Small Business Cybersecurity: How to Stay Ahead of Data Breaches
Table of Contents
A company runs on its data, which has intrinsic value. This valuable commodity is in the sights of cybercriminals. Hackers attack a company's network and its people to steal data. A data breach can involve ransomware infection, financial fraud, and the sale of company secrets on the dark web. In one quarter alone, 422.61 million data records were leaked in data breaches. According to the Verizon Data Breach Investigation Report (DBIR), 60% of data breaches involve a human element.
What is a Data Breach
A data breach is defined by NIST's Computer Security Resource Center (CRSC) as:
"An incident that involves sensitive, protected, or confidential information being copied, transmitted, viewed, stolen, or used by an individual unauthorized to do so. Exposed information may include credit card numbers, personal health information, customer data, company trade secrets, or matters of national security, for example."
The unauthorized disclosure and loss that defines a data breach are in contrast to a data exfiltration, a deliberate and malicious act to steal data; data breaches can be accidental or malicious.
Causes of a Data Breach
Hackers do not just cause data breaches; accidental exposure and human error cause data breaches, too. The leading causes of a data breach are as follows:
Accidental
The Verizon Data Breach Investigations Report (DBIR) ranks "carelessness" among the top action categories to prevent data breaches. Human error is a cause of data exposure, with employees causing leaks due to errors such as email misdelivery, poor security hygiene (e.g., sharing passwords), and app misconfiguration. The report states that "human error is an enduring cause of data breach events."
Malicious Insiders
Employees and ex-employees are behind some data breaches. Malicious insiders cause data breaches for many reasons, including grudges against a company for financial benefit and to commit industrial espionage. On average, 17% of data breaches involve espionage, according to the DBIR. This average varies depending on the industry sector; for example, 55% of data breaches in the mining and utilities sectors are due to espionage. Malicious insiders have been known to be recruited on the dark web.
External Attackers
Data breaches from external malicious forces are behind the majority of attacks. According to the DBIR, different sectors experience different rates of external attacks. For example, the education sector experiences 62% of data breaches caused by external hackers, whereas finance and insurance suffer 78% of attacks from external hackers.
Eight Common Data Breach Methods with Examples
Whatever the starting point, be it an accident, a malicious insider, or an external hacker, the human element plays a key role. Credential abuse, social engineering, errors, and phishing all play a part:
Phishing
Phishing remains a go-to technique for initiating a data breach and an ideal method for stealing credentials. With the advent of generative AI, phishing messages are more believable and highly personalized; AI gathers intelligence and creates phishing campaigns based on that information. Making matters worse, evasive tactics like using QR codes in an email rather than malicious links make phishing detection much harder.
A recent report shows that 94% of organizations are victims of phishing attacks, with a 52% increase in phishing attacks that successfully bypassed detection. The financial sector regulator, the Financial Industry Regulatory Authority (FINRA), recently issued a cyber-alert warning about evasive phishing.
"ONNX Store, a Phishing-as-a-service platform (PhaaS)1, is targeting Microsoft 365 (M365) accounts at FINRA member firms with an advanced social engineering attack known as quishing: a business email compromise (BEC) attack that uses QR codes in embedded PDF documents to redirect victims to phishing URLs."
Malware Infection
Malware is often used to initiate a data breach, according to the DBIR. Keylogger and infostealer malware collect keystrokes during credential entry and take screenshots, then send them back to an attacker. Hawkeye Reborn keylogger malware attacks were distributed as Malware-as-a-Service (MaaS).
Phishing emails containing malicious attachments or linking to infected attachments in portals like Dropbox initiated the malware infection. The Hawkeye Reborn threat actors used social engineering spam attacks to contact victims in various industries, including transportation and logistics, healthcare, and agriculture.
Ransomware Infection
Ransomware encrypts data to demand a ransom for a decryption key and steals the data before encryption occurs. It then uses the stolen data to leverage the ransom demand. A recent example involving a spate of attacks by ransomware gang Scattered Spider targeted large UK retailers. The attackers targeted the popular retail brand Marks & Spencer (M&S). The company was likely targeted in a spear phishing attack that led to the ransomware infection and data breach. The stolen data included personal details like name, address, and orders placed. The company was forced to stop online orders and close shops. Operations were severely disrupted for days. Notably, the DBIR survey found that 44% of data breaches involve ransomware.
Man-in-the-Middle (MitM) attacks
MitM attacks intercept data and other communications as they are being transferred, often modifying the communication. The Equifax data breach, which affected 145 million American citizens, used the MitM technique to exploit shared SSL digital certificates to perform SSL and DNS spoofing, redirecting users to fake websites.
SQL Injection Attacks
SQL Injection attacks can bypass authentication and access a database. The UK real estate company Foxton Group was a victim of a SQL Injection-based data breach affecting 16,000 customers. The attackers used database vulnerabilities to carry out SQL injection. The data ended up on the dark web, and the company faced a $108 million (£80 million) class action.
Credential Stuffing
Credential stuffing attacks use already stolen data, usually available on the dark web, to attempt to access accounts. The process is automated, and attackers use millions of stolen credentials to flood online accounts until they get a match. A credential stuffing attack impacted HSBC Bank's U.S. customers - attackers used stolen logins to access customer accounts. Data stolen included personal information like contact details as well as transaction histories.
Social Engineering
Social engineering is increasingly successful due to AI and deepfakes. Attackers can manipulate individuals into handing over login credentials and other sensitive information by making them believe they are communicating with a trusted person, like a CEO. Once the data is released to a cybercriminal, it can be used to carry out follow-on attacks, including ransomware infection and data breaches. Examples of deep fake-enabled social engineering are increasing.
A recent example was the attack on Arup Engineering, where an employee was tricked into joining a video conference call with company executives. However, the executives were all deepfakes, and the company handed over $25 million to fraudsters. The risk of AI-enabled attacks used to breach data is likely to increase.
Accidental Data Leaks
Accidental data breaches cover a broad spectrum of possible ways that data can be exposed. Email misdelivery is a common way for data to leak. A survey from Typing.com found that 57% of people have admitted to accidentally sending the wrong email message to a co-worker, with 17% sending the wrong email to a client or customer. Human error is a common problem leading to data breaches, with 74% of Chief Information Security Officers (CISOs) citing human error as their top cybersecurity risk. This concern is not misplaced, as the World Economic Forum (WEF) found that human error is behind 95% of security breaches. This concern was realized at a G20 Summit when the Australian immigration department accidentally sent an email to the wrong person, revealing the personal details of world leaders.
The Dark Web's Role in Data Breaches
The dark web is used by cybercriminals to research vulnerable targets, to rent phishing and malware campaigns, on an as-a-service basis, and to buy and sell data. Data breaches feed the dark web, and the stolen information is sold to other cybercriminals, who then use it to carry out further attacks. For example, the data stolen in the Equifax and M&S attacks found its way onto the dark web, and the companies had to inform customers that their data could be used in phishing attacks.
Dark web monitoring vendors, like Sentinex, provide tools to allow companies to safely delve into the dark web to look for signs that their company is being targeted and to identify instances of company or customer data for sale on dark web marketplaces. By gathering dark web intelligence, a company can be forewarned, allowing it to plan for an attack or any repercussions from a data breach.
The Cost of a Data Breach
Data breaches are costly. Accidental or malicious data exposure can lead to noncompliance with laws and regulations like GDPR and HIPAA. Lost data also results in class actions, loss of customer trust, reputation damage, and exposure of company secrets and intellectual property (IP).
Data from the IBM Data Breach Investigations Report provides some startling costs associated with a data breach:
- The average cost of a data breach across all industries is $4.88 million.
- Customer data is lost in 46% of data breaches. The cost per lost data record is $173 per record.
- Malicious insider attacks cost on average $4.99 million.
- Data breaches at industrial organizations take around 199 days to identify and 73 days to contain. During this time, company operations are disrupted.
- Phishing attacks last an average of 261 days.
- Social engineering attacks take an average of 257 days.
How To Prevent Data Breaches
To mitigate a data breach, a company must use layers of security measures. The following are recommended as a baseline for data breach prevention:
Security Awareness Training
Phishing is a popular method to steal login credentials that can lead to a data breach. Educate employees on the type of manipulation tactics used in phishing campaigns. Use phishing simulation exercises to test employees' responses to phishing to enhance and optimize training. Also, system admins and IT teams should be fully aware of the importance of correctly configuring databases and other web apps to prevent exploits of misconfiguration that lead to data breaches.
Robust Identity Security
Stolen login credentials can open doors to larger data breaches. Deploy robust identity security measures, including multi-factor authentication (MFA), and privilege governance. Ensure that when people leave an organization they have their access rights and privileges swiftly removed, this help to derisk ex-employee insider threats.
Secure the Network
Network vulnerabilities and exploits are commonly used to hack databases. Secure your network by monitoring it using intrusion detection and prevention system (IDPS) solutions. A network monitoring tool detects unusual activities that could signal data exfiltration. Also, a web access firewall (WAF) should be deployed to inspect HTTP requests and identify malicious traffic.
Network Segmentation
When an attacker enters a network, they can use tactics, like lateral movement, to access sensitive areas. Use network segmentation to isolate areas of the network to prevent attackers from entering restricted areas.
Email Security Solutions
Advanced anti-malware protection identifies potential malware infections. AI and machine learning-based solutions are used to identify emerging and evasive malware-based attacks.
Data Leak Prevention (DLP)
DLP solutions enforce policies and rules to prevent sensitive data from leaving the network without authorization.
Patch Vulnerabilities
Vulnerability exploits are used to enter a network and escalate privileges to allow attackers to gain unauthorized access to databases and other sensitive areas of a network. To prevent this, patch and upgrade software and firmware promptly.
FAQs
What Causes Data Breaches?
Data breaches are caused by malicious insiders, external hackers, or accidental exposure.
- External hackers: Phishing often leads to credential theft, which offers unauthorized access to a database. Infostealers, keylogger malware, and ransomware are used to steal data. Software vulnerabilities can be exploited to help hackers gain privileged access to databases and other sensitive network areas, leading to data breaches.
- Malicious insiders: Disgruntled employees and ex-employees may be recruited on the dark web to steal data on behalf of attackers. Employees who steal data often abuse their access privileges to do so.
- Accidental exposure: Data may be accidentally exposed by employees, for example, by misdelivery of emails.
Who is Liable for a Data Breach?
Liability depends on who owns the data, contractual clauses, and the security measures used to protect the data. In the USA, a company usually has to inform its customers and the appropriate authority after a breach has occurred. In a cloud environment, liability usually resides with the data owner, i.e., the company. This remains the case even if the security breach is due to the data holder's failure, i.e., the cloud provider.
Liability may be defined by any regulations the company must adhere to. For example, if a company is a healthcare provider or associate, it will be covered under HIPAA and be expected to comply with the breach notification rules.
How To Check if a Company's Data Has Been Breached
Security solutions such as network monitoring tools, like intrusion detection and prevention systems (IDPS), will alert a company if signals of a data breach occur. Dark web monitoring tools, like Sentinex, provide a way to look deeply into the dark web to see if stolen company and customer data is being bought and sold on dark web marketplaces.