Townsend Security Data Privacy Blog

Verizon 2022 Data Breach Investigations Report (DBIR)

Posted by Patrick Townsend on Jun 14, 2022 2:10:41 PM

I really like the annual Verizon Data Breach Investigations Report. The Verizon team succeeds at making the report detailed enough to be helpful, but also easy to read. The 2022 DBIR report is now out and it is a good read (see the link below to get the report). Here are just a few of my take-aways on the new report.

Phishing and stolen credentials are still the most common pathways to a ransomware infection and a data breach. Cybercriminals use phishing emails with poisoned links or attachments to break into your local system, and then worm their way into the IT infrastructure of your company or organization. Also, cybercriminals leverage the gains of past work to use compromised credentials to break into your systems. Because we humans tend to re-use our passwords, or use weak passwords, stolen credentials are one of the main ways criminals get access to our systems. There are other methods of compromise, but phishing and compromised credentials are the most common ways of gaining access. More on what you can do below. Encryption Strategies for VMware Environments

We are still very much reliant on email to conduct our work. Yes, we use other messaging methods like Slack and Microsoft Teams, but we still tend to use a lot of email. Cybercriminals know they can target us through phishing emails. And we shouldn’t be naïve. These emails are now very sophisticated and can be hard to recognize. They look like the come from a colleague, or business partner, or vendor, or even our family members. But they contain deadly links and attachments.

What can we do thwart phishing emails? Here are a few of the ways we can protect ourselves:

  • Conduct employee training on how to detect phishing emails. It is amazing how effective this can be. We do this at Townsend Security on a regular basis. And there is a bonus for acing the test! Full disclosure – I did not ace the test the last time, but I learned a lot from the exercise and we will do it again.

  • An overlooked way to minimize the threat is to use an email service that builds in phishing email protection. Here at Townsend Security we use commercial Google Gmail infrastructure which helps in this area, but other email systems also provide this. If you are on an older email server infrastructure, it makes sense to migrate now.

  • You should also disable macros in Word and Excel. Never allow code to execute from an untrusted party, and always be suspicious even if you think you know the person sending the email to you. If you are not expecting the email with an attachment or link, do not trust it. I’ve often just picked up the phone and called the sender to check.

Stolen credentials are also a big problem. Here are a few steps you can make to minimize this threat:

  • Activate Multi-Factor Authentication (MFA) on all of your important accounts. This will go a long way to preventing the use of stolen credentials. Applications like Authy or Google Authenticator can make this easier.

  • Use strong passwords and avoid re-using a password. This is incredibly hard without the use of a password manager. There are many password managers that you can use. LastPass and 1Password come to mind. But there are others.

  • Periodically check to see if your credentials have leaked. Use the “Have I Been P0wnd” website to check your email address. If you use the Google Chrome browser you can use the built-in feature to show you where your passwords may have been leaked.

When it comes to analyzing who the main targets are, the report is very helpful. Many of the industries come as no surprise. Banks and financial services are high on the list. And healthcare providers are right up there, too. But did you know that schools are a target? And technology companies? And manufacturers? It turns out that almost everyone is a target! The report breaks these vertical segments out in some detail and it is enlightening to research your own industry segment for helpful pointers on how attacks are likely to play out.

Here are a few other items in the report that I found interesting:

The SolarWinds attack was a supply chain attack that was surprising and new. It made the news because of its devastating and rapid spread. It represented a relatively new attack vector with a high level of sophistication. Related to this is a new focus by attackers on MSPs and ITSOs. MSPs represent a valuable target as they often provide access to a large number of downstream end customers. Perhaps because of the SolarWinds attack the federal government is trying to strengthen the security posture of its suppliers. The new CMMC regulations are a part of this.

Ransomware is still on the rise. In spite of the fact that we are now quite aware of ransomware and how it works, it is increasing in terms of the frequency and number of attacks. This is probably because the attackers find it easy to execute and because it is so profitable. While the Verizon report does not talk much about data exfiltration due to ransomware, this is now a part of most ransomware attacks. If you don’t pay the ransom you will be threatened with the release of your sensitive data. That’s why we here at Townsend Security have been talking about encrypting all of your sensitive data.

In the past the health industry was a target due to the availability of patient medical information. Now the health industry is a target because of Personally Identifiable Information (PII). Perhaps this is because medical records systems are better at protecting patient medical information, but have not yet extended protections to good old PII?

Manufacturers are an increasing target. In the past manufacturers were the target of espionage efforts for IP theft. This is still true, but now the ransomware attackers are looking for quick gains from manufacturers. Espionage attacks are harder to detect as the attacker often does not want to be discovered. On the other hand, ransomware attackers WANT you to know they are there! And manufacturers are motivated to quickly make ransom payments in order to get their facilities back up and running.

If I did not mention your industry segment be sure to read the report. It covers a lot of different segments!

Hey, small businesses – heads up! You are now a prime target of ransomware attacks. You might be thinking that you are small fish and not worth the bother. That’s not true – payment of a small ransom is just fine for attackers. No more putting our heads in the sand. From the Verizon report:

“Contrary to what many may think, very small organizations are just as enticing to criminals as large ones, and, in certain ways, maybe even more so. Threat actors have the “we’ll take anything we can get” philosophy when it comes to cybercrime. These incidents can and have put small companies out of business. Therefore, it is crucial that even very small businesses (10 employees or less) should take precautions to avoid becoming a target.”

Small businesses especially need to improve their security around phishing and stolen credentials. If you are a small business and are being served by an outside Managed Service Provider, contact us. We have a special program that will empower your MSP to deliver encryption of sensitive data at a very reasonable cost.

The Verizon report doesn’t just tell us what happened. It gives some good pointers on what we can actually do to help prevent a data breach. See page 76 of the report for a very practical and achievable set of steps you can start taking right now.

If you are a security professional, this report is well worth a read. It helps us understand the mindset of the cybercriminal and how their techniques are evolving. If you are not a security professional, you might also like to peruse this report. It is very readable and even has some not-so-lame humor!

Patrick

Resources:

The Verizon Data breach report:

https://www.verizon.com/business/resources/reports/dbir/

CISA ransomware prevention guidance:

https://www.cisa.gov/sites/default/files/publications/CISA_MS-ISAC_Ransomware%20Guide_S508C.pdf

Google phishing training:

https://phishingquiz.withgoogle.com/

Have I been Pwnd:

https://haveibeenpwned.com/

New call-to-action

Topics: Encryption, Phishing, CyberSecurity

Gone ‘Phishin: Don't Be A Victim

Posted by Adam Kleinerman on Jun 29, 2012 6:49:00 AM
phishing

In May 2012, the Commodity Futures Trading Commission (CFTC) was the victim of a fairly high profile security breach. The breach occurred when a CFTC employee opened a suspicious email that turned out to be part of a “phishing” scheme. Phishing is a type of cyber crime where a hacker, posing as a legitimate company, gains access to a user’s private information when that user opens the fake email.

These emails often appear to be messages from large, well-known organizations that you may or may not be affiliated with or a customer of, such as cellular service providers, banks, or insurance agencies. The messages often contain fake bill statements with requests for payment, or requests for password or address changes. Once a user clicks on the email or the links provided in the email, the hacker gains access to personal information that can then be used for identity theft and other kinds of fraud.

In an official statement by the CFTC, chief information officer John Rogers revealed that the personal information stolen by the phishing scheme was largely social security numbers. However, Rogers asserted that CFTC operations would not be affected by damages due to the breach. This is, in general, is true for large organizations and corporations who can often afford to absorb the high cost of these setbacks. Rarely will these breaches affect them in the long run. Smaller and mid-sized organizations, on the other hand, often have difficulty rebounding from data breaches and are always at a greater risk to phishing schemes and other types of data loss.

Here at Townsend Security we recommend to everyone who has a personal or work email to take care that they are sending and receiving messages from reliable sources. Red flags to look for include emails with offers that seem “too good to be true”, receiving a bill you don’t expect, unsolicited offers from any organization, or requests to change any type of personal information through a link provided in the email.

For more information on data privacy, download our podcast Data Privacy for the Non-Technical Person.  Patrick Townsend, our Founder & CTO, discusses what PII (personally identifiable information) is, what the most effective methods for protecting PII, as well as the first steps your company should take towards establishing a data privacy strategy.

Click me

Topics: Phishing, Data Privacy

Epsilon Data Breach - More Serious Than You Think

Posted by Patrick Townsend on May 17, 2011 12:00:00 AM

epsilon breachI found the data breach of Epsilon just shocking for several reasons:

First, the scope of the breach was astounding. About 2,500 companies are using Epsilon for email communications with their customers, and some of these companies are quite large. Thus the number of email addresses exposed was gigantic. You really have to wonder why those email addresses weren’t encrypted. Anyone would see those email addresses as a high value target. And email addresses are Personally Identifiable Information (PII), after all.

Second, you have to wonder why really large companies trusted Epsilon with their customer information without insisting on good data protection practices.  What were they thinking? When you hand over your data to an outside company, you aren’t off the hook if there is a data loss.  It wasn’t Epsilon who had to send emails and letters to customers. The originating companies bear the cost of that effort, and the business damage that follows.

Third, the loss of an email address is not trivial. It’s true that email addresses are more public than many bits of personal information we have. But email addresses are often used as account identifiers for on-line services. If I have your account ID it is a lot easier to attack your password credential. People are amazing lax about creating strong passwords. So the loss of emails provides one more weak link in the chain of security for individuals.

Then there are the phishing attacks. If I have your email address it is a lot easier to send you an infected PDF file. I just look on your company’s web site or Facebook page and find the name of your CEO. Then I send you an email with the CEO’s name and an infected PDF. Perhaps I name the PDF “Look at these terrible results!.pdf”. You are probably going to jump to open that one!  So now I have invaded your internal network.

You can see how this can really escalate to bad news for you and your organization.

The lesson for any organization is to do some due diligence with your service providers. Be sure they are protecting your information with the same level of care that you do. After all, you are on the hook if they lose your data.  For more information, download our white paper titled AES encryption and Related Concepts.

 

Click me

Topics: Encryption, Phishing, Data Breach, Personally Identifiable Information (PII)