Verizon DBIR: What the numbers say

Data breach, yawn. Those two little words that occur so frequently in the media and will have you switching off. Last week, Verizon released their 2019 Data Breach Investigations Report (DBIR) which provides valuable insight spanning across 86 countries and 41,686 incidents.

The executive summary of the DBIR articulates the issue perfectly in stating that “No organization is too large or too small to fall victim to a data breach. No industry vertical is immune to attack. Regardless of the type or amount of your organization’s data, there is someone out there who is trying to steal it”.

Numbers speak volumes, so here are the highlights of the report:

69% of attacks are perpetrated by outsiders
39% of all attacks are perpetrated by organized criminal groups
23% of bad actors are identified as nation-state or state affiliated
43% of breaches involved small businesses victims
52% of breaches involved hacking
33% included social attacks
28% involved malware

Are there any numbers here that shock you? Probably not at first glance. So, let’s consider the 2^nd tier of numbers: the DBIR finds that 34% of attacks involved an internal actor. That’s right, the person standing next to you at the coffee machine could be stealing company data or working with someone externally to steal company data.

On the inside

Two weeks ago, I attended the opening reception of a venture capital office in Silicon Valley. The fund focuses on cybersecurity companies, so, as you would expect, the interest of the attendees had a bias. One attendee was talking about an internal system using, in their words, "artificial intelligence" that the company had developed to profile employees on the probability that they could act negatively towards the company, for example steal data when leaving, or be part of a data breach or other activities that could be detrimental to the business.

Not all businesses have the resources, inclination or skill sets to profile employees in this way, or at least not yet. I am certain that within 10 years this will be a standard feature of a human resources system. The idea that employers may analyze every interaction that their employees have in the workplace will no doubt make many of us a little uncomfortable. It all feels too much like George Orwell’s book ‘1984’.

The interesting element is that a company has resorted to protecting itself from the human element, an issue that can evade cybersecurity solutions. I say ‘can’ as anti-phishing, data leakage prevention and such like do help protect from human mistakes causing incidents.

Meanwhile, financial gain is the most prevalent driver behind a data breach at 71%, according to the DBIR, as espionage came in second with 25%. This highlights that cybercrime is a business and can be very lucrative for those involved. If a data breach includes personal, credit card and CVC data, then the bad actors have a relatively simple opportunity to monetize their efforts.

What other stats say

Last week, ESET Asia Pacific (APAC) also released statistics, taken from 7 countries in the region with 2,000 respondents in each. There are some interesting similarities with 27% declaring a data breach was due to malware, compared with the DBIR’s 28%. Here are the takeaway numbers from the survey:

58% of respondents in APAC experienced a data breach in the past 12 months
27% suffered a “virus attack”
20% suffered a social media breach
19% had their personal data stolen and used

The survey also asked what actions a company should take once they are aware of a data breach:

32% said that the companies should apologize and inform customers what happened and how the problem was resolved
25% said that the companies should provide proof that the right systems were in put in place

Personally, I think companies should provide proof that the right systems were in place at the time of the breach and this was beyond their control. But then I have been the victim of a data breach in the last 12 months, and there is a blog post on its way later this month with more details.

Let's conclude with a number of proactive steps that companies can take to tackle the issue of data breaches, including: