It’s here, the 2022 Verizon Data Breach Investigations Report (DBIR)!

Using data behind 23,896 security incidents and 5,212 that were confirmed data breaches, the report covers a wide array of data and insights and comes in at over 100 pages. It can be a lot to sort through so we did a wrap up.

Top 5 stats from the Verizon DBIR

Here are the top five stats you need to know from the lengthy report:

1. The most popular path leading to your organization’s estate was credentials, with around 50% of breaches being caused by them. In second place was phishing, accounting for almost 20% of breaches.

2. The most common attack vector for ransomware was stolen credentials through desktop sharing software, and with ransomware seeing a 13% increase year over year the risks continue to grow with stolen credentials.

3. Over 80% of web application breaches were caused by stolen credentials.

4. Financial gain continues to be a top motive for criminals when targeting organizations of any size. Making money off their attack is why over 80% of hackers do what they do.

5. Humans are prone to errors and mistakes and this year was no different, with 82% of breaches involving a human element. This could mean someone falling for a phishing scam, using credentials that had been previously stolen, or misuse of devices.  

Stolen credentials continue to be a driving force behind breaches, and with these credentials hackers can easily execute phishing and ransomware campaigns..

You don’t have to believe us, here’s direct quote from the report:
“There’s been an almost 30% increase in stolen credentials since 2017, cementing it as one of the most tried-and-true methods to gain access to an organization for the past four years.”

Across industries, when data was compromised one of the top targets was credentials. Also, use of stolen credentials was one of the top methods to attack educational services, accommodation and food services, manufacturing, mining, quarrying, oil & gas extraction, and utilities industries.

How to protect your organization and data

With ransomware, stolen credentials, and phishing all rearing their ugly heads year after year, there are some tactics that you can take to protect your sensitive data:

• Eliminate passwords: By eliminating passwords you remove the threat of any password-based attack, instantly making your security stronger
• Use phishing-resistant multi-factor authentication (MFA): For too long MFA solutions have used weak, easily bypassed and hackable factors like passwords, SMS text messages, and push notifications. Moving to a phishing-resistant MFA that uses factors like biometrics, cryptographic security keys, and security checks of the user, device, and transaction at the time of login can make sure authentication attempts are legitimate.
• Start a path to zero trust: “Never trust, always verify” is the motto of zero trust and by implementing this type of security architecture it won’t be assumed that just because someone can login that they are authorized to access any resource on the network.

Beyond Identity can help protect your company’s network and resources with its unphishable MFA and everything, from authentication, customizable risk policies, and admin controls are all centrally located in a single platform. Get a free demo today.