NEW: Microsoft Vulnerabilities Report 2022 - Read the Findings of Our Annual Report Read Now

  • Partners
  • Support
  • Careers
  • English
    • Deutsch
    • français
    • español
    • 한국어
    • português
BeyondTrust
  • Products

    Privileged Password Management

    Discover, manage, audit, and monitor privileged accounts and credentials.

    • Password Safe
    • DevOps Secrets Safe
    • Privileged Access Discovery Application

    Endpoint Privilege Management

    Enforce least privilege across Windows, Mac, Linux, and Unix endpoints.

    • Windows and Mac
    • Unix and Linux
    • Active Directory Bridge

    Secure Remote Access

    Centrally manage remote access for service desks, vendors, and operators.

    • Remote Support
    • Privileged Remote Access
    • Privileged Access Discovery Application

    Cloud Security Management

    Automate the management of identities and assets across your multicloud footprint.

    • Cloud Privilege Broker

    BeyondInsight

    Experience the industry’s most innovative, comprehensive platform for privileged access management.

  • Solutions

    Use Cases

    • Cloud Security
    • Compliance
    • Cyber Insurance
    • Digital Transformation
    • Endpoint Security
    • Operational Technology
    • Ransomware
    • Service Desk Efficiency
    • Zero Trust

    Industry Applications

    • Financial Services
    • Government Agencies
    • Healthcare
    • Law Enforcement
    • Manufacturing
    • Schools & Universities

    Solutions

    The BeyondTrust Privileged Access Management portfolio is an integrated solution that provides visibility and control over all privileged accounts and users.

  • Resources

    Learn

    • Blog
    • Customer Stories
    • Competitor Comparisons
    • Datasheets
    • Demos
    • Glossary
    • Podcast
    • Whitepapers

    Attend

    • Events
    • Go Beyond
    • Training
    • Webinars

    Support

    • Changelog
    • Professional Services
    • Technical Documentation

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

  • Company
    • About
    • Leadership
    • Core Values
    • Partners
    • Careers
  • Watch Demo
  • Contact Sales

Verizon DBIR 2018: Follow the Data… to the Money

April 12, 2018

  • Blog
  • Archive

Verizon DBIR 2018


Oh, the joy of joys! It’s that time of year again! No, not the Holidays. It’s Verizon Data Breach Investigations Report season –that special time of year when we are most painfully reminded of how far we haven’t come in securing our systems, applications and data. But, hey, we’re not alone, right? This year’s report is packed full of useful data intended to help ensure you’ve addressed all the low hanging fruit required to help secure your environment.

In comparing this year’s findings to years past, there is one theme that stands out amongst the noise: Follow the data to the money. Analysts have coined this concept Infonomics – the value and economics of information. If you consider the industries that are most targeted, the methods utilized by attackers, the insiders in cahoots, and the ultimate motive, it’s pretty clear that it’s all about the data – or, more precisely, it should be about protecting it against unwanted access.

In this blog, I will review the data points that stood out and helped form this conclusion. First up, let’s look at the verticals.

Industries

Physician, heal thyself!

Healthcare breaches jumped 81% – from 296 in 2016 to 536 in 2017 – with a greater insider threat than external threat. Some of this can be attributed to errors, but looking deeper into the data the report shows privilege abuse behind 74% of cases. Whether it’s inadvertent curiosity or a malicious attempt at accessing the Holy Grail of data – personal + health + payment – an 81% jump is not healthy. (See what I did there?)

Looks like you’ll be staying with us for two nights. Would you like an upgraded threat view?

Looking at data in the Accommodation industry vertical, breaches related to privilege misuse jumped from 5 in 2017 to 302 in 2018. That’s like a 5,940% increase, putting Accommodation at the concierge level in terms of risk. It’s no wonder, though. As with Healthcare, Accommodation/Hotel information stores contain a wealth of customer information – payment, personal preferences, rewards, and more.

Small businesses suffer disproportionately

Breaches affecting small businesses grew from 22% in 2017 to 58% in 2018. Often strapped for resources – people, budget, technology – small businesses are both the engine of our economy and a ripe target for cyber-attacks. Please see the figure from this year’s DBIR (page 5) at right. The one with the really subtle callout.

blog-verizon-dbir-2018-a.jpg

Public Sector – Still a yuuuuuuuuuuuuge problem

Despite your perspective on what’s going on in Washington, you have to admit that public service is a noble professional calling. Looking at Figure 39 from this year’s report, though, shows a decidedly ignoble pattern– Privilege Misuse. The data tells us that most often the misuse is privilege abuse (78%), which of course is using existing privileges in a manner that is unauthorized and/or out of policy. Cyber espionage notwithstanding, with Edward Snowden and Reality Winner in mind, it’s imperative to have privileged password and least privilege management solution in place to assign accountability and control over the keys to the kingdom, while balancing that out with user behavior analysis to map patterns of access.

blog-verizon-dbir-2018-b.jpg

Insider or Outsider?

Next up, let’s look at how the mix of outsider vs. insider breaches has changed over the years. We learn from the 2018 report that 73% of breaches were perpetrated by outsiders, and 27% by insiders. Although only subtly different from 2017 (75%/25%, respectively), take the long view. Breaches involving insiders has increased from around 20% three years ago to nearly 30% today. Digging in a little deeper into the actor, we see that the system admin (26%) (72/277 breaches) is the #1 culprit. Not every case was malicious, of course. Sometimes the processes can be sloppy, the oversight minimal, and workload too burdensome. That’s why it’s so important to have automated systems for password management, privileged session monitoring and privilege delegation – to provide the control and accountability so admins can be productive with less concern for the impact of mistakes.

Other Interesting Trends

Use of stolen credentials (hacking) is the #1 action variety in breaches again this year at 22% (399/1,799 breaches), with privilege abuse coming in at #4. See Figure 5 from this year’s report (edited, with emphasis).

blog-verizon-dbir-2018-c.jpg

Credentials (11%) and Secrets (7%) are increasing in number year-on-year as data types compromised, as shown in this year’s report. This reaffirms that stolen credentials can be used to advance attacks and ultimately compromise other data types. As we saw with sysadmins and in the Public Sector above, this screams for a fully automated privileged credential management solution.

blog-verizon-dbir-2018-d.jpg

In looking at timelines in Figure 10 if this year’s report, compromises and exfiltration are happening in minutes, but discovery takes months, and containment days thereon.

blog-verizon-dbir-2018-e.jpg

Compare that to last year’s report and you see some consistency. Consider also that the average time to vulnerability resolution is 57 days, up from 30 days not so long ago.

blog-verizon-dbir-2018-h.jpg


Recommendations for Better Protecting Access to Your Data (And Therefore the Biggest Asset Your Organization Possesses)

Our recommendations aren’t that new. In fact, they’re quite similar to last year’s recommendations (and bear a striking resemblance to the year’s before that, too). Cybersecurity hygiene is key, and I detect a pattern. The reason is, most organizations still struggle with the basics. Here’s your top 5 list:

  1. Deploy patches for known vulnerabilities as soon as possible to mitigate the attack surface of external parties seeking to become insiders by leveraging credentials to move laterally throughout an organization. Lateral movement can lead an attacker to encrypt a file server or database, which the report tells us, is much more damaging than encrypting a single user device. (In fact, we just released new rules in PowerBroker for Windows that will help you detect lateral movement.)
  2. Deploy a password management solution that discovers every account in the environment, securely stores and manages credentials, requires an approval process for check-out, monitors activity while checked out, and rotates the credential upon check-in. Looks for a workflow-based process for obtaining privileges. If requests happen during normal business hours and within acceptable parameters, set auto-approval rules to enable access without restricting admin productivity. But, if time, day, or location indicators point to something out of band, deny it and investigate.
  3. Segment your network or implement a secure enclave that ensures all privileged accounts (employees, contractors, and third parties) do not have direct access to manage devices. This model ensures that only approved devices and restricted network paths can be used to communicate with secured resources.
  4. Enforce least privilege across your entire environment by removing local admin rights from end users, and restricting the use of admin and root account privileges to servers in your data center. Elevating rights to applications on an exception basis, and employing fine-grained policy controls once access is granted can quickly limit the lateral movement of would-be attackers.
  5. Implement multi-factor. Multi-factor authentication raises the bar given the number of breaches that involve weak, stolen or default credentials. As the report says (page 28), “… passwords, regardless of length or complexity, are not sufficient on their own.” Attackers need credentials to move laterally and multi-factor makes that movement more complex. When reviewing the need for multi-factor the only right answer is every user, every account.

At the end of the day, you have to understand what you’re protecting access to, and then build your defenses out from there. This year’s DBIR tells me it’s (still) all about the data – prioritizing and protecting it.

For more on how BeyondTrust can help you build out your data-centric security strategy, using privileged access and vulnerability management, contact us today.

Photograph of Morey J. Haber

Morey J. Haber, Chief Security Officer, BeyondTrust

Morey J. Haber is the Chief Security Officer at BeyondTrust. He has more than 25 years of IT industry experience and has authored three books: Privileged Attack Vectors, Asset Attack Vectors, and Identity Attack Vectors. He is a founding member of the industry group Transparency in Cyber, and in 2020 was elected to the Identity Defined Security Alliance (IDSA) Executive Advisory Board. Morey currently oversees BeyondTrust security and governance for corporate and cloud based solutions and regularly consults for global periodicals and media. He originally joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition where he served as a Product Owner and Solutions Engineer since 2004. Prior to eEye, he was Beta Development Manager for Computer Associates, Inc. He began his career as Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelor of Science degree in Electrical Engineering from the State University of New York at Stony Brook.

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

You May Also Be Interested In:

Whitepapers

Microsoft Vulnerabilities Report 2022

Whitepapers

Cybersecurity Insurance Checklist

Whitepapers

Privileged Access Management: PAM Checklist

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support
  • Cloud Privilege Broker

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Podcast
  • Videos
  • Webcasts
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press
BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2022 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.