The 2024 edition of the esteemed Verizon Data Breach Investigation Report (DBIR) was released in May. The report spanning 100 pages contains numerous remarkable observations and currents.
The communication from Verizon highlighted these primary points:
- Increased exploitation of vulnerabilities rose significantly by almost threefold (180 percent) compared to the previous year.
- Ransomware and the rapid increase of extortion tactics contributed to a third (32 percent) of all breaches.
- Majority of breaches (68 percent) involved a non-malicious human aspect.
- Analysis of 30,458 security incidents and 10,626 confirmed breaches in 2023 showed a twofold increase from 2022.
- Verizon’s security statistics: managing over 4,200 networks globally, processing 34 trillion raw logs per year, and maintaining nine security operation centers worldwide.
Further examination of the Cybersecurity Infrastructure and Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog indicated that organizations typically take 55 days on average to rectify 50 percent of critical vulnerabilities after patches are released. In contrast, the median duration for detecting widespread exploitations of the CISA KEV on the Internet is five days.In the past year, 15 percent of breaches involved an external party, encompassing data custodians, vulnerabilities in third-party software, and other supply chain issues, marking a 68 percent increase from the same timeframe in 2023.
Below are summarized extracts from the comprehensive report:
- “Our analysis observed a substantial increase in attacks exploiting vulnerabilities as the key method to initiate breaches compared to previous years. This spiked by nearly 180% from last year, especially notable with MOVEit and similar zero-day vulnerabilities. These attacks were mainly exploited by Ransomware and other Extortion-related threat actors, with web applications being the primary vector for these initial breaches.
- “Around one-third of all breaches involved Ransomware or some form of Extortion technique. Pure Extortion incidents have increased over the past year and now constitute 9% of all breaches. The transition of traditional ransomware actors to these newer techniques led to a slight decline in pure Ransomware incidents to 23%. Nonetheless, combined, given their shared threat actors, they represent a substantial growth to 32% of breaches. Ransomware remained a significant threat across 92% of sectors.
- “Our dataset showed an uptick in breaches due to Errors, now at 28%, as we expanded our contributor base to include several new mandatory breach notification entities. This affirms our belief that errors are more common than typically perceived through media or traditional incident response-driven biases.”
This video summarizes key findings from the 2024 report:
WATCHGUARD INTERNET SECURITY REPORT
The quarterly WatchGuard Internet Security Report may not be widely recognized, yet it furnishes valuable insights on current cyber risks.
Key data findings include:
- Detections of malware targeting endpoints surged by 82 percent.
- Heightened detection of a malware variant aimed at enterprise Internet of Things (IoT) devices like smart TVs, with the identification of “Pandoraspear” malware targeting business smart TVs.
- Emergent patterns in malware focusing on Chromium-based web browsers.
An interesting discovery is the following: “Compared to Q4 2023, ransomware detections experienced a 23% decrease, while zero-day malware detections declined by 36%.
“The insights from the Q1 2024 Internet Security Report underscore the necessity for organizations of all sizes to safeguard internet-connected devices irrespective of their usage for business or leisure,” stated Corey Nachreiner, chief security officer at WatchGuard. “As evidenced in numerous recent breaches, bad actors can infiltrate an enterprise network through any connected device, subsequently causing significant harm to crucial resources and data exfiltration. It is now crucial for organizations to adopt a comprehensive security approach, which can be overseen by managed service providers, to encompass widespread monitoring of all devices and endpoints.”
Other significant observations from WatchGuard’s Q1 2024 Internet Security Report include:
- The average number of malware detections per WatchGuard Firebox significantly dropped by nearly half (49 percent) in the first quarter, while the volume of malware transmitted over an encrypted connection rose by 14 percentage points to 69% in Q1.
- A new variant of the Mirai malware family targeting TP-Link Archer devices through a newer exploit (CVE-2023-1389) to penetrate compromised systems emerged as one of the most widespread malware campaigns during the quarter. This Mirai variant affected nearly 9% of all WatchGuard Fireboxes globally.
- Chromium-based browsers were found to be the source of over three-quarters (78%) of the total malware originating from attacks against web browsers or plugins in the quarter, signifying a significant rise compared to the preceding quarter (25%).
- A vulnerability in the widely-used HAProxy Linux-based load balancer application, identified in 2023, was among the prominent network assaults of the quarter. This vulnerability underscored how weaknesses in popular software can lead to widespread security issues.
FINAL REFLECTIONS
Numerous other new, remarkable cyber threat, ransomware, and data breach publications are accessible to readers, such as the Ransomware Trends Report from Veeam, shedding light on the fact that ransomware victims typically permanently lose 43% of the affected data following an attack. The IT Governance USA blog presents key U.S. data breach statistics for 2024 (and prior years).
Moreover, the BlackFog State of Ransomware reports are consistently engaging, pertinent, and captivating. I incorporate their ransomware statistics into some of my major presentations.
However, beyond just examining prevailing cyber attack trends, which display mixed patterns overall, I highlight these reports to guide readers on where to access additional knowledge and deeper insights related to data in their sectors, along with specific tools to evaluate metrics and data concerning these topics.
To end on a positive note, according to The Hacker News, the U.S. Federal Bureau of Investigation has announced possession of more than 7,000 decryption keys connected to the LockBit ransomware operation, enabling victims to recover their data at no charge.
“We are getting in touch with identified LockBit victims and urging anyone suspecting they were affected to visit our Internet Crime Complaint Center at ic3.gov,” mentioned FBI Cyber Division Assistant Director Bryan Vorndran during a keynote session at the 2024 Boston Conference on Cyber Security.
About Author
