2019 Verizon DBIR highlights cyberespionage, nation-state attacks

Public sector under siege

The rise of cyberespionage and nation-state activity was bad news for two spaces: the information industry and the public sector.

"An eye-opening 36% of external attackers [for information industry breaches] were of the state-affiliated variety, statistically even with organized crime," the report said.

The Verizon DBIR also noted that cyberespionage "is rampant in the public sector," with the number of espionage-driven breaches for government entities jumping 168% year over year. The authors said while the number of incidents and breaches in the public sector was roughly the same as in last year's report, "the makeup of the breaches has seen some change."

While nation-state groups are often described as sophisticated actors with advanced skills and tools, the Verizon DBIR said 78% of cyberespionage-related incidents involved phishing, compared to just 32% of overall breaches involving phishing.

Malcolm Harkins, chief security and trust officer at BlackBerry Cylance, based in Irvine, Calif., said many breaches are attributed to advanced threat actors, but those attacks often begin with simple phishing email messages.

"It doesn't take an advanced actor to create an email that looks like it came from your boss, your wife or your kid, then take a picture from [a] social media site or something else and send you an email," Harkins said. "And guess what? You're going to click on the damn thing."

The 2019 Verizon DBIR did offer some positive news. Data from simulated phishing exercises, provided by third-party vendors, showed a continued decline in the click rates to just under 3%.

"The numbers on the phishing simulations are encouraging," Hylender said. "But if you've read these reports over the years, then you know it's a tried-and-true attack method.

Email threats

Email has been a widely known and popular vector for threat actors for some time, but the 2019 Verizon DBIR painted a grim picture for the communication channel beyond basic phishing attacks. According to the report, which included "data received from millions of malware detonations," the median organization received more than 90% of their detected malware through email messages.

The Verizon DBIR highlighted that, in 60% of web application attacks, the app in question was the front end to cloud-based email servers. The report also noted that most compromised credentials were to cloud-based mail servers.

"There was an uptick in actors seeking these credentials to compromise a user's email account," the report said.

"That's an indication of where the attackers are going," Hylender said. "And it shows me that [organizations] are not doing enough to protect their credentials."

Once threat actors gain access to email accounts and the underlying email server, he said, they send phishing email messages from those accounts, initiate business email compromise (BEC) campaigns or harvest additional credentials to continue moving laterally though the organization.

Justin Harvey, managing director and global incident response lead for Accenture Security, said he's seen a number of incidents in the last year involving web apps and compromised credentials.

"Because a lot of infrastructure is in the cloud, it's very easy to get access to a lot of those services like SharePoint and OWA [Outlook Web App]," he said. "We have seen people branch out from there by compromising administrators and gaining full access to the environment."

Hylender said while there are sophisticated ways to prevent phishing attacks and protect credentials, he advised organizations to "start with the basics" by implementing two-factor authentication.

Harvey agreed and said most of the email threats and BEC attacks he sees are only successful because users had no multifactor authentication.

"The first order of business, in a lot of these cases, is to get the organization on Office 365, get them on Windows 10 and get on multifactor authentication," he said. "And Microsoft has made that very easy."

Despite concerns about the security of SMS-based 2FA, Harvey said users are better off using it than not having it at all.