Verizon’s Data Breach Investigations Report 2023 – The Findings

Verizon recently released its 2023 Data Breach Investigations Report (DBIR). The report examines 16,312 security incidents, of which 5,199 were confirmed data breaches, and focuses on what happens when defences don’t work. In a time where all businesses are hoping to do more with less, analysing why defences failed can prove very beneficial. The information within the report, including a comprehensive list of potential controls, can be used as a valuable tool to help businesses refocus their efforts and better defend against attacks.

NOTABLE FINDINGS

Some of the key findings within Verizon’s comprehensive report include the following:

• 74% of breaches include the human element, whether due to error, privilege misuse, use of stolen credentials or social engineering.
• BEC attacks have almost doubled and now represent 50% of social engineering incidents.
• 83% of breaches involve external actors, with 95% of those breaches being financially driven.
• The three primary ways in which adversaries access businesses are:
  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities
• Ransomware is present in 24% of breaches, remaining ubiquitous across businesses in all industries and holding its place as one of the top action types.                          

INCIDENT CLASSIFICATIONS MAPPED TO CIS CONTROLS

As in previous reports, Verizon has grouped similar incidents into incident classification patterns in order to make its findings more digestible. However, this year, Verizon has also unveiled a valuable addition to the report – the mapping of Center for Internet Security (CIS) controls to these classifications. This provides organisations with an actionable and comprehensive list of controls that directly align with high-impact areas that have historically led to confirmed incidents and breaches. Moreover, it enables them to gain a strategic advantage and to prioritise security efforts by focusing on controls that directly address specified incident types and vulnerabilities.

To give a flavour of the report, the following summarises the CIS controls for consideration for three of the primary incident patterns:

1. Social Engineering

Social engineering incidents have increased from the previous year due to Pretexting, which is commonly used in BEC. Not only has the use of Pretexting almost doubled since last year, but the median amount stolen from these attacks has increased to $50,000 over the last couple of years.

Due to the human element associated with social engineering, many of the CIS controls relate to helping users detect and report attacks and protect their user accounts in the event that they fall victim to phishing. As this is a complex threat, there are several controls that can be implemented:

• Protect Accounts
  • Account Management
    • Establish and Maintain an Inventory of Accounts
    • Disable Dormant Accounts
  • Access Control Management
    • Establish an Access Granting Process
    • Establish an Access Revoking Process
    • Require MFA for Externally-Exposed App locations
    • Require MFA for Remote Network Access
• Security Awareness Programs
  • Security Awareness and Skills Training
  • Although not part of the CIS Controls, a special focus should be placed on BEC and processes associated with updating bank accounts.
• Managing Incident Response
  • Incident Response Management
    • Designated Personnel to Manage Incident Handling
    • Establish and Maintain Contact Information for Reporting Security Incidents
    • Establish and Maintain an Enterprise Process for Reporting Incidents

2. Basic Web Application Attacks

These breaches tend to be largely driven by attacks against credentials, with attackers leveraging those stolen credentials to access a range of different resources. However, while attacks don’t have a huge number of actions after the initial compromise, the breaches represent around one-fourth of Verizon’s dataset, making them extremely significant in terms of volume. The CIS controls for consideration are as follows:

• Mitigating Against Stolen Credentials by Protecting Accounts
  • Refer to the above recommendations for "Account Management" and "Access Control Management"
  • Mitigating Against Vulnerability Exploitation
    • Continuous Vulnerability Management
    • Establish and Maintain a Vulnerability Management Process
    • Establish and Maintain a Remediation Process
    • Perform Automated Operating System Patch Management
    • Perform Automated Application Patch Management                      

3. Miscellaneous Errors

Misdelivery, misconfiguration and publishing errors are leading to massive breaches and are often committed by system admins and developers. While unintentional, these actions directly compromise the security attributes of information assets. CIS controls for consideration are as follows:

• Control Data
  • Data Protection
    • Establish and Maintain a Data Management Process
    • Establish and Maintain an Inventory
    • Configure Data Access Control Lists
    • Enforce Data Retention
    • Securely Dispose of Data
    • Segment Data Processing and Storage Based on Sensitivity
    • Deploy a Data Loss Prevention Solution
• Secure Infrastructure
  • Continuous Vulnerability Management
    • Perform Automated Vulnerability Scans of Externally Exposed Enterprise Assets
  • Application Software Security
    • Use Standard Hardening Configuration Templates for Application Infrastructure
    • Apply Secure Design Principles in Applications Architectures
• Train Employees
  • Security Awareness and Skills Training
    • Train Workforce on Data Handling Best Practices
    • Train Workforce Members on Causes of Unintentional Data Exposure
• Application Software Security
  • Train Developers in Application Security Concepts and Secure Coding

TRENDS IN ASIA PACIFIC (APAC)

There were 699 incidents from the APAC region included in the report, 164 with confirmed data disclosures. While it’s immediately apparent from the report that the system intrusion pattern was at the top for the vast majority of regions, this wasn’t the case for APAC. While it is still a significant issue, it didn't show to be as pressing as social engineering. Overall, social engineering, system intrusion and basic web application attacks represented 93% of breaches. Most threat actors were external (97%) and well over half of threat actors were motivated by financial gain.      

ASSESS YOUR CYBER SECURITY MATURITY

Cyber security should be at the forefront of every organisation to help mitigate these ongoing, sophisticated threats. For help with your cyber security journey, download Verizon's DBIR or contact the team at Infotrust today for a maturity assessment.

‍