Report Reveals the Rise of Ransomware and Importance of the Human Element

The Verizon Data Breach Investigations Report is eagerly awaited each year. It provides a window into the world of global trends in security. This year’s analysis looked into 79,635 incidents around the world, of which 5,258 were confirmed data breaches.

Social engineering (primarily phishing) came up as the top avenue of incursion used in breaches. More than 30% of incidents stemmed from it, while web application attacks accounted for around 25% and system intrusions scored almost 20%.

Not surprisingly 85% of breaches included a human element with 61% involving credentials, and 13% containing ransomware. About 10% of the ransomware attacks cost organizations an average of about $1 million – whether from forking over the cash, remediation, or lost revenue.

Ransomware = Organized Crime

Organized crime is now behind four out of five breaches. In other words, the days of the lone hacker-genius-student sitting in an attic breaking into big government systems are behind us. These days, criminals are most often involved and their goal is money – as much as possible per breach. Yes, there is a little espionage going on, and perhaps a few lone wolves showing off their hacking prowess. But by and large, we are now dealing squarely with cybercriminals motivated by money and extortion.

The Verizon report emphasizes how hackers now use automation to quickly zero in on ripe areas.

“It’s important to limit your public facing attack surface, through asset management, defensive boundaries and intelligent patching.”

Another important finding is that it is not new vulnerabilities that cause the most trouble. It is old, unmitigated holes and vulnerabilities that are the most exploited.

“One might think that more recent vulnerabilities would be more common. However, as we saw last year, it is actually the older vulnerabilities that are leading the way. These older vulnerabilities are what the attackers continue to exploit. “

They give the example of the Microsoft Exchange Remote Code Execution Vulnerability (CVE-2021- 26855) that is being actively and massively exploited. Despite Microsoft issuing warning after warning, patches being in existence for months, and a barrage of news stories about this problem, organizations continue to be attacked due to not fixing this issue.

That’s why Verizon analysts condemn the ability of IT teams to keep up with the deployment of patches.

“The patching performance this year in organizations has not been stellar. Granted, it’s never been great.”

How to Greatly Reduce Cyber Risk

Those wishing to greatly reduce cyber risk, therefore, are advised to institute three practices.

1. Institute security awareness training to educate users into the many tricks and strategies of social engineering. Use this training to proof them up against phishing and other scams.
2. Automate patch management: Eliminate internal procedures that slow the deployment of patches. Instead of relying on someone in IT to review, test, and determine when and if a patch should be deployed, add automation to the process.
3. Conduct regular vulnerability scans to detect systems, apps, and devices that offer a potential pathway into the enterprise.

How Syxsense Can Help

Syxsense provides the answer to 2 and 3 above. It combines automated patch management with vulnerability scanning and IT management as a way to eliminate risk and plug the holes cybercriminals are using to institute ransomware and other forms of attack.

Top IT Security Trends of the Year

Gartner recently released a list of the top security trends. How have these changed since COVID-19 hit? What new trends have emerged? Which old ones remain as persisting challenges?

Here are some of the key ones noted in the report.

1. Staffing

Filling positions with skilled security personnel was a problem long before COVID-19 hit. And it remains a major issue today.

“The first challenge is a skills gap,” said Gartner Analyst Peter Firstbrook. “80% of organizations tell us they have a hard time finding and hiring security professionals and 71% say it’s impacting their ability to deliver security projects within their organizations.”

2. Remote Work

Gartner surveys show that as many as 40% of employees will continue to work from home post-COVID-19. Thus, the additional support and security measures that have been implemented for remote work since March of 2020 will have to be continued indefinitely. Not only that, security personnel will have to deal with some people working only in the office, some only from home, and many combining both.

A further wrinkle is that many offices are taking the opportunity to downsize. One example is an organization of 100 that is planning to have personnel work three days per week in the office. This means that 60 will be onsite at any one time. To address this change, office space is being reduced. Standard cubicles are being dispensed with and employees will be asked to hook up their laptops to available spaces.

Therefore, security staff will have to get used to new patterns of operation, revise policies and best practices, and implement new tools to deal with a more fluid workplace.

3. Identity First Security

Gartner defines identity first security as an approach that places identity front and center in security design. Instead of a disparate set of tools and applications, each with their own security methods, user identity becomes the key to accessing everything from anywhere on any device.

This includes being able to monitor authentication centrally across the enterprise, not just implementing point tools related to multi-factor authentication, single sign-on, or biometric authentication. Organizations will have to evaluate the value of buying new software and systems to implement identity first security against the desire to maximize earlier investments in point tools.

4. Tool Sophistication Grows

Cybercriminals have upped their game. The recent SolarWinds and Microsoft Exchange Server hacks demonstrate the extent and also the depth to which networks can rapidly be compromised.Therefore, security vendors have been forced to raise their game, too, with new technologies such as breach and attack simulation (BAS) tools.

BAS is all about continuously assessing the defensive posture of the organization rather than relying on occasional penetration tests to determine potential areas of exposure. The logic behind this is: why conduct penetration tests on a quarterly or annual basis when you can be doing it virtually all the time?

5. Vendor Consolidation

The modern-day security toolkit contains way too many individual elements. A Gartner survey of CISOs found that 78% have 16 or more cybersecurity tools. Incredibly, as many as 12% of organizations have 46 or more security applications. That’s bad news for IT as they have to integrate, correlate, manage and maintain all those systems. They have had enough of hopping from console to console to fix one issue or another. It is no wonder that mistakes happen and breaches occur.

An emerging element of strategy, therefore, is to consolidate toolkits to encompass a smaller set of vendors. The advantages include ease of implementation, stronger integration, and lowered costs. That’s why 4 out of 5 CISOs intend to consolidate vendors over the next three years.

“Having fewer security solutions can make it easier to properly configure them and respond to alerts, improving your security risk posture,” said Firstbrook.

Enhance Your IT Management and Security

Syxsense Secure is a patch management platform that includes IT management and vulnerability scanning in one console. It not only shows you what’s wrong, but also deploys the solution.

Gain visibility into OS and third-party vulnerabilities like defects, errors, or misconfigurations of components, while increasing cyber resilience with automated patching and security scans.