2018 Verizon Data Breach Report Finds That Ransomware Attacks Doubled Last Year

While cryptominers are on the rise, ransomware was the most prevalent form of malware in 2017, according to the 2018 Verizon Data Breach Report, released last week. Ransomware made its first appearance in Verizon’s 2013 report, and this is the second year in a row in which ransomware incidents doubled.

2018 Verizon Data Breach Report Finds That Ransomware Attacks Doubled Last Year

The 2018 Verizon Data Breach Report, which analyzed over 53,000 security incidents and more than 2,200 breaches, explained that the enduring popularity of ransomware makes sense from a cyber criminal’s perspective:

Ransomware attacks are inexpensive to launch and pose very little risk to attackers.
Attackers get paid right away instead of having to wait to sell stolen data.
Ransomware is flexible; it can be used against both individuals and organizations.
When used against organizations, it can cripple multiple computers at once, thus giving the attackers leverage to demand very large ransoms.

The healthcare industry continues to be plagued by ransomware attacks. While ransomware was responsible for 39% of incidents involving malicious code overall, in the healthcare industry, that figure was 85%. Further, 24% of breaches in the 2018 Verizon Data Breach report involved healthcare organizations, and healthcare was the only industry in which the majority of threat actors were insiders.

It is important to note that while ransomware was the most common type of malicious software, denial of service (DoS) attacks were 27 times more common.

Other notable findings from the 2018 Verizon Data Breach Report include:

When breaches are successful, the time to compromise is very short, measured in seconds or minutes. Conversely, discovery takes weeks or months; 68% of breaches take months or longer to detect. Breach mitigation takes weeks or months more.
About three-quarters of cyber attacks are financially motivated. However, in the public sector and the manufacturing industry, the majority of breaches were cyber espionage attacks that sought to steal secrets.
58% of victims were categorized as small businesses.
While nation-state hackers continue to grab headlines, and the threat they pose shouldn’t be ignored, they represented only 12% of all breaches in the Verizon report. Cyber attacks by organized crime groups were far more common; they were responsible for half of all breaches.
While 78% of people did not click on a single phishing email all year, an average of 4% of people will click – and it only takes one click for a hacker to get into an enterprise system. Further, those same 4% of people tend to be repeat offenders; they’ve never seen a phishing link they didn’t like, and they’ll click again and again.
Companies are three times more likely to be breached as the result of a social engineering attack than an actual vulnerability.

Lessons from the 2018 Verizon Data Breach Report

When developing proactive cyber security defenses, it is critical to understand the specific threats that organizations in your industry are most likely to face. For example, the healthcare industry is struggling with ransomware; the public sector and the manufacturing industry are most likely to face cyber espionage threats; and accommodation and food services attacks are dominated by POS system breaches.

Cyber security tips that apply to all industries include:

Stay on top of your systems and users; monitor your network for suspicious behavior.
Give employees the minimum amount of system access they need to perform their jobs, and no more.
Ensure that your employees receive comprehensive and ongoing training in best cyber security practices.
Employ two-factor authentication to prevent hackers from being able to use stolen credentials.
Always back up your systems and data, and encrypt sensitive data so that it’s useless even if it is stolen.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

The Under Armour breach provides lessons in the do’s and don’ts of enterprise cyber security and compliance with the EU GDPR

Last week, athletic apparel manufacturer Under Armour announced that its popular MyFitnessPal weight loss and fitness tracking app had been hacked, compromising 150 million accounts. The Under Armour breach is the largest data breach so far this year and ranks among the top five to date. It also makes a good case study in the do’s and don’ts of enterprise cyber security. Let’s examine the lessons enterprises can take away from the Under Armour breach and its fallout, especially as the deadline for the EU GDPR approaches on May 25.

Cyber Security Lesson Brief from the Under Armour Breach

If a breach does happen, prompt disclosure is crucial.

The Under Armour breach was discovered on March 25 and disclosed only four days later; compare this to Equifax, which waited several weeks to notify users it had been hacked (and then chose to do so while the nation’s attention was focused on Hurricane Irma), and Uber, which waited more than a year (after attempting to cover the breach up). Prompt disclosure is going to be even more important under the GDPR, which will require organizations to report breaches within 72 hours.

Segment your data, and collect only the data you need.

The Under Armour breach involved only user names, email addresses, and encrypted passwords. The MyFitnessPal app does not collect Social Security numbers or other government identifiers, and payment information is stored separately, in a part of the system the hackers did not breach.

The GDPR requires organizations to bake data security into their products, policies, procedures, and systems from day one. While network segmentation alone does not constitute data security, it goes a long way towards demonstrating due diligence.

The GDPR will also require organizations to provide users with a plain-language explanation of what user data they are collecting and what they intend on doing with it. If you don’t absolutely need a particular piece of personal information to conduct your business, don’t collect it.

Properly encrypt and salt user passwords.

This is where Under Armour dropped the ball. The company states that while “the majority” of the compromised passwords were hashed using the robust bcrypt hashing function, at least some of the passwords were hashed using the notoriously hackable SHA-1 function. Under Armour has not disclosed why only some of the passwords were encrypted with bcrypt. It also has not specified whether the bcrypt-hashed passwords were salted for extra protection, which involves appending random data that is unique to each user and saving it along with their password.

To properly protect user passwords and fulfill the security requirements of the GDPR, make sure you are using a robust hashing function and salting user passwords. As strong as bcrypt is, it is not unbreakable; the Ashley Madison hack involved 36 million passwords hashed using bcrypt.

Do not reuse passwords.

Although the Under Armour breach yielded “only” email addresses and login credentials, not payment data or sensitive personal data like Social Security Numbers, a lot of people use the same set of login credentials on multiple sites. Armed with these credentials, hackers could attempt to use them on banking, shopping, or social media sites and to access victims’ email accounts. This underscores the importance of using a different, strong password for every system, website, and app.

If you have a MyFitnessPal account, you should log in and change your password right now. If you reused your MyFitnessPal password on any other sites, make sure to change those, too.