Data breach digest: Scenarios from the field

Description

The Verizon RISK Team performs cyber investigations for hundreds of commercial enterprises and government agencies annually across the globe. In 2015, we were retained to investigate more than 500 cybersecurity incidents occurring in over 40 countries. In 2008, the results of our field investigations were the genesis of the first Data Breach Investigations Report (DBIR), an annual publication that dissects real-world data breaches with the goal of enlightening the public about the nature of the threat actors behind the attacks, the methods they use, including the data they seek, and the victims they target. Our incident data corpus, which contains a wealth of breach information from over 70 contributors, has fueled eight years of DBIR reporting (to include this year's ninth DBIR). VERIS has allowed us to analyze this data to uncover the actors, actions, assets, and attributes involved in the incidents. While the DBIR focuses on trends and patterns found in an aggregated incident data set, the Data Breach Digest (DBD) gets you closer to the action. With the DBD, we're leveraging VERIS like never before. We're lashing up the cold, hard VERIS metrics to our on-the- ground casework experience. Essentially, we have opened our case files, and are giving you a first-hand look at cyber investigations from our experiences—a view from the field. Welcome to the field......Page 3 Mapping the industries, patterns and scenarios......Page 5 The human element......Page 8 Scenario 1: Social engineering—the Hyper Click......Page 10 Scenario 2: Financial pretexting—the Slick Willie......Page 15 Scenario 3: Digital extortion—the Boss Hogg......Page 18 Scenario 4: Insider threat—the Rotten Apple......Page 22 Scenario 5: Partner misuse—the Busted Chain......Page 26 Conduit devices......Page 30 Scenario 6: USB infection—the Porta Bella......Page 31 Scenario 7: Peripheral tampering—the Bad Tuna......Page 35 Scenario 8: Hacktivist attack—the Erratic Fanatic......Page 38 Scenario 9: Rogue connection—the Imperfect Stranger......Page 43 Scenario 10: Logic switch—the Soup Sammich......Page 46 Configuration exploitation......Page 49 Scenario 11: SQL injection—the Snake Bite......Page 50 Scenario 12: CMS compromise—the Roman Holiday......Page 54 Scenario 13: Backdoor access—the Alley Cat......Page 58 Scenario 14: DNS tunneling—the Rabbit Hole......Page 62 Malicious software......Page 65 Scenario 15: Data ransomware—the Catch 22......Page 66 Scenario 16: Sophisticated malware—the Flea Flicker......Page 70 Scenario 17: RAM scraping—the Leaky Boot......Page 74 Scenario 18: Credential theft—the Poached Egg......Page 78 Way forward......Page 82 Appendix A: Top 25 VERIS threat actions......Page 83 Appendix B: CIS critical security controls......Page 84