2020 was the year of phishing, ransomware, and web application attacks disrupting organizations that already had their plate full with transformations brought on by COVID-19. 

Verizon chronicles this story in their 2021 Data Breach Investigations Report. 

Using global data from 5,358 breaches and 83 contributors, the report tells the story of cybercriminals getting creative at the expense of everyone else.

Unsurprisingly, stolen credentials were a common theme, rearing their ugly head across breach methods.

5 Important Stats from the 2021 Verizon DBIR 

2020 proved yet again that unauthorized access to data and cloud applications is a constant threat: 

1. Web applications were the top hacking vector in breaches.
2. Passwords caused 89% of web application breaches, either through stolen credentials or brute force attacks.
3. 61% of all breaches exploited credential data via brute force attacks, credential stuffing attacks, or credential data leaked and used later.
4. Phishing was up to 36% in 2020, compared to 25% of attacks in 2019.
5. Ransomware doubled its frequency from 2019, appearing in 10% of breaches.

Where stolen credentials go, phishing and ransomware follow. 

The Link Between Stolen Credentials and Breaches

The alarming rise of phishing and ransomware attacks was, of course, due to many organizations becoming cloud-first practically overnight. 

But the authors of the 2021 Verizon DBIR also pointed out that organizations lacking multi-factor authentication were easier targets than their counterparts who deployed MFA. 

If anything, the 2021 Verizon Data Breach Investigation Report makes it abundantly clear that credentials are a glaring vulnerability. 

The only way to stop credential theft is to eliminate passwords from your environment.

Getting rid of the risk associated with passwords goes a long way to preventing ransomware and phishing while securing remote work.

4 Cyber Security Recommendations from The 2021 Verizon DBIR

Verizon was kind enough to recommend Controls for each industry in their 2021 Breach Report. 

From the Center for Internet Security Controls (CIS Controls), these recommendations help organizations prioritize security initiatives accordingly. 

The top four CIS controls strongly recommended across all industries were:

1. Secure Configuration of Enterprise Assets and Software
2. Account Management
3. Access Control Management
4. Security Awareness and Skills Training

Numbers one and four go without saying. 

But numbers two and three represent an important acknowledgment: stronger authentication seriously prevents breaches.

How to Provide Secure Authentication

Start with account management. Monitor unusual activity to prevent brute-force and credential-stuffing attacks.

Make sure to pair account management with access control. Certain accounts merit certain privileges. Adding multi-factor authentication helps prevent stolen credentials from becoming sure-fire breaches.

Rather than being permissive with access, be deliberate about which accounts get access to what resources — and how.

Beyond Identity can eliminate the use of passwords at your organization while helping you be deliberate about account management and access control. Request a demo today.