Data insecurity on the rise

Cloud computing and web-based applications have emerged as a serious cybersecurity vulnerability worldwide, with attacks on web apps accounting for 43% of breaches, more than double the proportion from 2019, according to the recent Verizon Business 2020 Data Breach Investigations Report (DBIR).

The report also showed that while most breaches (72%) targeted large businesses, attackers are also focusing on a growing number of smaller organisations that have moved their operations to the cloud.

To create the report, now in its 13th year, the DBIR team examined 16 business sectors and analysed 32,002 security incidents and 3,950 confirmed breaches. The team concluded that most organisations should focus the bulk of their security efforts on credential theft, social attacks, and human error. The report also cautioned that employees working from home could be particularly vulnerable to attacks.

The DBIR cited stolen credentials and social attacks, such as phishing and business email compromises, as two of the most common types of data breaches. Hacking accounted for 45% of breaches, and social attacks accounted for 22%. Human error caused 22% of all breaches included in the study.

Personal information is increasingly a prime target for thieves, according to the report, which found that personal data was involved in 58% of breaches, nearly double the percentage from last year. These thefts included email addresses, names, phone numbers, physical addresses, and other types of data found in email or stored in databases.

In addition, the DBIR team discovered that malware accounted for 17% of stolen data, and that of all malware incidents, 27% could be attributed to ransomware. The report also found that 18% of organisations blocked at least one piece of ransomware this year, and warned that organisations cannot afford to ignore its existence.

Organised crime responsible for many attacks

The report also reveals that outsiders are at the heart of most violations. In fact, external actors caused 70% of the data breaches this year, with organised crime accountable for more than half.

Corporate data breaches and business email compromises resulted in losses averaging $32,200 per incident, up from $29,300 a year prior.

The report also contained some positive news, finding that most organisations are doing a good job of patching weak aspects in their systems.

The DBIR emphasised that businesses must continue to be vigilant, to consistently manage internet-facing assets, and to avoid creating dangerous holes in their defences.

Security tools also are getting better at blocking common malware. DBIR data shows that Trojan-type malware, which peaked as a cause of breaches at just under 50% of all cases in 2016, has since dropped to just 6.5%.

— Teri Saylor is a freelance writer based in the US. To comment on this article or to suggest an idea for another article, contact Drew Adamek, an FM magazine senior editor, at Andrew.Adamek@aicpa-cima.com.