[author: Kelly Sweeney]

We follow the Verizon Data Breach Investigation Report each year. It just hit the news stand and as always, is full of insights.

The report collected data from 65 organizations in 84 countries, including 42,068 cybersecurity incidents and 1,935 data breaches.

The major themes of the report are:

• No one thinks it’s going to be them. Until it is.
• Organizations think they’ve got the basics covered.
• People are also still failing to set strong passwords.
• People rely on how they’ve always done things.

The conclusion is that all organizations and industries are at risk of cyber-attacks, and 61 percent of the data breaches experienced by those responding were companies with less than 1,000 employees.

The report notes that although targeted attacks on organizations do occur, most of the attacks by cyber-criminals were “opportunistic.” This means that the attackers gained access to systems though vulnerabilities that have not been addressed by the company, employee errors and “poor choices of cybersecurity solutions that fail to protect against the latest threats.” This conclusion is important, and stresses the importance of choosing new tools and technology solutions that are protecting the organization in the era of new attacks.

Shockingly, the report notes that 81 percent of hacking related breaches were caused by stolen or weak passwords. The message there is to implement a strong password protocol.

Malware and ransomware continued to be an issue with employees opening infected email attachments. The report concluded that in 66 percent of the cases they reviewed, the infection was caused by an employee clicking on an infected attachment or link in an email. The statistic was 1 in 14 employees did so. The report suggests that employees be trained on phishing emails, but that single training sessions are not enough—employees should receive different modes of training in order to become more aware about security.

Another interesting conclusion in the report is that the healthcare industry is the only industry where the biggest threat is insiders. 68 percent of the breaches suffered by the healthcare industry involved internal threats. Of those incidents, 81 percent of healthcare data breaches involved the loss of theft of equipment or documents, unintentional errors by employees or privilege misuse (i.e., looking at someone’s information without a treating relationship). The Report notes the importance of paper documents in assessing risk in health care organizations.

All in all, the Verizon report continues to provide a reality check on what is going on in the industry—which we are experiencing—and provides practical solutions to enhance security in all organizations.

[View source.]