Verizon and National Intelligence Director Agree; We Aren't Doing Enough for Our Security

Each year, Verizon releases a report regarding data breaches and recently published the 2016 Data Breach Investigations Report (DBIR). It's easy to assume that all the information we receive on cybersecurity means that we are on an upswing. However, if you did so, you would be incorrect. What the report actually determined is that either we are not paying attention or we really need additional awareness training to help prevent data breaches of our organizations.

The DBIR found that 1,935 breaches occurred last year in 84 different countries. Out of those, 88% were successful due to the cybercriminals perpetrating one of nine familiar attacks. You read that right; they are performing the same nine attacks and they are still working.

What the analysts determined is that companies are not performing basic security functions to protect their networks. Bryan Sartin, executive director of Verizon's Global Security Services said "Often, even a basic defense will deter cybercriminals who will move on to look for an easier target."

What are those basic functions?

• Patch software on all systems. If your organization doesn't have a patch program in place, put one together. When a critical or security patch is released, it should be applied immediately even if it is outside of the normal patch schedule.

• Use multi-factor authentication for user logins. There are many options for this including biometrics, text, or email codes, and now the super tiny authentication keys that are becoming more popular and are supported by Google already.

• Encrypt all sensitive data that is passed through or being stored on the network. Encrypt portable devices too. This will prevent anyone from getting easy access to your corporate or customer data should they penetrate the defenses.

• Segment the network. Critical and sensitive data should be separated out and encrypted when possible. This will prevent someone from accessing it even if they get through to a different segment of the network.

• Have a training program in place to help educate everyone that connects to your network on how to identify phishing attacks and what to do should one occur. There are many options for this ranging from creating and conducting classes yourself to hiring a third-party to do regular training courses or even provide Training-as-a-Service.

Director of National Intelligence, James Clapper echoed the advice of Verizon with respect to dealing with phishing. He said, "Cyberattacks targeting the human factor are still a major issue." Unfortunately, people are also not heeding advice of security professionals with regards to passwords. Eighty-one percent (81%) of the hacking related breaches were successful due to users having weak passwords that were stolen and reused on other sites.

The report also found that 61% of the attacks in 2016 were targeted to smaller businesses; those with fewer than 1000 employees.

Clapper's eventual conclusion is that companies need to put more emphasis on improving security. This includes training employees to stop clicking on links and attachments in unsolicited or unexpected email messages. He said organizations should "test [staff] and publicize the results. ...No manager wants to see his results compare unfavorably with his fellows."