2018 Verizon Data Breach Report Finds That Ransomware Attacks Doubled Last Year

While cryptominers are on the rise, ransomware was the most prevalent form of malware in 2017, according to the 2018 Verizon Data Breach Report, released last week. Ransomware made its first appearance in Verizon’s 2013 report, and this is the second year in a row in which ransomware incidents doubled.

The 2018 Verizon Data Breach Report, which analyzed over 53,000 security incidents and more than 2,200 breaches, explained that the enduring popularity of ransomware makes sense from a cyber criminal’s perspective:

• Ransomware attacks are inexpensive to launch and pose very little risk to attackers.
• Attackers get paid right away instead of having to wait to sell stolen data.
• Ransomware is flexible; it can be used against both individuals and organizations.
• When used against organizations, it can cripple multiple computers at once, thus giving the attackers leverage to demand very large ransoms.

The healthcare industry continues to be plagued by ransomware attacks. While ransomware was responsible for 39% of incidents involving malicious code overall, in the healthcare industry, that figure was 85%. Further, 24% of breaches in the 2018 Verizon Data Breach report involved healthcare organizations, and healthcare was the only industry in which the majority of threat actors were insiders.

It is important to note that while ransomware was the most common type of malicious software, denial of service (DoS) attacks were 27 times more common.

Other notable findings from the 2018 Verizon Data Breach Report include:

• When breaches are successful, the time to compromise is very short, measured in seconds or minutes. Conversely, discovery takes weeks or months; 68% of breaches take months or longer to detect. Breach mitigation takes weeks or months more.
• About three-quarters of cyber attacks are financially motivated. However, in the public sector and the manufacturing industry, the majority of breaches were cyber espionage attacks that sought to steal secrets.
• 58% of victims were categorized as small businesses.
• While nation-state hackers continue to grab headlines, and the threat they pose shouldn’t be ignored, they represented only 12% of all breaches in the Verizon report. Cyber attacks by organized crime groups were far more common; they were responsible for half of all breaches.
• While 78% of people did not click on a single phishing email all year, an average of 4% of people will click – and it only takes one click for a hacker to get into an enterprise system. Further, those same 4% of people tend to be repeat offenders; they’ve never seen a phishing link they didn’t like, and they’ll click again and again.
• Companies are three times more likely to be breached as the result of a social engineering attack than an actual vulnerability.

Lessons from the 2018 Verizon Data Breach Report

When developing proactive cyber security defenses, it is critical to understand the specific threats that organizations in your industry are most likely to face. For example, the healthcare industry is struggling with ransomware; the public sector and the manufacturing industry are most likely to face cyber espionage threats; and accommodation and food services attacks are dominated by POS system breaches.

Cyber security tips that apply to all industries include:

• Stay on top of your systems and users; monitor your network for suspicious behavior.
• Give employees the minimum amount of system access they need to perform their jobs, and no more.
• Ensure that your employees receive comprehensive and ongoing training in best cyber security practices.
• Employ two-factor authentication to prevent hackers from being able to use stolen credentials.
• Always back up your systems and data, and encrypt sensitive data so that it’s useless even if it is stolen.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

The Under Armour breach provides lessons in the do’s and don’ts of enterprise cyber security and compliance with the EU GDPR

Last week, athletic apparel manufacturer Under Armour announced that its popular MyFitnessPal weight loss and fitness tracking app had been hacked, compromising 150 million accounts. The Under Armour breach is the largest data breach so far this year and ranks among the top five to date. It also makes a good case study in the do’s and don’ts of enterprise cyber security. Let’s examine the lessons enterprises can take away from the Under Armour breach and its fallout, especially as the deadline for the EU GDPR approaches on May 25.

If a breach does happen, prompt disclosure is crucial.

The Under Armour breach was discovered on March 25 and disclosed only four days later; compare this to Equifax, which waited several weeks to notify users it had been hacked (and then chose to do so while the nation’s attention was focused on Hurricane Irma), and Uber, which waited more than a year (after attempting to cover the breach up). Prompt disclosure is going to be even more important under the GDPR, which will require organizations to report breaches within 72 hours.

Segment your data, and collect only the data you need.

The Under Armour breach involved only user names, email addresses, and encrypted passwords. The MyFitnessPal app does not collect Social Security numbers or other government identifiers, and payment information is stored separately, in a part of the system the hackers did not breach.

The GDPR requires organizations to bake data security into their products, policies, procedures, and systems from day one. While network segmentation alone does not constitute data security, it goes a long way towards demonstrating due diligence.

The GDPR will also require organizations to provide users with a plain-language explanation of what user data they are collecting and what they intend on doing with it. If you don’t absolutely need a particular piece of personal information to conduct your business, don’t collect it.

Properly encrypt and salt user passwords.

This is where Under Armour dropped the ball. The company states that while “the majority” of the compromised passwords were hashed using the robust bcrypt hashing function, at least some of the passwords were hashed using the notoriously hackable SHA-1 function. Under Armour has not disclosed why only some of the passwords were encrypted with bcrypt. It also has not specified whether the bcrypt-hashed passwords were salted for extra protection, which involves appending random data that is unique to each user and saving it along with their password.

To properly protect user passwords and fulfill the security requirements of the GDPR, make sure you are using a robust hashing function and salting user passwords. As strong as bcrypt is, it is not unbreakable; the Ashley Madison hack involved 36 million passwords hashed using bcrypt.

Do not reuse passwords.

Although the Under Armour breach yielded “only” email addresses and login credentials, not payment data or sensitive personal data like Social Security Numbers, a lot of people use the same set of login credentials on multiple sites. Armed with these credentials, hackers could attempt to use them on banking, shopping, or social media sites and to access victims’ email accounts. This underscores the importance of using a different, strong password for every system, website, and app.

If you have a MyFitnessPal account, you should log in and change your password right now. If you reused your MyFitnessPal password on any other sites, make sure to change those, too.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

Proactive Steps to Promote Employee Cyber Security Compliance

Your organization’s people are your first line of defense against cyber criminals. Unfortunately, they’re also your weakest link. Insiders pose the biggest threat to cyber security in the healthcare industry, and only 13% of public sector employees “take personal responsibility for cyber security.” Here are 10 proactive ways to improve employee cyber security compliance.

Employee Cyber Security Training Should be Mandatory & Continuous

The cyber threat environment is constantly changing, so employee cyber security training is not “one and done.” It is a continuous process that should begin during the onboarding process and continue throughout the employee’s tenure.

Employee Cyber Security Training Is About More than Compliance

Many healthcare organizations make the mistake of focusing employee cyber security training exclusively on HIPAA compliance, and organizations in other industries can fall into similar traps. While compliance is important, it does not automatically equate to cyber security.

Keep Employee Cyber Security Rules & Procedures Simple

Often, employee cyber security manuals are written by the IT department or security personnel, who may fill them with so much “tech-speak” that they require a degree in computer science to decipher. Make sure that your rules and procedures are written in plain language that non-IT employees can easily understand.

Everyone Needs to be Trained

Cyber security is everyone’s responsibility. This includes all levels of employees, from the C-suite down to the receptionist. Don’t forget about part-time employees, seasonal workers and other temps, even interns. Everyone in your organization who has access to a computer must be trained on cyber security best practices.

Have Clear Cyber Threat Reporting Procedures

If one of your employees receives a suspicious email or finds a flash drive on the floor, who should they report the incident to, and how? Make sure your employees know exactly what to do next.

Tie Workplace Cyber Security to Personal Cyber Security

Illustrating why cyber security hygiene is important both in and outside the office is a great way to reinforce training lessons and bolster employee buy-in. Use real-world examples that employees can relate to, such as phishing scams that seek to steal personal account credentials.

Employ User Behavior Analytics & Continuous Monitoring

User behavior analytics, paired with continuous monitoring of network activity, protect your organization on two fronts. First, they allow you to identify employees who are snooping around in areas of your system they don’t need to access to do their jobs. Second, they allow you to identify stolen credentials by flagging logins at odd hours and/or from unusual locations. In either case, you can set up the system to temporarily suspend access until you determine what’s going on.

Regularly Review Employee System Access

The best way to ensure that employees don’t misuse their credentials is to prevent them from doing so in the first place. Employees should be given the minimum amount of system access to perform their jobs, and no more. Access levels should be regularly reviewed for appropriateness.

Don’t Flog Employees for Making Mistakes

Even the most diligent employee can make a mistake. If employees fear being fired for inadvertently clicking on a phishing link, not only will they not report the incident; they may try to cover it up, which could make things even worse. Encourage employees to report missteps as soon as possible, and ensure them that they won’t be disciplined for doing so.

Reward Employees for Good Cyber Behavior

In addition to not beating your employees with sticks, offer some carrots. Recognize employees who flag phishing schemes and other attempted cyber attacks.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.