Every year, digital security experts, IT personnel and top executives from various industries look forward to the release of Verizon’s data-rich and analytical security report, which many consider to be the annual breach bible for the industry.
The 2019 Verizon Data Breach Investigation Report has just been released. For me, the DBIR provides some of the most insightful views on the evolving threat landscape and thus is one of the most valuable annual assets in the security industry. If you haven’t looked at it, you should.
Verizon writes, "The threats are real, the attackers motivated. But something stands between them and your organisation's data: you and your security teams, with the insight, perspective, and tools to take action. Understanding the threats can help you manage risk effectively. You'll find that all right here.”
To help you take advantage of the 78-page report, I've highlighted some important insights that we can take from it:
1) The importance of looking at attack vectors
“Leveraging an attack path model is not only an important step towards formalising our understanding of attacks, but also a means to understanding our defence. (…) The more we can understand the sequence of events happening in an attack, the more we as a community can make it harder for adversaries to reuse the same process.”
What started out as a small appendix in last year’s report is now making its way to the front. Talking about attack paths, the steps and actions that attackers take beyond the initial breach point, is key to improving the security posture.
Considering the fact that over 60 per cent of breaches involved simple techniques such as phishing (32 per cent) and stolen credentials (29 per cent), we can assume that an adversary will find its way into the organisation (or “if the proverbial lever is long enough they will breach your perimeter”). Regarding phishing in particular, the report tells us that 94 per cent of malware is delivered through email (“Malware delivery method: email – 94 per cent”). Once installed, it’s most often used as a foothold for injection of more malicious programs or ransomware commands.
This of course is not to say that you shouldn’t secure the perimeter, yet we must prepare for what happens after the initial breach. The fact that an attacker has managed to get access to your system doesn’t necessarily mean they will manage to cause great damage, and now it is much more in your control. (“Admittedly, there’s not a lot you can do about the development, preparation, targeting, distribution, and other shenanigans that take place on the part of the bad guy before the breach. However, what goes down after the breach is another story altogether”). We can see that the median loss in data breaches was $7,611, and in many breaches the loss was almost zero. What separates the costly breaches from the rest is how hard it was for the attacker to reach the crown jewels after the initial breach.
So, what did we learn about the attack paths? We can see that most incidents didn’t involve many steps and, while they may have started in a number of ways, malware and hacking are the predominant ways to progress inside and reach the crown jewels.
2) Disappointingly long time to discover breaches
“56 per cent of breaches took months or longer to discover.”
While in other reports such as FireEye’s M-Trend 2019 we can see that we are improving our average time to discovery (from 416 days in 2011 to 78 in 2018), this is still very depressing. We must do better than allowing criminals to hide in our networks for months at a time.
3) Vulnerabilities vs. IT hygiene
"At most, six per cent of breaches in our data set this year involved exploiting vulnerabilities."
This is another thing we must emphasize. Vulnerabilities are important, and patching is crucial (and smart patching is even more crucial). Yet vulnerabilities are only a small portion of what attackers are doing. In fact, IBM and Gartner have shown in the Implement a "Risk-Based Approach to Vulnerability Management" report that the number of vulnerabilities exploited in the wild stays quite constant over the years, representing only a fraction of the vulnerabilities exposed each year.
What we need to pay more attention to is IT hygiene: misconfigurations, user error, and strong credentials spread across machines without any real reason. To quote Gartner, “By 2025, more than 85 per cent of successful attacks against modern enterprise user endpoints will exploit configuration and user errors” (according to its "The Long-Term Evolution of Endpoints Will Reshape Enterprise Security" report released in May). This is something we need to put more focus on -- our IT hygiene.
“Errors were causal events in 21 per cent of breaches.”
Trivial mistakes are to blame for data breaches. In many cases, the attacker does not have to work all that hard because somebody left the door open.
“It is important to acknowledge that there will always be [vulnerability] findings. The key is to prioritise the important ones and have a plan for the remaining actionable vulnerabilities; and to be able to defend acceptance of unaddressed findings.”
Ray Ottey runs Verizon’s security business across the UK, Ireland, and the Nordics. In a recent interview with Forbes, he stated, "Every one of the incidents in this report is either where data has been stolen, or there was a quantified cyber incident. So it's just facts, things that have happened. So we look at the analysis of that, how did they get in, what assets did they steal, how long did it take or how many steps do they take.”
It’s remarkable that the twelfth iteration of the DBIR compiles real-world data from almost 42,000 security incidents and more than 2,000 data breaches across 86 countries.
I am happy to applaud the fact that the 2019 Verizon Data Breach Investigation Report reflects a high accuracy and methodology, setting a high standard for the community. I strongly believe it should be more encouraged.
Menachem Shafran, VP Product, XM Cyber
Image Credit: Balefire / Shutterstock