Scratching the Surface

How is this my fault?

This year, 82% of breaches in the DBIR¹⁴ involved the human element. This puts the person square in the center of the security estate with the Social Engineering pattern capturing many of those human-centric events.

As you can see in Figure 49, the Social Engineering pattern is dominated by Phishing. And we know what you’re going to say: “I’m so surprised! Fetch my fainting couch!” But in a way the chart highlights the numerous paths a social engineering breach can take. We see where the phish steals credentials to then be used in “Use of stolen creds.” We see Business Email Compromises (BECs) (with the E for email being directly tied to the phish) in “Pretexting.” We see malware being dropped in “Downloader” and “Ransomware” (which, by the way, goes up to 17% of Social Engineering when we are discussing incidents rather than breaches), hacking in “Scan network” and “Profile host,” and persistence in “Backdoor or C2.” All in all, it highlights the fact that phishing is one of the four main entry points into an organization.¹⁵

Phishing

Sutton’s law tells us “When diagnosing, first consider the obvious.”  Thus, if you wonder why criminals phish, it is because email is where their targets are reachable. And while only 2.9% of employees may actually click on phishing emails, a finding that has been relatively steady over time, that is still more than enough for criminals to continue to use it. For example, in our breach data alone, there were 1,154,259,736 personal¹⁶ records breached. If we assume those are mostly email accounts, 2.9% would be 33,473,532 accounts phished, (akin to successfully phishing every person in Peru).

The good news is we are getting better at reporting phishing. Figure 48 shows a steady climb with an increase of roughly 10% in phishing test emails reported in the last half decade. The question is “Can your organization both act on the 12.5% that reported and find the 2.9% that clicked?”

BEC

In Figure 49, we see that Pretexting is 27% of Social Engineering breaches, almost all of which are BECs. While we call these attacks BECs, they tend to be a bit more complex than just some bad actor impersonating someone through a compromised email account. Only 41% of BECs involved Phishing. Of the remaining 59%, 43%¹⁷ involved Use of stolen credentials against the victim organization. The percentage remaining were most likely BECs using an email from a partner, or utilizing a free email account of some type requiring no “C¹⁸” at all. BECs come in many forms: your organization may be targeted due to a breach in a partner, your partners may be targeted due to a breach of your emails, you may be breached and then targeted using your own breach, or as pointed out earlier, there may be no breach at all, just an attacker with a convincing story about why they need your money.

Figure 50 gives an idea of how much of that money the criminals feel they need. It appears they saw inflation on the horizon and granted themselves a raise this year.  Regardless, you, being the erudite reader of the DBIR that you are, can do something about it. File a complaint at ic3.gov and get in touch with the FBI IC3 Recovery Asset Team (RAT). In cases where the RAT acts on BECs, and works with the destination bank, half of all US-based BECs had 93% of the money either recovered or frozen, whereas only 14% had nothing at all recovered.

Malware

“Malware? I already read about it in the Action section. Why do I have to hear about malware again?!” Because there’s lots of it! Although, we admit there is a degree of bleed-over in the sections. This year we saw more things that fell into two patterns than we did last year. With System Intrusion and Social Engineering being chief among them.  

As Figure 38 in the System Intrusion section points out, email is the most common malware delivery method, at least initially. Figure 52 shows that, in breaches, providing a Backdoor or Command and Control (C2), followed by delivering a Downloader are the top two things actors are looking to do once their successful phish lands their malware. If the phish busts through the door, Figure 52 shows that the Backdoor, C2, and Downloader hold it open for all the rest of the actions to make their way in. It is noteworthy that while Ransomware shows up about half way down the list in breaches, the same analysis for incidents has Downloader and Ransomware moving into the top two spots with 74% and 64% of malware incidents respectively. This definitively proves that we can’t write a single section of the DBIR this year without mentioning Ransomware at least once.

Training

Clearly the Human Element leaves a lot to be desired when it comes to information security. Even when a breach is not directly caused by a person, the information systems were still built by people.¹⁹ Frankly, we’d rather have people solving the problems since asking the AI to do it sounds much trickier. 

Unfortunately, nothing is perfect. Not people, not processes, not tools, not systems.²⁰ But, we can get better, both at what we do and what we build. To that end, training is a big part of improving. Figure 51 gives an idea of the amount of phishing training folks are taking per year. Most training takes twice as long to complete than was expected with 10% taking three times as long. Training can potentially help improve security behaviors, in both day-to-day (such as Don’t Click… Stuff, and using a password keeper) as well as in design (such as secure coding, lifecycle management, etc.). Unfortunately, while getting training is easy, proving it’s working is a bit harder. If you want some pointers on how to do it, have a look at Appendix C: Changing Behavior.

¹² And by average, we mean median because statistics isn’t hard enough already. Mode.

¹³ “The Pyramid of Pain”, Bianco, David J., https://bit.ly/PyramidOfPain, January 2014.

¹⁴ Not just the Social Engineering pattern.

¹⁵ Along with Credentials, Vulnerabilities, and pre-existing Bots.

¹⁶ “Personal” doesn’t have to be email. It could be addresses and names and such, but it normally includes email. And this doesn’t even count credentials where the username is often an email.

¹⁷ Ok, so 59% times 43%, carry the 1, convert to roman numerals... that’s like 25% of all BECs!

¹⁸ Compromise

¹⁹ Unless that whole bigfoot thing is true. We sent Dave to a conference to find out but haven’t heard back.

²⁰ Not DBIR Authors (This is debatable. We asked the Oracle, rolled some bones, and signs pointed to “probably perfect”).