2024 Verizon Data Breach Investigations Report: Key Findings and Recommendations

Introduction

The 2024 Verizon Data Breach Investigations Report (DBIR) marks the 17th edition of this comprehensive publication, aimed at shining a light on various cyber threats, actors, tactics, and targets. The report is based on the analysis of 30,458 security incidents, including 10,626 confirmed data breaches across 94 countries, reflecting the evolving landscape of cyber threats and their impact on organizations worldwide.

Key Findings

1. Increase in Vulnerability Exploitation:
   • Exploitation of vulnerabilities as a critical pathway to breaches almost tripled compared to the previous year, seeing a 180% increase.
   • Web applications are the main vector for initial entry points, often exploited through zero-day vulnerabilities such as the MOVEit vulnerability.
   • Ransomware and extortion-related attacks are predominantly utilizing these vulnerabilities, with attackers focusing on unpatched systems and weak security configurations.
2. Rise in Extortion Attacks:
   • Extortion attacks, including pure extortion and ransomware, now constitute roughly one-third of all breaches.
   • Traditional ransomware attacks have declined slightly, but extortion tactics have increased, resulting in a combined 32% of breaches.
   • The shift from encrypting ransomware to pure extortion is a notable trend, with threat actors leveraging stolen data for blackmail without necessarily encrypting systems.
3. Human Element:
   • The human element is involved in 68% of breaches, primarily due to phishing and social engineering attacks.
   • There has been an effort to exclude malicious privilege misuse from this metric to provide a clearer picture of what security awareness can mitigate.
   • Phishing remains a significant threat, with the median time to click on a malicious link being just 21 seconds after opening an email.
   • Business Email Compromise (BEC) incidents, often resulting from pretexting, have been particularly damaging, with median transaction amounts around $50,000.
4. Third-Party Breaches:
   • Breaches involving third parties, including partner infrastructure and software supply chain vulnerabilities, have increased by 68% from the previous year.
   • This trend highlights the importance of selecting vendors with strong security practices and conducting regular security assessments of third-party partners.
5. Errors and Misdelivery:
   • Breaches involving errors have risen to 28%, partly due to new mandatory breach notification entities being included in the data.
   • Misdelivery and misconfiguration are common error types, emphasizing the need for improved internal controls and employee training.

Incident Classification Patterns

The report categorizes incidents into several patterns based on the 4As of VERIS (Actor, Action, Asset, Attribute):

1. System Intrusion:
   • The most common pattern, accounting for 36% of breaches.
   • Characterized by sophisticated attacks leveraging hacking and malware, often resulting in ransomware deployment.
   • Vectors include direct install, web applications, email, and desktop sharing software.
   • Ransomware continues to be a significant threat within this pattern, accounting for 23% of all breaches.
   • Median losses for ransomware incidents are around $46,000, with initial ransom demands typically being 1.34% of the victim organization’s revenue.
2. Social Engineering:
   • Involves psychological manipulation of individuals to breach security.
   • Pretexting, a form of social engineering often resulting in Business Email Compromise (BEC), has risen significantly.
   • Phishing remains prevalent, with threat actors continuously refining their techniques to deceive users.
   • The median time to fall for phishing emails is less than 60 seconds.
3. Basic Web Application Attacks:
   • Targeting web applications to steal data or credentials.
   • This pattern has seen a decrease compared to previous years, possibly due to improved security measures and awareness.
   • Credential theft and exploitation of vulnerabilities are common tactics used in these attacks.
4. Miscellaneous Errors:
   • Unintentional actions compromising security, such as misdelivery and publishing errors.
   • This pattern has increased, highlighting the need for better internal controls and training.
   • Errors involving misconfiguration and accidental exposure of data are common.
5. Denial of Service (DoS):
   • Attacks aimed at compromising the availability of networks and systems.
   • Remains a prevalent threat across various industries, particularly targeting high-traffic websites and online services.
   • DoS attacks account for 59% of security incidents, emphasizing the need for robust network defenses.
6. Privilege Misuse:
   • Involves unauthorized or malicious use of legitimate privileges by insiders.
   • A significant portion of breaches in this pattern are driven by human error, such as employees accessing data they are not authorized to view.
   • The rise in insider threats highlights the need for stricter access controls and monitoring.
7. Lost and Stolen Assets:
   • Incidents involving missing information assets, whether through theft or misplacement.
   • This pattern underscores the importance of physical security and proper asset management practices.
   • Lost and stolen assets often lead to breaches involving sensitive data stored on the missing devices.
8. Everything Else:
   • Covers incidents that do not fit into the other patterns, acting as a catch-all for unique or less common attack vectors.
   • This category includes a diverse range of incidents, from physical breaches to environmental hazards impacting data security.

Industry and Regional Analysis

• Industries:
  • Financial and Insurance: Continues to be a prime target for cybercriminals due to the high value of financial data. Ransomware and web application attacks are prevalent.
  • Healthcare: Faces significant threats from ransomware and insider misuse, with attackers targeting sensitive patient data.
  • Public Administration: Often targeted by espionage-motivated attacks, particularly state-sponsored actors seeking sensitive government information.
  • Retail: Commonly affected by payment card skimming and credential theft, with a notable increase in attacks targeting e-commerce platforms.
  • Accommodation and Food Services: Targets include payment card data and reservation systems, often affected by ransomware and skimming attacks.
  • Educational Services: Increasingly targeted by ransomware and phishing attacks, with sensitive student data at risk.
  • Manufacturing: Faces threats from ransomware and intellectual property theft, often through compromised supply chains.
  • Professional Services: Highly targeted due to the valuable client data they handle, with a mix of ransomware, phishing, and insider misuse incidents.
• Regions:
  • North America: Shows a high prevalence of ransomware and extortion attacks, reflecting the region’s significant digital footprint and economic value.
  • Europe: Faces a mix of espionage and financially motivated attacks, with a strong regulatory environment driving better reporting and mitigation practices.
  • Asia-Pacific: Experiences a diverse range of attacks, including state-sponsored espionage and cybercrime targeting both public and private sectors.
  • Latin America: Primarily affected by financially motivated attacks, with a growing trend of ransomware and credential theft incidents.

Recommendations

1. Vulnerability Management:
   • Organizations should prioritize patching critical vulnerabilities and maintaining a robust vulnerability management program.
   • Regularly update and review security practices to adapt to evolving threats, ensuring timely application of patches and updates.
   • Consider implementing automated patch management solutions to reduce the window of vulnerability.
2. Human Element Mitigation:
   • Invest in comprehensive security awareness training to mitigate phishing and social engineering risks.
   • Implement policies and procedures to handle extortion and ransomware demands, ensuring employees are prepared to respond appropriately.
   • Conduct regular phishing simulations and provide feedback to employees to improve their ability to recognize and report phishing attempts.
3. Third-Party Risk Management:
   • Select vendors with strong security practices and regularly assess their security posture.
   • Include third-party risks in the overall security strategy and incident response planning, ensuring continuous monitoring of vendor security.
   • Establish clear security requirements and SLAs with vendors to ensure accountability.
4. Error Prevention:
   • Enhance internal controls to reduce errors and misdelivery incidents, incorporating automated checks and balances where possible.
   • Conduct regular audits and reviews to identify and mitigate potential error points, ensuring continuous improvement in error management.
   • Implement data loss prevention (DLP) technologies to detect and prevent accidental data leaks.
5. Incident Response:
   • Develop and maintain a robust incident response plan tailored to the organization’s specific threats and vulnerabilities.
   • Regularly test and update the plan to ensure effectiveness during actual incidents, incorporating lessons learned from past incidents.
   • Conduct tabletop exercises and simulations to ensure that all stakeholders understand their roles and responsibilities during an incident.
6. Secure Software Development:
   • Emphasize secure coding practices and conduct regular security assessments throughout the software development lifecycle.
   • Adopt a “secure by design” approach, incorporating security considerations from the initial stages of development.
   • Utilize automated tools for static and dynamic analysis to identify and remediate vulnerabilities early in the development process.
7. Advanced Threat Detection and Response:
   • Implement advanced threat detection solutions such as endpoint detection and response (EDR) and network traffic analysis.
   • Leverage threat intelligence to stay informed about emerging threats and adjust defenses accordingly.
   • Establish a security operations center (SOC) to continuously monitor and respond to security incidents in real-time.

Conclusion

The 2024 Verizon DBIR provides critical insights into the evolving threat landscape, highlighting the importance of proactive security measures and continuous adaptation to new threats. By understanding the common patterns and vectors of attacks, organizations can better prepare and defend against potential breaches, safeguarding their data and assets in an increasingly hostile cyber environment.