Ways to Navigate the Threat Landscape Conveyed in Verizon’s DBIR 2021

On May 13, Verizon released its Data Breach Investigations Report (DBIR) 2021. This annual publication serves many purposes. It yields context into what security analysts are seeing, for instance. But it also affects organizations’ security postures at an even higher level.

Here’s Anthony Israel-Davis, research and development manager at Tripwire, with more:

One thing that the DBIR does is it takes the things that are going on in the cybersecurity space, particularly with breaches and incidents, and breaks them down into something that is both interesting to look at from a statistics standpoint but then actionable to various industries or people who are actually doing the work to defend the enterprise. At a very high level, if you are a cybersecurity analyst and you’re in the trenches, this might be old news, but if you are doing strategy, if you’re trying to determine what to do in your space, this is a great report to understand what’s going on out there—especially year to year.

Of course, there are only so many initiatives that organizations can take on each year. Organizations therefore need to be strategic about what security priorities they elect to pursue. This reality raises some interesting questions. What if they don’t know which security objectives to take up? What if they’re looking to maximize the latest DBIR’s findings for the year ahead?

If organizations find themselves in that position, they can develop a multi-part strategy that focuses on some or all of the following five objectives.

Objective #1: Create a Phishing Awareness Program

In its DBIR 2021, Verizon explained that phishing continued its reign as one of the top Action varieties in breaches. But it also noted that phishing was more prevalent in 2020, accounting for 36% of breaches. That’s up from 25% a year prior, an increase which reflects the influx of pandemic-related phishing lures in the first half of 2020.

Acknowledging this growth of phishing, CISOs and other security professionals need to prioritize the creation of an anti-phishing program. Phishing attempts regularly target non-IT staff with convincing messages using psychological techniques to create a sense of urgency that motivates recipients to click. They thus need to invest in educating their personnel about phishing, making sure that everyone within their organization from HR to legal to R&D understands red flags to look for, how to report suspicious messages, and what to do if they clicked a link or opened a file contained within a phishing email.

Objective #2: Use the CIS Controls

At one point in its report, Verizon stated that “‘doing the basics’ will help against the vast majority of the problem space that is most likely to affect your organization.” Not every organization knows what “the basics” consist of. Fortunately, they can look to the CIS Controls.

A prioritized list of best practices maintained by the Center for Internet Security, the CIS Controls constitute a free, highly respected framework that organizations can use to ensure that they have the most important security controls in place. One way they can look at the fundamental security imparted by aligning with the CIS Controls is to think of their organization’s digital environment as a house. Without basic security in place, anyone can enter. Adhering to fundamental security controls—especially those listed in Implementation Group 1 of the CIS Controls v8—can help to close the windows, lock the doors, and put a standard security system in place. While nothing can completely eradicate the possibility of a break-in, implementing the CIS Controls can help to decrease the likelihood and impact of a breach.

Objective #3: Revisit Vulnerability Management

Verizon found in its DBIR 2021 that breaches involving older vulnerabilities were more common than those exploiting more recent weaknesses. Part of the reason for this trend is that organizations don’t always approach patching as a priority. In the absence of diligent patching practices, attackers can use the same exploits against the same vulnerabilities for years on end.

Organizations can do their part to address this trend by emphasizing vulnerability management (VM), the process of scanning networks for known vulnerabilities (often referring to a list of CVEs or “common vulnerabilities and exposures”) before prioritizing and remediating those vulnerabilities based on risk severity. Admittedly, one of the more difficult aspects of running a successful VM program is understanding which vulnerabilities to work on mitigating first. When vulnerabilities pile up, it can be a challenge to tell which ones are the most serious and potentially damaging. Organizations can therefore elect to work with advanced VM solutions that provide flexible, granular scoring systems for prioritizing known flaws.

Objective #4: Secure Public Cloud Assets

In this year’s publication, Verizon relayed that external cloud assets were more common than on-premises assets in both breaches and incidents. This observation highlights the need for organizations to understand their cloud security responsibilities. While their cloud security provider will safeguard the cloud infrastructure they are utilizing, it’s their responsibility to ensure that all their company data and processes added to the cloud are secure.

How do they do that? Advanced cloud account monitoring cybersecurity tools can scan their cloud accounts for the misconfigurations that could serve as open windows for attackers. For example, cloud monitoring tools can prioritize cloud account misconfigurations in order of risk level so they can address the most critical issues first. This will help them to keep their assets secure as their presence in the cloud continues to evolve and grow.

Objective #5: Prioritize Industrial Cybersecurity

Verizon witnessed threat actors preying on industrial environments, particularly those in the manufacturing sector. Indeed, researchers documented a 61.2% increase of ransomware’s part in malware-associated breaches involving manufacturing organizations over previous years. They also learned that personal data was the most compromised data type in those breaches.

Organizations can respond by prioritizing their industrial cybersecurity. In addition to educating their teams about the importance of cybersecurity for increasingly connected operational technology (OT) environments, for instance, one of the most important things they can do to secure the OT side of their organization is to implement an industrial visibility solution. Visibility starts with holistic asset inventory, so they can use a tool that shows them exactly what’s on their network via a complete inventory of hardware and software assets. They need to know who these devices are communicating to, know if their configurations are changing, know what vulnerabilities are applicable, and know what their logs are telling them. Once they achieve real-time visibility, they can then implement protective security controls and continuously monitor their environment.

More DBIR 2021 Insights Await

For more information about where to spend your time in the DBIR 2021, check out this resource published on the State of Security.