- Security Operations Senior Technical Analyst, Financial Services. Exclusive to DCL Search
- 75000 + benefits
Exclusive Security Operations - Senior Technical Analyst (x2) needed within a forward thinking financial services business head quartered in London. DCL Search have been engaged on an Identifier Project to attract the very best cyber talent to this business. Influence the cyber security capability and direction within the business. Learn new skills working within a collaborative team. Grow as a security professional. ROLE Triaging and troubleshooting security alerts. Improve tooling, reducing false positives. Improve processes and documentation Reviewing, approving, escalating security change management requests. Day to day operations, management and scalability of existing cyber security systems. Implementing new cyber security systems. Managing of and maturing security tooling such as; SIEM Vulnerability management Firewalls Patch management CASB Ideal technical experience Vulnerability Management: Qualys Forcepoint: CASB, DLP, web security, email security Microsoft Defender for Endpoint SIEM (Splunk) Firewalls: Cisco, Palo Alto, Juniper, Sonicwall IDS: Alert Logic Microsoft Cloud App Security Microsoft Azure ManageEngine ADAudit Plus Darktrace, Cloudflare, Cisco Umbrella, Imperva WAF Appreciation of ISO27001, GDPR, PCI, etc 2 days a fortnight in London- or more if you want.. Hybrid reworking.
- It's Pen Testing Chris, but not as we’ve know it.
- United Kingdom
5 reasons, as long as you are a skilled penetration tester (and a nice person) this may be different enough for you. Healthy package for the right talents- before you ask up to 95k+ (depending on skillset). Yes permanent only. Remotely based with the occasional time to meet up- unless you enjoy retiring from society. BUT UK based but not UK client focused. Research and training time- A dedicated trainer with budget for you to sharpen / develop skills. You can make your stamp. It’s a new role for someone technical to deliver, lead and shape a testing capability. No political shenanigans etc Exclusive to DCL Search and not one of the usual names. So you can dramatically increase your chances of securing it. Infrastructure pen testing and Web app / Manual penetration testing experience highly valued. Someone that can scope, deliver pen testing, report and not be useless in front of clients. Apply today to find out more. Or email Chris.Holt@dclsearch.com Or call 07884666351 This is a UK based role.
- Ping Contractor-
- Depends on skills and experience
Looking for experienced PIng Consultants, Looking for consultant with Implemenation or Architect experience in the Ping product set (Ping Identity, Ping Federate, Ping Access, Ping Directory, Ping Adapter development, SDK etc) This would be for implementation projects, working across UK. You will be responsible for providing implementation services to our clients from information gathering through to implementation. Evaluating client business, process, systems, and technology requirements and advise clients on best practices to help guide and solidify proposed designs. Manage Client expectations, Stakeholder Managment, ensuring design Matches business requirements
- Cyber Security Operations Engineer / Analyst. AWS experience. Remotely based. UK
- United Kingdom
Cyber Security Operations Engineer / Analyst. AWS experience. REMOTE UK. In house role. Senior role to technically lead and grow where required a security operations capability within an in house role. New position. Exclusive to DCL Search. You role will touch on the following Security Monitoring- Threat Analysis, Maturing monitoring capability. Utilising SIEM tools Vulnerability Management- Identifying threats to internal assets- working with internal teams to patch. Cloud based vulnerability tool experience preferred. Access Control Management- Mature policy and process of RBAC. Ideally AWS KMS experience. Vulnerability Testing- Aiding with Pen test scoping in line with identified vulnerabilities. Working internally to plan and track remediation actions. Security Incident Management- Triaging alerts, evidence capture, escalation, diagnose and fix. Working within a Cloud based environment. Ideally AWS. Security Patch Management Support & Assistance – Approach methods, solutions, and policy alignment. Disaster Recovery planning Change Management AWS CLOUD experience essential. Contact me today for more information Chris.Holt@dclsearch.com/ 07884666351