Companies still fail security basics, as ransomware rises

Verizon report: Most breaches take advantage of simple passwords

Companies are still failing to take basic steps to secure their businesses, a new report has found.

Verizon's annual Data Breach Investigations Report, published today, revealed that of the almost 2,000 breaches and security incidents that were analysed, a whopping 81% used easily-guessed or stolen passwords.

Furthermore, over 65% of malware infections were delivered via email attachments - a technique that has been around for decades. Pretexting - a form of social engineering used to obtain privileged information - is also on the rise.

Advertisement - Article continues below

With so many enterprises falling victim to age-old tactics, why are businesses still failing to take basic security measures like strong password hygiene and regular data backups?

"It's a very good question, and it's one we ask ourselves on a recurring basis," Verizon's director of international security solutions, Ali Neil, told IT Pro, "because this is not the only year that we find that the human vector is probably the most susceptible, and theoretically the easiest one by which to combat things."

"You don't have to pay a fortune for a SIEM solution or an intrusion detection solution, you actually have to enforce some basic standards," he added. "Our message is that training is the simplest thing you can do with people."

Advertisement - Article continues below

Not everyone agrees, however. Bromium's EMEA CTO, Fraser Kyne, said that companies need to spend less time focusing on employee training, not more.

"What most interested me in this year's report was that phishing attacks are actually becoming even more prevalent," he said. "One in 14 users are being duped into clicking on a bad link or attachment; but even worse, a quarter of those people go on to do it again. There is a phrase that I think is very apt here - "You can't patch stupidity'.

Advertisement - Article continues below

"Organisations therefore need to shift the onus away from controlling user behaviour if they are to get a handle on the situation. The best way of mitigating phishing attacks is to have a safety net in place, allowing end users to click with freedom, without having to worry too much about stumbling upon a bad link or malicious attachment."

The report included further interesting findings, such as the fact that organised crime gangs were behind more than half of all breaches, almost 70% of all threats to healthcare come from within the organisation, and around 50% of attacks on educational institutions were perpetrated by state-affiliated hackers.

Unsurprisingly, ransomware has also gone up by 50% compared to last year's report. Across the numerous reports put out by the security industry, a consistent rise in ransomware activity is one of the universal constants.

"Our vision is to unite industries with the end goal of confronting cybercrime head-on, and we are achieving this," said Verizon enterprise solutions' executive director of global security services, Bryan Sartin.

Advertisement - Article continues below

"The success of the Data Breach Investigations Report series is thanks to our contributors who support us year after year. Together we have broken down the barriers that used to surround cyber crime - developing trust and credibility. No organisation has to stand in silence against cybercrime - the knowledge is out there to be shared."

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now



Microsoft issues warning about new PonyFinal ransomware attacks

3 Jun 2020
data breaches

Amtrak Guest Reward suffers a data breach

3 Jun 2020
cyber security

Brand-impersonation and form-based attacks are rising

3 Jun 2020
mobile security

Parachute's Superlock feature keeps your phone recording in an emergency

2 Jun 2020

Most Popular


Ransomware collective claims to have hacked NASA IT contractor

3 Jun 2020

VMware Cloud Director exploit lets hackers seize corporate servers

2 Jun 2020

How data science is transforming business

29 May 2020