If your organization would be to successfully handle cybersecurity risks, you want to understand what things to keep an eye out for.
That is where Verizon's 2020 Data Breach Investigations Report comes from. Its yearlong investigation of the causes of information breach has shown the 6 most frequent methods organizations fall prey to.
We took a look at every one of these on this site and see which comes out on the top.
1. Criminal hacking
It should not be a surprise that criminal hacking is the most effective cause of information breaches since it is frequently required to run certain attacks. Malware and SQL injection, as an instance, are often only possible when criminal hacks into an organization's system.
It is typically related to computer programming, but Verizon discovered that the most popular offender hacking technique included stolen credentials.
This does not need any specialized knowledge. Crooks can buy the credentials on the darkened net, locate down them, crack them with a password-generating device or figure them.
After a cybercriminal includes a user's login credentials, then they can execute any number of nefarious actions, but it typically boils down to extracting data to commit fraud or market on the darknet, or to establish additional attacks, such as phishing scams.
2. Social engineering
Verizon's analysis found that nearly a quarter of information breaches are brought on by fraudsters only acting like they belong.
You are likely aware of phishing, where cybercriminals send malicious emails that appear valid, but Verizon also emphasized the danger of financial pretexting.
Pretexting is very similar to phishing because crooks contact their aims under false pretenses to obtain their data (in this instance, financial information especially ).
But, protesters contact sufferers by telephone in addition to by email, and instead of replicating a valid organization's site, they just ask that the target ship them their financial particulars.
Once they have that info, the crooks can perpetrate fraud, sell the information or contact a third party (like the victim's bank or a provider the victim's company functions with) requesting information in their history.
3. Human error
Breaches do not need to be brought on by someone acting maliciously. Verizon discovered more than one in five episodes was the effect of a mistake made by an employee.
The most common mistakes involved sensitive information that has been delivered to the incorrect individual. This may involve sending an email to the wrong individual, attaching the incorrect record, or committing a physical document to somebody who should not have access to this info.
The second most frequent cause of human mistake was misconfiguration, which generally entails leaving a database containing sensitive data online with no password limitations.
4. Physical actions
We have a tendency to consider information breaches as being a consequence of cybercrime, but Verizon discovered that a substantial number of incidents do not involve technology in any way.
Most bodily incidents involve the theft of all paperwork or devices such as notebooks, telephones, and storage apparatus. Workers are encouraged to operate at home or on the move, however, if they do not keep their eye on their resources, an opportunist crook might easily steal them.
Another major physical activity is card skimming. This is really where crooks add a device into account readers and ATMs to harvest payment card info.
5. Malware
Cybercriminals can utilize malware for numerous functions, however, Verizon's report highlights a couple of notable types, such as RAM scrapers, which scan the memory of electronic devices to gather sensitive data. POS (point-of-sale) systems are especially vulnerable to RAM scraping.
The report also noted that the incidence of keyloggers, which catch the keys struck onto a computer keyboard. They are usually utilized to steal passwords and other sensitive info.
6. Unauthorized use
Organizations always overlook the danger their workers pose, however, Verizon discovered more than one in twelve statistics breaches are brought on by a member of staff using data improperly.
There are two chief ways this occurs. The first is privilege abuse, where workers misuse information they have been granted valid access to.
This is not always for malicious intentions. The worker may have stumbled upon the data unintentionally, which may take place if the organization does not set up proper access controls.
Alternately, the worker might have disregarded access policies. This may happen when, as an instance, an employee changes a record without following the right procedure. The second common sort of urgency misuse is information mishandling.
