Denial of Service (DoS) attacks topped this year's list of security incidents in Verizon's Data Breach Investigations Report (DBIR), with 11,246 reported incidents and five confirmed data breaches.
Large organizations (98%) bore the brunt of 11,246 DoS attacks last year, and financial organizations ranked as top targets for cyber attacks accounting for 24% of the total reported breaches. Along with healthcare and public sector organizations, the three verticals accounted for more than half of the security breaches analyzed.
(Figure 1 - Verizon 2017 Data Breach Investigations Report)
When we knew the organization size, DDoS attacks were disproportionately (98%) targeted at large organizations. Most attacks are not sustained for more than a couple of days.
The Verizon report also revealed that 80% of hacking-related breaches leveraged weak, stolen or compromised credentials – not surprising given the cavalier attitude some users display toward protecting their passwords. In the wake of the crippling DDoS attack (Distributed Denial of Service – a variant of DoS) on the British Parliament, an MP revealed her lax approach to cybersecurity on Twitter; divulging she shares her login and passwords with staff, including temporary interns.
Then a fellow MP, Nick Boles, tweeted that he too shared his password with his staff for the same reasons.
While changing user attitudes toward cybersecurity is easier said than done, DoS incidents and data breaches as a result of lost or stolen devices are preventable.
So why aren't organizations acting?
Put simply, procrastination. A lot of the breaches occur when organizations are in a state of indecisiveness; evaluating the impact of updating legacy applications or applying patches; researching the implications of migrating from on-Prem to the cloud; or, merely navigating the bureaucratic red tape, organizations lose focus on this important security issue.
Just look back at some of this year's cybersecurity horror stories: Equifax admitted it was aware of an application vulnerability on one of their websites, but wanted to 'identify' the weakness first. When WannaCry swept across the globe, the NHS was running a 16-year-old operating system, Windows XP. And the British Parliament, it seems, just hadn't got around to enforcing basic security practices.
The bottom line, hackers will find and exploit security gaps. Companies from every sector regularly have sensitive data exposed through user carelessness, lost devices, stolen phones and leaked documents. The stats speak for themselves:
- One laptop is stolen every 53 seconds.
- 70 million smartphones are lost each year, with only 7 percent recovered.
- 4.3 percent of company-issued smartphones are lost or stolen every year.
- 52 percent of devices are stolen from the office/workplace, and 24 percent from conferences.
And the instance of data leaks and associated financial losses is only set to increase with the trend toward BYOD (Bring Your Own Device). When lost or stolen devices fall into the hands of hackers, the information stored on them will, no doubt, be used in illegitimate ways including Denial of Service attacks.
What's an Information Security professional to do?
Plug the gaping holes.
Email, for instance, is still a primary communication tool for most organizations. In the age of BYOD, email has become one of the most challenging information sharing tools to monitor, manage and secure. Without control over email data, you have a significant gap in your overall enterprise IT security, resulting in a high potential for data leakage. When devices are lost or stolen, hackers have access to email and attachments containing sensitive data – not only your data but data belonging to partners and clients as well.
Doctors losing laptops with patient data contained in emails accounted for 14% of all Healthcare breaches in 2017 (Click to Tweet!)
Of course, one way of protecting email data is to invest in a Mobile Device Management (MDM) solution, but MDM solutions are expensive, complicated to implement and time-consuming projects. And MDM’s may not cover all eventualities. You end up staring down the barrel of indecision. And while everyone is making up their mind which MDM solution to deploy, hackers are clawing at the door.
However, in all the hype, one tends to overlook the most straightforward solution: Prevention. Reduce the risk of exposure associated with lost or stolen devices by preventing email and associated attachments from ever leaving corporate control.
Combining technologies like Microsoft Outlook Web and Messageware AttachView, users can securely access and view emails and attachments without ever downloading any content or data to their device. What's more, AttachView is easy to deploy, residing on your Exchange server. Eliminating the support overhead required to install, support and manage software on user devices. Not to mention the benefit of not having to deal with irate employees over installing restrictive software on their personal devices.
If you're grappling with BYOD challenges and you are running Exchange on-premise, don't leave things to chance this year, talk to us about how you can proactively secure your corporate data now.