Speaker 1: Welcome to the Cyber Risk Management Podcast. Our mission is to help executives thrive as cyber risk managers. Your hosts are Kip Boyle, Virtual Chief Information Security Officer at Cyber Risk Opportunities and Jake Bernstein partner at the law firm of K&L Gates. Visit them at cr-map.com and klgates.com.

Jake Bernstein: So Kip, what are we going to talk about today on episode 165 of the Cyber Risk Management Podcast?

Kip Boyle: I love this time of the year with the podcast because this is roughly kind of sort of when we do our Verizon Data Breach Investigation Report review. And it's usually a two-part episode, and we know already, this one's definitely a two-part episode.

Jake Bernstein: Definitely a two-parter.

Kip Boyle: We are going to be looking at the 2024 edition of this report, which you can download. Anybody can download this off the internet. If you're not tech-savvy, you might have to give Verizon your email address. But I'll tell you, I've given them my email address year after year after year, and they don't market to me as far as I can tell, maybe I've got my filters turned up so high that I just can't see it. But now if you're more tech-savvy you should be able to search and Google and just find the PDF and grab it, which is kind of what I've gotten into that habit.

So anyway, so that's what we're going to do. Now, it turns out that we're recording this episode on a very historic day. I woke up this morning and looked at the news and found out that vast swaths of IT services or IT-based services around the world were out of order today, because it's apparently, and the data's still emerging on this, so bear with us, but it looks like CrowdStrike issued a software update, some kind of a driver and some configuration details. And when it landed on a Windows machine, it just took it out.

Jake Bernstein: Blue screen of death.

Kip Boyle: Yep. The modern BSOD.

Jake Bernstein: And it's only... And only Windows machine.

Kip Boyle: Yep. So all us Mac OS and Linux users, or even if you're just not a CrowdStrike user, you were probably okay.

Jake Bernstein: Specifically it was the Falcon product.

Kip Boyle: And poor George Kurtz, he looks miserable in all the videos. I feel bad for him because-

Jake Bernstein: I feel bad for him too. Those who don't know, that would be CrowdStrike CEO.

Kip Boyle: Yeah. Who I respect. George is very respectable, and I just couldn't imagine what an awful day he must be having. But anyway, so now, believe it or not, Jake assures me that he is going to make an amazing connection between what the world is experiencing today, and we'll talk about the impact of this, and the DBIR, some of the findings. So we're not a news of the day podcast, but it just so happens that the news of this day matters.

Jake Bernstein: Agreed, Kip, agreed. And again, this is all very early. That's what we know happened. The impact, as far as I can tell, and Kip feel free to add to this, was immense. For a non-cyber attack to cancel thousands of flights, people's vacations have been canceled or postponed. Doctors were unable to make appointments, people couldn't access their money. I mean, it was, and I will say it appears that much of this happened when North America, particularly the West Coast, was asleep. So I don't know, it seems like maybe it didn't impact us personally as much because by the time we woke up and saw the news, it seemed like a lot of it had already been, the fix had already been out, and many-

Kip Boyle: People are already working on it.

Jake Bernstein: Though not all, were still coming back online. So in some ways, unlike a truly malicious cyber attack, the tail of this one isn't likely to be super long. Although, there are some reasons to believe that hands-on keyboard might be required to recover some machines from it.

Kip Boyle: Or all of them or substantially all of them.

Jake Bernstein: Or all of them. Again, I don't know.

Kip Boyle: Yeah. They're essentially bricked. When a device gets bricked, that means that you have to flash the firmware, reload the operating system, or maybe the thing's just dead forever. You have to pry the ASICs off the motherboard with pliers, I don't know, but it's bad, and the current recovery instructions require hands-on keyboard, which it's obviously degrading our performance in recovering from this thing. And I think it's instructive that we kind of did this to ourselves as opposed to an adversary doing this to us. So that was one thing that ran through my head is like, well, what if this was a cyber attack? How would we feel about this? Would this finally cross the threshold into like, "Hey, it's an act of war?" I don't know.

Jake Bernstein: Well, I mean, that's actually, I admit that's not where I thought you were going to go with that. I think that what it does, and this is some of the headlines already today, is really shines a light on, again, something that we'll be talking about with respect to the Data Breach Investigations Report, which is, man, we've consolidated vulnerabilities for ourselves. I mean, the fact that one company made what very well might turn out to be a, we don't know, it literally could have been a typo in a config file. That's it. It could have been a typo in a config file. But we are so interconnected and so reliant on a relative handful of companies.

Kip Boyle: There's been a lot of consolidation, especially in the cloud era.

Jake Bernstein: Especially in the cloud era. And we understand why. Scale, man, it's all about economies of scale. So let's leave it at that. And why don't we end our special report and move into the regularly scheduled podcast.

Kip Boyle: I'm old enough to have tickered, was that? Teletype teletype noises in my brain right now with-

Jake Bernstein: Beep, beep, beep, beep, beep, beep.

Kip Boyle: No, no, that's the telegraph. The teletype was the tick, tick, tick, tick, tick, tick.

Jake Bernstein: Oh, yeah. So I guess, I was thinking more of the special news alert little like-

Kip Boyle: Ti, ti, ti, ti, ti ,ti.

Jake Bernstein: Yeah, that one. So.

Kip Boyle: Oh, wow. Whatever's going in your head, run with it. Okay. Now having sort of opened the show with that, let's turn our attention to the Verizon DBIR. Now, this is the 17th edition, which is really exciting. This is... I feel warm and fuzzy whenever I get this because I really prefer to have data driven action. So if I'm going to advocate something, I want it to be based on the best high quality data that I can get.

Jake Bernstein: And Kip, I've got news for you. Not to be too much spoiler alert, but you're going to get more data in this year than you've ever had in any previous year.

Kip Boyle: That's great.

Jake Bernstein: It's a little preview.

Kip Boyle: Yeah, that's fantastic. So yeah. Now, I will say, I'm going off script Jake, you're encouraging me to do things that I don't think I should do. But as I was reading through the report, the one thing that came into my mind, and we can talk about this later, is because it's the 17th edition, I get concerned that it is hobbled a little too much by its past. So for example, the fact that it's called the Data Breach Investigations Report made total sense when it first came out. But we're not that concerned with data breaches these days as much as we are ransomware attacks, extortions. We're going to unpack that. But I hope that this report is going to change and reflect the times.

Jake Bernstein: And Kip, I admit to being a little slow on getting the script done for this, because I had that feeling so strongly that it was difficult for me to get into it. I mean, many years, I'm super excited to read the DBIR, but this year I had that very similar feeling of, "Gosh, it just kind of feels like it's going to be the same old, same old. There's nothing new." And let me tell you, Kip, I was wrong and I apologize profusely even the inaudible-

Kip Boyle: We're sorry. We doubted you Verizon.

Jake Bernstein: ... to authors and I am very sorry that there was any doubt whatsoever. Because the reality is that it is evolving, and we're going to talk about that.

Kip Boyle: Okay, so the name hasn't evolved, but the contents are evolving. I love that. That's fantastic. Okay. And let me just talk about that. So in 2024, this edition, they're diving deeper into the pathway to breaches. In other words, how are the threat actors actually getting into our systems and causing all this trouble. And so they have things like most likely action and vector groupings and so forth. So yeah, I'm excited to get into it. Let's get going.

Jake Bernstein: Okay. So as a reminder, as we say every time, the 2024 DBIR deals with data collected between November 1st, 2022 and October 31st, 2023. So again, if anything seems out of date, it is just proof that things move pretty fast in the world of cyber security. And of course, because it is now a sacred tradition and so critically important, I will start again as I often do by quickly drawing attention to how the DBIR handles incident versus breach. Now, something new this year is that they, after 17 years, they've decided that a lot of people probably have read this before who are reading it now. So they did move the whole, what used to be kind of, about this report incident versus breach definition, how do we trust our data? All that is now in an appendix.

Kip Boyle: And it's well written, by the way. I think they've revised it, and I think it's easier to understand.

Jake Bernstein: Yeah, it is, it's good. So again, if you want to do that, now I'm just going to say that the key definition is, as it has always been, an incident, is a security event that compromises the integrity, confidentiality, or availability of an information asset. And a breach is an incident that results in the confirmed disclosure, not just potential exposure of data to an unauthorized party. And now Kip, now that I've said that, I'm suddenly paranoid that I didn't actually go and check the appendix because I felt like such an experienced reader. But maybe I'll do that in the middle of the episode and just make sure. But I think for now I'm good with this. And as I said before, I don't want people to make the mistake of assuming that incidents aren't as important. Humorously, I think Kip, you kind of did this to yourself in a way, you were like, "Oh, it's not really about data breaches anymore." That's true, that's fair.

Kip Boyle: Well, I think they have one foot in the old world of data breaches, and I think they're trying to put a foot into a more current concern about, okay, data gets breached but now my computer is ransomewared and I can't even get any work done, which from the point of view of the victim is worse.

Jake Bernstein: Agreed. So I can confirm happily enough that the incident versus breach definition has not changed. So Kip, why don't we go ahead and get going?

Kip Boyle: Yeah, let's push into it. So the report starts quickly this year, they're pushing this new user guide to an appendix, and then we're just getting right into the data. So we learned immediately that exploitation of vulnerabilities as a path to initiate a breach has nearly tripled from last year.

Jake Bernstein: Tripled?

Kip Boyle: Tripled. Yeah. So that's huge, and probably one of the reasons why they wrote the report the way they did, because they analyzed the data and said, "Holy moly, this is a trend that we need to talk about." But why? Well, does MOVEit ring a bell? Other zero-day vulnerabilities, as you can think of and remember, this dataset is not 2024 dataset. This is 2023 data that has been crunched between November and March roughly, and then written into a report and then released. And I want to remind people, by the way that we had an excellent episode way back in 2021. It was episode number 91, and the title of that episode was, "Can we trust the DBIR to help you run your cyber risk program?" And we got a lot of inside perspective on how the report is made, why the data is high quality, and why the data analysis is high quality. We did that with Susan Widup and she continues to be an author of the report. So anyway, just

Jake Bernstein: I think Suzanne. I think Suzanne.

Kip Boyle: Oh, Suzanne. Yeah. So this is good stuff. Now, web applications, that's the primary vector to blame for these increased attacks. So this is going to be a major theme of the DBIR this year. And there's going to be many ramifications for companies that purchase security software from third parties, which ta-da, the connection with-

Jake Bernstein: That's the first of many connections, Kip. Actually, I honestly typo'd that it's really purchase software.

Kip Boyle: Okay. Not just security software-

Jake Bernstein: But also-

Kip Boyle: It's included. Yeah, it's included. So we're also going to learn that ransomware is losing some popularity, sort of. Don't get too excited because the only reason why ransomware is going down right now is because just plain old extortion has become far more popular. Why deploy ransomware when I can just do a more simple attack and then just say, "Give me money, or I'm not going to go away." I mean, extortion in the report is just blackmail without the use of ransomware-style encryption. And it's just an evolved form of monetizing breaches right? Now, I want to say one more thing before you comment, Jake. Ransomware is still, according to the DBIR, a top threat across 92% of the industries that they examined. And we'll dive more deeply into that in part two. But the ransomware ticking down, I don't know that it means much.

Jake Bernstein: Yeah. And just to be clear, when I say, when I wrote for poor Kip here, that extortion technique has become far more popular, I just meant relative to extortion in the past. Is ransomware is still the top, it's just that some chunk of it is now extortion. And then, look, extortion is, we used to, for a while, we were calling it ransomware 2.0. It was like, oh, well, if you want your data back then you'll... If you don't care about getting your data back, then ransomware 2.0 was, we're going to threaten to release it. Well, the bad guys have just decided that whole encrypting their data thing is a complication that we just don't really need, because it turns out that a lot of people have gotten the clue and-

Kip Boyle: They're backing up.

Jake Bernstein: inaudible stuff. They're just going to restore from backup. But you know what we have found fellow bad guys, is that almost nobody wants us to make stuff public. So in a lot of ways, they just skip, it's ransomware, exfiltration, but they just skip the encryption, figuring why waste our time. So there you go.

Kip Boyle: More efficient.

Jake Bernstein: And Kip, those are the great high-level summaries that we have. And I want to focus on what they're calling, what the report is calling it's ways in analysis. And it's fascinating, especially amongst the explosive growth of the exploit vulnerability pattern, which is distressing. And like you just said, this is funny because I scripted it. I'm not sure I consider the ransomware extortion split to be all that meaningful either. But before we do that, let's get in, let's take a look at the bigger picture. So we do this every year.

Now, the numbers this year are as follows, 30,458 security incidents with 10,626 confirmed data breaches. If that seems like it's bigger, Kip, that's because it's about double last year's report. And why so many? Well, the DBI authors think the surging number of incident reporting organizations, many of whom have been guided by a growing requirement to report breaches. That's going to be a theme as well. So a lot of breaches-

Kip Boyle: But isn't it interesting?

Jake Bernstein: And also I want to say I feel like I can't remember the exact ratio, but I'm fairly certain that we're getting a higher and higher ratio of breaches to incidents as we go. So that's one thing. But Kip, you said at the beginning that you love data and you want to make your decisions based off data.

Kip Boyle: Yep.

Jake Bernstein: Well, as you'll see, I mean, that's very significant, double the confirmed data breaches year-over-year. We-

Kip Boyle: Now, we have to be careful because whenever we see something like that, we have to ask ourselves, what's causing that increase? And in this case, it's because there's more data.

Jake Bernstein: Yeah, there's more reporting. I want to be clear. I think honestly what that says-

Kip Boyle: There aren't more attacks, is there's more visibility into the attacks.

Jake Bernstein: Yes. I guess, maybe we don't know, to be fair, if it's more or not. It doesn't really matter.

Kip Boyle: Okay. But that's one explanation.

Jake Bernstein: It is. Well, not only is it one explanation, I think it's the correct explanation. And the fact is that, and this is going to be one of my themes, is that reporting matters a great deal.

Kip Boyle: Yes. And when it comes to crime, most crime isn't reported. And so remember that any crime statistics you see is only a fraction of what really is going on out there. And this has been true for decades and decades and decades. People are very reluctant to report that they have been victimized by a crime, especially in more traditional crime like in the case of rape and assault and that sort of thing, the percentage of reporting is very, very, very, very low. And I only bring that up because some people feel a lot of shame around personal assaults, but they also feel a lot of shame on some of the cyber stuff because they just figure like, "Oh, I was so stupid." And they weren't. But they feel that way. And so they don't tend to report. So just bear that in mind.

Now, let's get into the findings. So the DBIR always starts with a summary of the findings across the board. So let's just take a look at that. And when you start paging through, you learn that roughly one-third of all the breaches involved, ransomware or some other extortion technique, one-third. And as Jake mentioned, pure extortion hacks have risen over the past year and are now a component of just under 10% of all breaches. And my prediction is that's just going to grow. Next year's report it's probably going to just be a bigger number. So even though ransomware has fallen slightly to 23%, when you combine them, the two techniques represent one-third of all breaches. I really appreciate that the DBIR is actually reporting on what's going on. I just think maybe they need to change the name of their report. Anyway.

Jake Bernstein: Never. I'll never, because then I'll have to say DBIR, because that's what it is.

Kip Boyle: Yeah, yeah, yeah.

Jake Bernstein: Don't listen to Kip, don't listen to-

Kip Boyle: But the only constant is change. So get used to it. Now, other thing to note this year is a revision to the DBIR's calculation of the involvement of the human element. And they are now excluding malicious privilege misuse. Okay, well, why? Well, it's because they want to provide a clear metric to what security awareness can and cannot impact. And I like this. I really, really do. Here's some of the numbers. 68% of all breaches involved a human element, and that was roughly the same as last year. But think about that, 68%, that's enormous. 32% of breaches involved ransomware or extortion, 28% of breaches involved errors, which I think is another form of human element, preventable. And then 16% of all breaches involved a third party. And that would be including software vulnerabilities and of course, our good friends, but unfortunately, having a bad day, CrowdStrike.

Now, the last piece is new this year. The DBIR authors, whoa, they definitely need to change that, introduced an expanded concept of breach, which involves a third party that includes partner infrastructure being affected and direct or indirect software supply chain issues. In other words, these are breaches that organizations can potentially mitigate or prevent by trying to select vendors with better security track records. That's not easy, but it's potentially a huge finding. The 15% of breaches involving a third party is up by over 68% year over year. This is great stuff.

Jake Bernstein: It really is, and I think this is why I said the report is evolving. They're aware that some of the various systems, some of the older, I mean it's 17 years old, things have changed in the security landscape. Things have changed in the computing landscape. 17 years ago, Kip.

Kip Boyle: I know.

Jake Bernstein: Where was cloud adoption 17 years ago?

Kip Boyle: I mean, 17 years ago, people I think were still kind of like, what's this virtualization thing?

Jake Bernstein: I think that might be right.

Kip Boyle: Yeah. So a lot's changed. And 17 years ago, let's see, the Center for Internet Security top 20 was still the SANS top 20. And I'm kind of critical about the fact that the SANS top 20 really, I don't think has really kept pace with the current landscape. I think it's due for a major overhaul, or maybe it just needs to be parked in the garage forever. But anyway.

Jake Bernstein: Okay. So I think that modification and the exclusion of malicious privilege misuse is important and why? It's because it's not really fair to include malicious insiders in the... It's not fair to include malicious insiders when we're trying to figure out what security awareness training can and cannot impact. So I think there's a little bit more to talk about on that. But I want to give some additional key figures. So again, thanks to new contributions from mandatory breach notification entities, this data set saw a growth of breaches involving errors now at 28%. And this, according to the DBIR authors, shows that errors are more prevalent than media or traditional incident response-driven bias would otherwise show. That's important because Kip, if you're embarrassed to report a crime, how much more embarrassed are you to report a breach or even an incident that was your own mistake? The level of embarrassment has got to be greater when it's an error. So of all the types of breaches that are going to be under-reported, you've got to think errors are right up there.

Kip Boyle: Yep. Yeah.

Jake Bernstein: So it's useful to have that. And now Kip, for some good news on phishing, sort of, we are seeing a surge in people reporting phishing. When I say that, I mean 20% of users actually report phishing attempts using the little report phishing button in their email client. And what's great Kip? 11% actually report even when they click on the email.

Kip Boyle: So after the horse is out of the barn?

Jake Bernstein: Yeah. They basically are willing, I mean, it's crazy that we're saying this is good news, but seriously, the percentage of people who used to report phishing at all was very, very low. And the percentage that would admit to clicking it and still and then report after clicking, even smaller. So all the training is having some benefit. And you might think, well, those numbers are still ridiculous, we're not going to rely on that. That is true. But if you think about what it means to have 11% instead of 1% report-

Kip Boyle: It's huge.

Jake Bernstein: ... is that you're going to discover it so much faster.

Kip Boyle: Right. Then other people won't even get it in their inbox. But the next bit is super interesting.

Jake Bernstein: Yeah. Kip, so here's not so good, is that the median time to click on a malicious link is 21 seconds.

Kip Boyle: That's a blink.

Jake Bernstein: It's a blink. And here's really scary. It's only another 28 seconds for the person caught in this phishing net to enter their data, which means Kip, yes, the median time for users to fall for phishing emails is less than 60 seconds.

Kip Boyle: Yes. And you know what? That goes directly to the heart of something that I've been trying to explain to people for a long time, which is phishing is emotional manipulation at a distance. It is really nothing more than hijacking your amygdala, which is the primitive lizard brain that we all carry around. The fight or flight response comes from this very ancient part of our brain. And so I tell people, if you open up a message, whether it's an email or a text message, doesn't matter, maybe it's a voice message and you get a rush of emotion, fear, greed, excitement, whatever, that is, your clue, your 21 seconds have begun right then and there. Just back away. Just put the device down, push yourself back from your keyboard and let those emotions run through your body. And then come back and ask yourself, "Is this real?"

Jake Bernstein: And why Kip? Because when you are flooded with those emotions, your ability to critically think and analyze inaudible.

Kip Boyle: Your prefrontal cortex has got your executive function. And one of the things that the amygdala does is it disables it temporarily. And that's why people say when they're in fight or flight mode or freeze, now is the third possibility. But where they say, "Well, I don't really remember doing this or doing that." Or "Wow, I had no idea that I fought back or whatever." And that's because there was a brief period of time where there executive function was all fuzzed out.

Jake Bernstein: Yep. Turns out, Kip, we don't need to be able to executively plan how we might escape from the charging lion, we just need to move.

Kip Boyle: That's right. That's right. That's survival.

Jake Bernstein: It is. And similar to this, we actually do need to have that executive function to avoid a phishing scam. And this data is amazing simply because it just totally confirms what we kind of suspected, which is that if a phishing email is going to work, it's going to work immediately.

Kip Boyle: That's right. That's right. And so because the amygdala can't grab you for a long, long time, it just gives you that shot of adrenaline and gets you going, and then it kind of let's go and goes and fades into the background, and then you get your prefrontal cortex back. If you can just push away from that message for 45 seconds, your head's going to clear and you're going to be able to see it for what it really is.

Jake Bernstein: And I almost got, I actually, I'm going to admit this Kip, I almost fell for one because it was one where it was so plausible and realistic inaudible.

Kip Boyle: Absolutely.

Jake Bernstein: And I was like, it was a request, it was like basically your credentials have been reset.

Kip Boyle: Compromised? Oh, yeah inaudible.

Jake Bernstein: No, no, just reset.

Kip Boyle: Just reset?

Jake Bernstein: That's the thing. It looked like it was just from my IT department. It was like, no big deal. Just reset this password. And I'm like, "Oh, okay." And I almost did, I think it even clicked on the link, which didn't do anything because then you had a form. And I still reported it, even though I clicked on the link.

Kip Boyle: Yeah, good.

Jake Bernstein: But I was saved only by my fairly typical day where I get distracted from things and I was going to... Basically, the reason I got saved is that by the time I came back to it, that whole little rush was over, and I was like, "Wait a second. Something is fishy here." And sure enough, it was. So, again, I don't want to belabor this point too much, but it is really, really much helpful to have that data. So I also want to mention that we have some new data regarding ransomware and extortion dollar losses. So this data mostly comes from the FBI's IC3 data set, which you'll actually mention as well.

But over the last three years, the median loss associated with the aggregated ransomware extortion breaches has been 46,000. But it ranges between $3, $1.141 million, and that range covers 95% of the thing. Now here's what's really interesting, Ransomware and negotiation data. God, I don't think I... I'm amazed that we get to say that, but the data shows that the median, I'll go slowly here, the median ratio of initially requested ransom to company revenue is 1.34%. What does that mean? It means that across the data set, now median mode, median is not average, is it? Which one's average?

Kip Boyle: No, mean is true average.

Jake Bernstein: Mean is average.

Kip Boyle: Median just means the midpoint in the data.

Jake Bernstein: Yes. Median is the midpoint. So the midpoint of the data, thank you for reminding me, means that if my company made a hundred dollars, then the initial ransom would be a $1.34.

Kip Boyle: Yep.

Jake Bernstein: So-

Kip Boyle: Or because of the fluctuation, it could have been different.

Jake Bernstein: Yeah. And I'll get there. Yeah. So now that's the median. Now the fluctuation is pretty substantial. It's between 0.13%, so very, very small, and 8.3%, but even that only covers 80% of cases. So there's a lot of variability here. Still, I think it's interesting, I think it's interesting to know.

Kip Boyle: Well, it's super interesting. One of the things that came into my mind, and I hope to God nobody actually is doing this, but a big question I often get asked, and this has happened over the years, is, "What percentage of my IT budget should I be spending on cybersecurity?" Well, this data almost had me saying, oh, well, as a benchmark, Mr. or Ms. senior decision-maker-

Jake Bernstein: inaudible 10% of your revenue on me.

Kip Boyle: No, no, no, no. That wasn't it. No. What I was thinking was, if you end up paying a ransom that is less than 1.34% of your annual revenue, you're doing good.

Jake Bernstein: That's funny. That is funny. Okay-

Kip Boyle: But I don't want that because I don't want ransoms paid.

Jake Bernstein: Yep.

Kip Boyle: Anyway, but yeah, that's fascinating. And I don't think we've had a DBIR where we had ransomware negotiation data before.

Jake Bernstein: No, I'm pretty sure this is the first time we've gotten that data.

Kip Boyle: Yeah, that's fascinating. It's sad. It's really, really sad. It's a tragedy of the commons. I've said this before, I'll keep saying it, every dollar we spend on ransomware is a vote for more attacks. It's really that simple. So anyway, now one last summary-level finding. So we're still in the introduction of this report, believe it or not, 33 minutes into the episode. Over the past two years, incidents involving pre-texting, that's where somebody is faking you out saying that they're somebody that they're not. A business email compromise is a great example. But these incidents account for one-fourth of the financially motivated attacks. And in both years, the median, that's the midpoint transaction amount of a BEC business email compromise was around $50,000 according to the FBI's data set. And $50,000, if you're Boeing or Microsoft or whatever, you're probably not too worried about that. But we work with mid-market companies at CRO, and my company. At 50 grand is a big deal.

Jake Bernstein: Well, and not only that Kip, but these BECs are, they're so... Look, there is some cost to ransomware deployment. Somebody had to develop it, someone has to keep it going. There's just command and control servers. It gets a little messy. There's the whole negotiating. But a BEC when done properly just results in magic money-

Kip Boyle: That's right. It just happens.

Jake Bernstein: inaudible bank account. It just happens. And so, yeah, you know what? Again, median transaction amount, here's the problem though, big companies, they're not only paying one BEC, they might be playing dozens in a year. Who knows?

Kip Boyle: Yep. And they're much higher than the median.

Jake Bernstein: Yep, for sure. Okay, so now it's time to dive into the results and analysis. And I will mention in brief that yes, they were very close last year. Now they have absolutely broken past their million incident milestone. But honestly, it's just a footnote. And by the way, I have to laugh at my own pun. Literally, see footnote number two. Second, it is worth celebrating in a twisted way that this edition now includes over 10 thousand breaches, as we said, analyzed in a single report. This really helps improve the data set, and allows us to get a lot of value from the report. More in some ways than we've gotten in years past. And it's going to become a theme this year, because it turns out Kip, tell me if you're surprised by this, that more reporting leads to better data, which leads to better analysis, which leads to superior actionable advice.
So look, even if you don't like it, breach reporting does help.

Kip Boyle: It does.

Jake Bernstein: It does. Okay. As a reminder, VERIS has these four categories, the four A's. Actor, which is who, action, how, asset, where, and attribute, what. Now, you may have noticed it's already at 36 minutes. You excuse a little bit of that for our digression on the news of the day, but I'm very pleased with myself because I've pre-planned that we're only going to try to cover actor in action the remainder of this episode. So if you're wondering where's asset and attribute, that's going to be next time. Now an incident, by the way, I remember that an incident isn't considered complete without all four of these, this data, even if we don't always know the true answer. And here's another example, Kip of why I'm saying the DBIR is evolving. This year, they decided to discuss some higher-level findings that go beyond that fixed VERIS four A structure. And I'm going to highlight those as they come up. But the very first one of these, actionable perspective is that new ways in analysis.

The goal is to help make sense of the initial steps into breaches in order to help predict how best to avoid or prevent them. And this is where we start talking about figures. Figure six shows a clear picture of the biggest pain point for everyone during this report's year, which is the 180% increase in the exploitation of vulnerabilities as the critical path action to initiate a breach. Obviously, not surprising thanks to the MOVEit event's notoriety, but it honestly should still be shocking. And the reason that I think it's shocking, Kip, and I'm curious what you think, is that it feels like, I don't know, a couple of years ago maybe we started talking about how the IT security seemed like it was pretty good, and that really we were really worried about texting and people, well, not that simple.

Kip Boyle: Yeah. Well, it's not. None of this is really simple. That's the problem. I mean, as good as the DBIR is, I mean, and I am a big fan, everybody knows that. Even the authors of the DBIR tell us that this is very difficult data to analyze and to draw strong conclusions from. There's lots of correlation in here, but there's not much causation like statistically proven, this causes that. So there's some real limitations. And also another thing-

Jake Bernstein: That's not their fault.

Kip Boyle: It's absolutely not their fault. Another thing that they say is that the type of science that they're doing here, this kind of data science they're doing, they're not able to really set up a thesis and then knock it over or affirm it, because that's just not what's going on here. They're relying on data coming in from contributors. They really don't have any control over what data is being given to them. All they can do is clean it and analyze the stuff that's worth analyzing, and then they just discover stuff. And so that's what it is.

Jake Bernstein: Yeah, they're not experimenting, which makes this really an interesting style of report. Okay, Kip-

Kip Boyle: But it's all we have, right?

Jake Bernstein: It is all we have, yes.

Kip Boyle: Okay. So there's an overlay of different actions with their most popular vectors and to help focus our response and planning. And if you go to figure seven in the report, and that's on page 12, 12 in the actual bottom of the page, not 12 as your PDF reader counts it, but figure seven. So here's what you're going to see when you go to figure seven. So first we have credentials plus web applications on top of this bar charts, in other words, where most of the action is. Then after that comes phishing plus email, then the exploitation of vulnerabilities with web applications, then credentials and desktop sharing software.

And then the final three would be credentials plus VPN, and then the exploitation of a vulnerability plus desktop sharing software. And then finally, exploit of a vulnerability plus VPN. So that's the bar chart. And if you're having a hard time imagining that, just flip open to page 12. But what do we learn from this? Well, credentials and exploit, the exploitation of vulnerabilities are the ways in for most non-error, non-misuse breaches, and an ironic source of pain are the VPNs, which are supposed to keep us safe. So that's a little discouraging.

Jake Bernstein: It is a little discouraging, but at the same time, I'm so glad that they have performed this kind of analysis and created this overlay. Because it seems like every year they come up with some new way here or there to slice and dice data, and they'll be the first to admit, sometimes it's not always useful, sometimes it is. This one I think is quite helpful because again, I mean the phishing email one is obvious. Everybody knows that if you have a phishing action, then email is probably by definition the vector. But the-

Kip Boyle: The VPNs, the desktop sharing software, that's insightful.

Jake Bernstein: And the fact that, I mean, that web application, the exploitation of vulnerabilities on web applications is really high up there. We didn't give numbers, but the credentials web application is roughly 50% of these things. The phishing email is maybe 20%, 30%. Exploit vulnerability is barely lower inaudible. So-

Kip Boyle: But it is interesting how things ebb and flow. I mean, one year, the exploitation of vulnerabilities just isn't that much of a thing. And then the next year, because these people attacking us are always innovating, it starts becoming a thing again. So we're running from one thing to the next. Now, let's also consider this new analysis around human element. And the original formula for what was included in the human element metric included privileged misuse breaches, which are cases that are involving malicious insiders. And you've already pointed out that it's really not fair to include that if you want to honestly understand employee mistakes.

In other words, these are not malicious people. They're just either making mistakes as they go about their work or they're being manipulated by somebody into doing something that they themselves would never do if they knew what was actually going on. And so by making this change, we can now really focus on what can security awareness training do to decrease the number of errors and to decrease the amount of times that somebody gets manipulated into doing something. And so this results in a revised human element presence of 68% in breaches, which is similar to last year. And as we said, this is things like the movement vulnerability, some zero-day stuff.

Jake Bernstein: Sorry. Actually, that my fault for making it clear, sorry. It's actually those are not, the movement vulnerability is not included here. The reason that 68% just happens to be similar to the human element from last year is that the increases in miscellaneous errors pattern and the increased automated MOVEit vulnerability were similar in scope. We just happened to have a similar result. But the authors really want to just make the point that going forward, they're just going to be more precise with how they talk about human element. And I think if they calculated it this year the way they did last year, it'd be like 75% instead of 68%. So it's not a huge difference, but I think when you're getting really granular, that is obviously significant enough to make the change in definition worthwhile.

Kip Boyle: My big takeaway from this, and what I tell my customers all the time is you have, you as a senior decision maker have way more control over this than you realize.

Jake Bernstein: Yeah, you do. Now, Kip, we also get a new metric. Are you excited for the new metric?

Kip Boyle: This is a good one.

Jake Bernstein: And I think we've already mentioned the name of it, or maybe we haven't. But the name is supply chain interconnection. And it was an influence in 15% of all breaches analyzed in the report, which is, as we've said, 68% year-over-year growth last year, what is now called supply chain interconnection, would've been a factor in only 9%-

Kip Boyle: So 9 to 15.

Jake Bernstein: ... of breaches. 9% to 15%. What does it mean? Well, to be included in this supply chain Interconnection, a breach must have taken place, because either a business partner was the vector of entry for the breach. The classic example here being the HVAC entry point back in the 2013 Target breach. Which man is 15, no. No, no, I can do math.

Kip Boyle: 11.

Jake Bernstein: 11 years ago. Or if the data compromise happened in a third party data processor custodian site, that's your MOVEit type example.

Now, the metric also includes things like solar winds and 3CX, which I don't remember. Because in those cases, the vendor's software development processes themselves were hijacked and used to push malicious software updates to customers. Therefore, all of the resulting end customer breaches were initially caused by the infiltration of a third party. And now the DBIR does count the exploitation of vulnerabilities in this metric as well. Now, they say it might be a little controversial, and that gets to blaming the victim. Technically, and the reason they're saying this is controversial is that, an exploitation of vulnerability of a third party might seem a little unfair to put on the third party because they themselves were exploited.

But what the DBIR says, and I agree, is that really the issue is the incentives for quality control not matching the risk of harm here, largely, in my opinion, because of scaling. In other words, just a few QC failures can disproportionately affect the customers using software and have a powerful and wide-reaching effect on the overall threat landscape. Now, Kip, how do we start this show? And now do you see what could be more perfect?Let's just take a... Let's paint a magic picture and say that truly the CrowdStrike caused outage was a typo in a driver, right? QC failure-

Kip Boyle: Yep, quality control.

Jake Bernstein: But oh goodness, oh my goodness. A disproportionate impact-

Kip Boyle: Definitely.

Jake Bernstein: ... of that QC failure is over the top. It's over the top.

Kip Boyle: Yeah. It really is.

Jake Bernstein: And I would like to direct your attention, friends and listeners to figure 10 on page 14, per the footer numbering system. It shows the action varieties in selected supply chain interconnection breaches, exploit vulnerability shows up, of course, given this year in 90% of these breaches, followed by backdoor or C2 at 80%, extortion at 70%, and then a quick and rapid decrease to other at 18%, and then at 10% or less, you've got use of stolen credentials, ransomware, export data and password dumper. So what does the DBIR say here? They say that, look, this metric ultimately represents a failure of community resilience and recognition of how organizations depend on each other.

Every time a choice is made on a partner or software provider by your organization, and it fails you, this metric goes up. Let me state that one more time. When you choose a partner, whether it's a true partner organization or simply a software provider, and that partner fails you, this metric is going to go up. So organizations must find ways to make better choices to avoid rewarding the weakest link.

Kip Boyle: That is so hard because we don't have very many reliable ways to do that.

Jake Bernstein: I know. I know we don't. But Kip, mandatory breach reporting is going to greatly assist us in this project. Here's the problem, and I'm a wax philosophical, this is just going to be a long episode. I don't think anyone minds.

Kip Boyle: Okay, but I am going to say right now, I don't think we're going to get nearly through all the material that we prepared for this one. So please be thinking about a convenient stopping point.

Jake Bernstein: I will do that. I will do that for you, which makes me laugh because yeah, well.

Kip Boyle: You always bring more to the party than you realize.

Jake Bernstein: I always bring more to the party. So look, markets are an incredibly efficient way to distribute capital and to reward efficient use of that capital. But one of the biggest problems with markets is a lack of information. Now, let's just hypothetically say that out there is some vendor, and I'm not going to pick on CrowdStrike, CrowdStrike, they feel bad enough. They already know what's going on, that one's out there. But Kip, what if every breach was publicized? Seriously, what if a... Sorry, what's the name again on this? The supply chain interconnection breach. What if every supply chain interconnection breach was publicized and there was a database of vendors involved in those supply chain interconnection breaches?

This does not exist. But if it did exist, what would happen is that companies that show up a lot in the supply chain interconnection breaches are either quickly or even possibly slowly, depending on how critical they are, lose customers. Or they'll get better. This is the nature of the market and competition. So what I think is that you're right, it is very hard to choose or to make those better choices to avoid rewarding the weakest link. But the breach reporting is perhaps one of the only ways to get the data that we all need to make these calls.

Kip Boyle: Yeah. And I'm not going to push back and say that that's wrong or misguided or anything, because yeah, this is so tough. I mean, we're talking about governance, we're talking about regulations, we're talking about laws and so forth. And the atmosphere in the United States right now is kind of perilous for regulations. And we've got another episode planned where we're going to talk about the Chevron case that just got-

Jake Bernstein: Yes, the Chevron doctrine's death.

Kip Boyle: Yep, yep, yep, yep, yep. So anyway. So I think that the salvation for us in terms of being attacked through cyber exploitation, our salvation, I think is going to have to come from some sort of a regulatory regime. And I think this is just one facet, just one aspect of that mandatory breach reporting. And I understand nobody wants to do it. I get that. I do. But I mean, we're talking about an online community here that everybody's been excited about since what, 1995? Commerce on the internet. I mean, it just caused everything to flourish. We have to protect that.

Jake Bernstein: We do. I also wonder if antitrust isn't going to become a bigger and bigger issue.

Kip Boyle: It's going to have to change though, right? Because Antitrust at the time of Standard Oil looks very different than it should today.

Jake Bernstein: It does. And that's a totally different conversation, which we will definitely not go into now. So Kip, why don't we do this? Maybe we wrap it up here.

Kip Boyle: This would be a good spot.

Jake Bernstein: This would be a good spot because we're about to dive into actors, and I think that we should probably go ahead and take the break here.

Kip Boyle: All right, so that's what we're going to do. Thanks for sticking with us, everybody. We know that this has gone a little bit long, but you can tell, we're excited. DBIR makes us completely excited and irrational. But that does wrap up this episode of the Cyber Risk Management Podcast. So today we did part one of our analysis of the 2024 edition of the Verizon Data Breach Investigations Report. We wanted to see what we could learn and admit that we didn't get quite as far into the report as we have in past years. But you know what? Next time we're going to pick back up and we're going to get through it all. We're going to look at assets, attributes, incident classification patterns, industry data, and we hope to see you here. So see you next time.

Jake Bernstein: See you next time.

Speaker 1: Thanks for joining us today on the Cyber Risk Management Podcast. If you need to overcome a cyber security hurdle that's keeping you from growing your business profitably, then please visit us at cr-map.com. Thanks for tuning in. See you next time.