homepage
Open menu
Go one level top
  • Train and Certify
    • Overview
    • Get Started in Cyber
    • Courses
    • GIAC Certifications
    • Training Roadmap
    • OnDemand
    • Live Training
    • Summits
    • Cyber Ranges
    • College Degrees & Certificates
    • Scholarship Academies
    • NICE Framework
    • Specials
  • Manage Your Team
    • Overview
    • Group Purchasing
    • Why Work with SANS
    • Build Your Team
    • Hire Cyber Talent
    • Team Development
    • Private Training
    • Security Awareness Training
    • Leadership Training
    • Industries
  • Resources
    • Overview
    • Internet Storm Center
    • White Papers
    • Webcasts
    • Tools
    • Newsletters
    • Blog
    • Podcasts
    • Posters & Cheat Sheets
    • Summit Presentations
    • Security Policy Project
  • Focus Areas
    • Cyber Defense
    • Cloud Security
    • Digital Forensics & Incident Response
    • Industrial Control Systems
    • Cyber Security Leadership
    • Offensive Operations
  • Get Involved
    • Overview
    • Join the Community
    • Work Study
    • Teach for SANS
    • CISO Network
    • Partnerships
    • Sponsorship Opportunities
  • About
    • About SANS
    • Our Founder
    • Instructors
    • Mission
    • Diversity
    • Awards
    • Contact
    • Frequently Asked Questions
    • Customer Reviews
    • Press
  • SANS Sites
    • GIAC Security Certifications
    • Internet Storm Center
    • SANS Technology Institute
    • Security Awareness Training
  • Search
  • Log In
  • Join
    • Account Dashboard
    • Log Out
  1. Home >
  2. Blog >
  3. 2021 Verizon Data Breach Incident Report Insights
370x370_Lance-Spitzner.jpg
Lance Spitzner

2021 Verizon Data Breach Incident Report Insights

This year's key finding is loud and clear, the human element is by far the largest risk.

June 17, 2021

Once a year every year, the Verizon Security team releases what is known as the Verizon Data Breach Incident Report, also known as the VZ DBIR. This annual report is known and respected as one of the world’s best data driven reports on incidents and breaches at a global level. What I love about this report is

  • It’s truly vendor neutral, there is no product or service to promote.
  • It’s truly global, the Verizon team collects data on thousands of incidents from around the world (29,207 for this year to be exact).
  • They then use this data to better understand the most common drivers for breaches and incidents today and share their analysis. As their data set is global they look at both technical and human risk.
  • They are very transparent on both the sources of their data and the processes they used to analyze the data, clearly pointing out areas of uncertainty.

There are several special things about this year’s report. The first is I had the opportunity to interview two of the authors behind the report, Alex Pinto and Gabriel Bassett. Alex and Gabriel were kind enough to help us better understand their thought process and findings. Second, we are very excited to announce that both of them will also be speaking at the SANS Security Awareness Summit this 5/6 August, further discussing the topic of human risk.

For 2021 one key finding is loud and clear; the human element is by far the largest risk. In fact, the report clearly calls out that human interaction was involved in over 85% of breaches. By human interaction the report means breaches that involved actions such phishing attacks, cyber attackers using easily guessed passwords, human error, intentional misuse of privileges, or even bad decisions leading to malware infections.

VZ_DBIR.png

In addition, human risk has become such a common element in incidents and breaches at a global level that after fourteen years the VZ DBIR had to change how they structure their report to include changing their infamous “Patterns” to include “Social Engineering” (p. 31 of the report). As security awareness professionals, there are two key ways you can leverage this data-driven report.

  1. Prioritize: Use the report to better understand the different elements of, and drivers for human risk, prioritize your top human risks and then focus your awareness program on just those top risks. As a result, you can be far more effective in how you manage your human risk.
  2. Support: Use this report to demonstrate to leadership just how important human risk has become and the key role awareness plays in managing that risk.

Here are the key points I took away from the report.

  • Human is the Top Risk (p. 07): Human interaction was involved in 85% of breaches. If your organization is taking a purely technical approach to your security program, you are crippling your ability to effectively manage your organization’s risk. To quote Gabe Bassett, “Your job is not to secure your computers but your organization. And if you’re not securing your people, you’re not securing your organization.”
  • Top Two (p. 15): For the third year in a row, the top two risks are phishing and passwords. If you don’t know what to focus on in your awareness program or if you don’t know how to best manage your human risk, start with phishing and passwords. If these are not a key part of your awareness program, you should have a good reason as to why.
  • Error (p. 43): Far too often we focus on just deliberate threat actors such as Cyber Criminals or Nation State, yet human error represents almost 20% of breaches, good people trying to do the right thing. The two most common examples of error are misconfiguring Cloud accounts resulting in your data accidentally being shared with the world and causing email delivery being sent to the wrong person (for example, due to auto-complete). Far too often security teams feel accidental is not their responsibility, even when it represents as many breaches as System Intrusions. Make sure you have someone responsible for, and a program to address human error.
  • Top Control (p. 64): With so much data, the VZ DBIR can identify key drivers of incidents and breaches at the industry level, this year they do this for eleven different industries. Based on the data for each industry they also recommended the top three Center for Internet Security controls that can most effectively manage each industry’s overall risk. Security Awareness and Training was the only control recommended for all eleven industries.

There is a huge wealth of knowledge in the report that we have not even touched on. For example, to include data on SMBs (Small-to-Medium Businesses), data based on Region and in-depth descriptions of their approach and methods used for data analysis. I highly recommend this report for any organization attempting to manage their cyber risk, for me it’s the gold standard for actionable reports.

To learn more about SANS Security Awareness’ product offerings and free resources visit us here!

Share:
TwitterLinkedInFacebook
Copy url Url was copied to clipboard
Subscribe to SANS Newsletters
Receive curated news, vulnerabilities, & security awareness tips
United States
Canada
United Kingdom
Spain
Belgium
Denmark
Norway
Netherlands
Australia
India
Japan
Singapore
Afghanistan
Aland Islands
Albania
Algeria
American Samoa
Andorra
Angola
Anguilla
Antarctica
Antigua and Barbuda
Argentina
Armenia
Aruba
Austria
Azerbaijan
Bahamas
Bahrain
Bangladesh
Barbados
Belarus
Belize
Benin
Bermuda
Bhutan
Bolivia
Bonaire, Sint Eustatius, and Saba
Bosnia And Herzegovina
Botswana
Bouvet Island
Brazil
British Indian Ocean Territory
Brunei Darussalam
Bulgaria
Burkina Faso
Burundi
Cambodia
Cameroon
Cape Verde
Cayman Islands
Central African Republic
Chad
Chile
China
Christmas Island
Cocos (Keeling) Islands
Colombia
Comoros
Cook Islands
Costa Rica
Croatia (Local Name: Hrvatska)
Curacao
Cyprus
Czech Republic
Democratic Republic of the Congo
Djibouti
Dominica
Dominican Republic
East Timor
East Timor
Ecuador
Egypt
El Salvador
Equatorial Guinea
Eritrea
Estonia
Ethiopia
Falkland Islands (Malvinas)
Faroe Islands
Fiji
Finland
France
French Guiana
French Polynesia
French Southern Territories
Gabon
Gambia
Georgia
Germany
Ghana
Gibraltar
Greece
Greenland
Grenada
Guadeloupe
Guam
Guatemala
Guernsey
Guinea
Guinea-Bissau
Guyana
Haiti
Heard And McDonald Islands
Honduras
Hong Kong
Hungary
Iceland
Indonesia
Iraq
Ireland
Isle of Man
Israel
Italy
Jamaica
Jersey
Jordan
Kazakhstan
Kenya
Kingdom of Saudi Arabia
Kiribati
Korea, Republic Of
Kosovo
Kuwait
Kyrgyzstan
Lao People's Democratic Republic
Latvia
Lebanon
Lesotho
Liberia
Liechtenstein
Lithuania
Luxembourg
Macau
Macedonia
Madagascar
Malawi
Malaysia
Maldives
Mali
Malta
Marshall Islands
Martinique
Mauritania
Mauritius
Mayotte
Mexico
Micronesia, Federated States Of
Moldova, Republic Of
Monaco
Mongolia
Montenegro
Montserrat
Morocco
Mozambique
Myanmar
Namibia
Nauru
Nepal
Netherlands Antilles
New Caledonia
New Zealand
Nicaragua
Niger
Nigeria
Niue
Norfolk Island
Northern Mariana Islands
Oman
Pakistan
Palau
Palestine
Panama
Papua New Guinea
Paraguay
Peru
Philippines
Pitcairn
Poland
Portugal
Puerto Rico
Qatar
Reunion
Romania
Russian Federation
Rwanda
Saint Bartholemy
Saint Kitts And Nevis
Saint Lucia
Saint Martin
Saint Vincent And The Grenadines
Samoa
San Marino
Sao Tome And Principe
Senegal
Serbia
Seychelles
Sierra Leone
Sint Maarten
Slovakia (Slovak Republic)
Slovenia
Solomon Islands
South Africa
South Georgia and the South Sandwich Islands
South Sudan
Sri Lanka
St. Helena
St. Pierre And Miquelon
Suriname
Svalbard And Jan Mayen Islands
Swaziland
Sweden
Switzerland
Taiwan
Tajikistan
Tanzania
Thailand
Togo
Tokelau
Tonga
Trinidad And Tobago
Tunisia
Turkey
Turkmenistan
Turks And Caicos Islands
Tuvalu
Uganda
Ukraine
United Arab Emirates
United States Minor Outlying Islands
Uruguay
Uzbekistan
Vanuatu
Vatican City
Venezuela
Vietnam
Virgin Islands (British)
Virgin Islands (U.S.)
Wallis And Futuna Islands
Western Sahara
Yemen
Yugoslavia
Zambia
Zimbabwe

Recommended Training

  • MGT514: Security Strategic Planning, Policy, and Leadership
  • SEC542: Web App Penetration Testing and Ethical Hacking
  • SEC534: Secure DevOps: A Practical Introduction

Tags:
  • Security Awareness

Related Content

Blog
SSA_Blog_Thumbnails_&_Social_Posts_May_22_PasswordDay_thumbnail.jpg
Security Awareness, Security Management, Legal, and Audit
May 5, 2022
World Password Day – Readying Your Workforce for MFA
Today is the perfect opportunity to talk about strong passwords.
370x370_Lance-Spitzner.jpg
Lance Spitzner
read more
Blog
Security Awareness
February 25, 2022
Russian Invasion of Ukraine - What to Communicate to Your Workforce
Focusing on cybersecurity fundamentals is key to protecting both yourself and your workforce at home and at work during these unprecedented times.
370x370_Lance-Spitzner.jpg
Lance Spitzner
read more
Blog
Security Awareness
February 15, 2022
Nation State Threat Actors: From a Security Awareness Perspective
What you should focus on teaching your workforce when defending against nation state threat actors.
370x370_Lance-Spitzner.jpg
Lance Spitzner
read more
  • Register to Learn
  • Courses
  • Certifications
  • Degree Programs
  • Cyber Ranges
  • Job Tools
  • Security Policy Project
  • Posters & Cheat Sheets
  • White Papers
  • Focus Areas
  • Cyber Defense
  • Cloud Security
  • Cyber Security Leadership
  • Digital Forensics
  • Industrial Control Systems
  • Offensive Operations
Subscribe to SANS Newsletters
Receive curated news, vulnerabilities, & security awareness tips
United States
Canada
United Kingdom
Spain
Belgium
Denmark
Norway
Netherlands
Australia
India
Japan
Singapore
Afghanistan
Aland Islands
Albania
Algeria
American Samoa
Andorra
Angola
Anguilla
Antarctica
Antigua and Barbuda
Argentina
Armenia
Aruba
Austria
Azerbaijan
Bahamas
Bahrain
Bangladesh
Barbados
Belarus
Belize
Benin
Bermuda
Bhutan
Bolivia
Bonaire, Sint Eustatius, and Saba
Bosnia And Herzegovina
Botswana
Bouvet Island
Brazil
British Indian Ocean Territory
Brunei Darussalam
Bulgaria
Burkina Faso
Burundi
Cambodia
Cameroon
Cape Verde
Cayman Islands
Central African Republic
Chad
Chile
China
Christmas Island
Cocos (Keeling) Islands
Colombia
Comoros
Cook Islands
Costa Rica
Croatia (Local Name: Hrvatska)
Curacao
Cyprus
Czech Republic
Democratic Republic of the Congo
Djibouti
Dominica
Dominican Republic
East Timor
East Timor
Ecuador
Egypt
El Salvador
Equatorial Guinea
Eritrea
Estonia
Ethiopia
Falkland Islands (Malvinas)
Faroe Islands
Fiji
Finland
France
French Guiana
French Polynesia
French Southern Territories
Gabon
Gambia
Georgia
Germany
Ghana
Gibraltar
Greece
Greenland
Grenada
Guadeloupe
Guam
Guatemala
Guernsey
Guinea
Guinea-Bissau
Guyana
Haiti
Heard And McDonald Islands
Honduras
Hong Kong
Hungary
Iceland
Indonesia
Iraq
Ireland
Isle of Man
Israel
Italy
Jamaica
Jersey
Jordan
Kazakhstan
Kenya
Kingdom of Saudi Arabia
Kiribati
Korea, Republic Of
Kosovo
Kuwait
Kyrgyzstan
Lao People's Democratic Republic
Latvia
Lebanon
Lesotho
Liberia
Liechtenstein
Lithuania
Luxembourg
Macau
Macedonia
Madagascar
Malawi
Malaysia
Maldives
Mali
Malta
Marshall Islands
Martinique
Mauritania
Mauritius
Mayotte
Mexico
Micronesia, Federated States Of
Moldova, Republic Of
Monaco
Mongolia
Montenegro
Montserrat
Morocco
Mozambique
Myanmar
Namibia
Nauru
Nepal
Netherlands Antilles
New Caledonia
New Zealand
Nicaragua
Niger
Nigeria
Niue
Norfolk Island
Northern Mariana Islands
Oman
Pakistan
Palau
Palestine
Panama
Papua New Guinea
Paraguay
Peru
Philippines
Pitcairn
Poland
Portugal
Puerto Rico
Qatar
Reunion
Romania
Russian Federation
Rwanda
Saint Bartholemy
Saint Kitts And Nevis
Saint Lucia
Saint Martin
Saint Vincent And The Grenadines
Samoa
San Marino
Sao Tome And Principe
Senegal
Serbia
Seychelles
Sierra Leone
Sint Maarten
Slovakia (Slovak Republic)
Slovenia
Solomon Islands
South Africa
South Georgia and the South Sandwich Islands
South Sudan
Sri Lanka
St. Helena
St. Pierre And Miquelon
Suriname
Svalbard And Jan Mayen Islands
Swaziland
Sweden
Switzerland
Taiwan
Tajikistan
Tanzania
Thailand
Togo
Tokelau
Tonga
Trinidad And Tobago
Tunisia
Turkey
Turkmenistan
Turks And Caicos Islands
Tuvalu
Uganda
Ukraine
United Arab Emirates
United States Minor Outlying Islands
Uruguay
Uzbekistan
Vanuatu
Vatican City
Venezuela
Vietnam
Virgin Islands (British)
Virgin Islands (U.S.)
Wallis And Futuna Islands
Western Sahara
Yemen
Yugoslavia
Zambia
Zimbabwe
  • © 2022 SANS™ Institute
  • Privacy Policy
  • Contact
  • Careers
  • Twitter
  • Facebook
  • Youtube
  • LinkedIn