January 27, 2023

Volume XIII, Number 27


January 27, 2023

Subscribe to Latest Legal News and Analysis

January 26, 2023

Subscribe to Latest Legal News and Analysis

January 25, 2023

Subscribe to Latest Legal News and Analysis

Verizon 2021 Data Breach Investigations Report Released

If you have been following Verizon’s annual data breach investigation reports like I have over the years, you get excited when the new one comes out. If you have never read the report, now’s your chance, as the 2021 report was just released.

Although chock-full of information, the Verizon Data Breach Investigations Report (DBIR) is always written in an understandable way, and provides important information to help stay current on threat actors’ schemes and scams so the information can be shared with employees to prevent them from becoming a victim.

This year’s DBIR is 119 pages long, so take your time. It defines words in an accurate way (like “incident” and “breach,” which I appreciate), and outlines the conclusions in an organized manner.

Here is a brief summary of important considerations for cyber risk management strategy:

  • Social engineering is the most successful attack

  • The top hacking vector in breaches is web application servers

  • Denial of service is the most frequent way incidents occur

  • 85 percent of breaches involved a human element

  • Financially-motivated attacks are the most common

  • Organized crime continues to be the number one attacker

  • External cloud assets were compromised more than on-premises assets

  • Older vulnerabilities that haven’t been patched are being exploited by attackers

  • Credentials remain one of the most sought-after data types, followed by personal information

  • Employees continue to make mistakes that cause incidents and breaches

  • Devices continue to be lost or stolen

  • Privileges are misused

  • Business Email Compromises were the second most common form of social engineering

  • The majority of social engineering incidents were discovered externally

In addition, phishing continues to be one of the top causes of data breaches, followed by the use of stolen credentials and ransomware, with the notable change in the past year of how threat actors “will first exfiltrate the data they encrypt so that they can threaten to reveal it publicly if the victim does not pay the ransom. We are not sure if this breach double-dipping is permitted in the Threat Actor Code of Conduct, but there has been no evidence that they have one anyway.”

The DBIR discusses the importance of building a culture of cybersecurity vigilance, the difficulties of patching, the new complexities of attacks, which involve numerous steps, and web application attacks.

I will be spending more time with the DBIR as it is hefty reading, but it is well worth the time and energy to stay current on cyber risks and patterns.

Copyright © 2023 Robinson & Cole LLP. All rights reserved.National Law Review, Volume XI, Number 141

About this Author

Linn F. Freedman, Robinson Cole Law Firm, Cybersecurity and Litigation Law Attorney, Providence

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She provides guidance on data privacy and cybersecurity compliance to a full range of public and private clients across all industries, such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine, and charitable organizations. Linn is a member of the firm's Business Litigation Group and chairs its Data Privacy + Cybersecurity Team. She is also a member of the Financial Services Cyber-Compliance Team (CyFi ...