2021 Verizon Data Breach Report | Avast

https://blog.avast.com/2021-verizon-data-breach-report-avast

This years report records a rise in ransomware in addition to a jump in social engineering-based breaches

Image credit: Gabriel Bassett (GitHub).
One interesting modification from in 2015s report is that total breach trends have followed comparable patterns, no matter the size of the organization impacted. A total of a thousand events and 260 breaches were confirmed from smaller sized businesses or those with less than 1,000 workers. The distinctions between the smaller sized and bigger organizations have mostly vanished from the DBIR in 2020.
” Last year we reported that smaller organizations appeared to be doing better in terms of finding breaches faster than their bigger counterparts. This years information shows that big companies have made a shift to discovering breaches within Days or less in over half of the cases (55%), while small organizations fared less favorably at 47%.” The report also found that “you dont need to be a big company to have a great chance that a person of your members has gotten a malicious URL and even set up a harmful Android app.” As soon as your company has more than 100 approximately workers, the chances are almost 100% that both of these occasions will take place to someone in your business.

More reading: How do hackers enter into a businesss network?Cybersecurity finest practices for small to mid-sized businesses.

What a year it has actually been. Absolutely nothing delineates things more than reviewing the annual Verizon Data Breach Investigations Report (DBIR), which was published earlier this month. We wrote about in 2015s DBIR at this time of year. To revitalize your memory, its based on Verizons assessment of breach information coming from a range of sources called VERIS.
This year, there are links to its open source collection (if you wish to do your own analysis), or a link to file your own (and anonymous) report in the interests of overall openness. Verizons group evaluated more than 29,000 events and 5,000 real breaches.
The report states, “breaches are moving toward social and webapp vectors, and those are ending up being more server based, such as collecting credentials and utilizing them against cloud-based e-mail systems.”
To no surprise, phishing increased from 25% of breaches in 2019 to 36% in 2020, aided by the various Covid-themed lures. Ransomware loomed large and doubled its frequency from 2019 to 2020 to 10% of the breaches, as you can see in the below chart..

Image credit: Gabriel Bassett (GitHub).
The report points out an unpleasant pattern where “actors have adopted the new strategy of stealing the data and publishing it instead of just encrypting it.” In half the events reported, the large bulk of funds that were paid for ransoms– 99%– were kept in accounts that were consequently frozen and eventually recovered. The report recommends that “If your organization experiences an event, we highly recommend that you call the regional branch of your nationwide law enforcement and seek their assistance. Or, better yet, be familiar with them prior to the breach happens!”.
In addition to the increase in ransomware, another trend is a dive in social engineering-based breaches, which continues this growth that was first reported back in 2017. The report states this is connected to the rise in cloud-based e-mail compromises. One big part of social engineering is the success or failure of various phishing lures. The DBIR evaluated 150 various phishing templates in this years report and examined the click-through rate, as revealed in the chart below. While there is a broad variety of success rates, the general average has actually decreased to three percent.
Image credit: Gabriel Bassett (GitHub).
A big part of social engineering-based attacks were business email compromises, whereby attacks pretend they are a manager at your business and try to get you to do their bidding. In the past year, there has actually been a dive to nearly 10% of all non-denial-of-service (DoS) events. Back in 2016, these attacks were less than one percent of these events, and over half of these compromises resulted in real payouts to the assaulters.
Mentioning DoS, you can see its continual rise with time, with it as soon as again being the leading event cause. DoS occurrences have an average attack rate of 1.3 Gbps, which is close to what was observed last year.

Absolutely nothing defines things more than evaluating the annual Verizon Data Breach Investigations Report (DBIR), which was published earlier this month. In addition to the rise in ransomware, another pattern is a dive in social engineering-based breaches, which continues this development that was initially reported back in 2017. The DBIR examined 150 various phishing templates in this years report and took a look at the click-through rate, as revealed in the chart below. One interesting modification from last years report is that total breach trends have actually followed comparable patterns, no matter the size of the organization affected.” Last year we reported that smaller sized companies seemed to be doing much better in terms of finding breaches more rapidly than their bigger equivalents.