Verizon Breach Report; UnitedHealth Attempts to Silence Victims With ID Theft Monitoring; Increasing GPT Attacks

It is not "human error". It is technology that is not protecting humans and abstracting security leading to a failure to communicate risk to users.

Johannes Ullrich

The term “human error” is actually incorrect. What VZ DBIR pointed out is the human element is involved in over 65% of all breaches (not including malicious insiders). That number is people, primarily victims of cyberattacks (social engineering) or people making mistakes (that is human error). What really popped this year is people making mistakes represents 28% of all breaches globally; that is a big number. One of the biggest problems we have is that security is really hard for most people, the behaviors we are demanding of them are often confusing, difficult, and overwhelming. Security is no longer just a technology challenge but also a human challenge, and the first step to addressing the human side is making security as simple as possible for people (which is not easy).

Lance Spitzner

Well done Verizon, another excellent report. For me, a few key takeaways: 1) the human is still the weak link to building an effective cybersecurity program – exploitation of authentication credentials; 2) Ransomware had a very good year in 2023 – increase in both attacks and payouts; and 3) software supply chain attacks also had a good year and has become a major concern for security professionals.

Curtis Dukes

One of the discoveries is it’s taking an average of 55 days to resolve 50% of vulnerabilities. While we’re likely nailing desktop and commodity system patching, those boundary devices, including VPN and remote access services need to be doubled down on. Make sure that you’re not just relying on your WAF to protect applications, code flaws need to be fixed as well.

Lee Neely

Two years of credit and identity theft protection is a very bad joke. How will that help people affected whose health records got stolen, and who probably have already free identity theft protection from one of a dozen other breaches? Without meaningful penalties, there is absolutely no reason to improve basic cyber security practices. Free identity theft protection is the "thoughts and prayers" of breaches.

Johannes Ullrich

This breach is similar to the Equifax breach in 2017, to include the size and scope of breach, the appearances before Congress and the impact. Just like Equifax, I expect there will be a report published on the details of why and how the breach happened. Just like Equifax, this is most likely more than just an issue of lack of MFA, but we will see a much bigger issue of a weak security culture.

Lance Spitzner

The big lesson to be learned is the impact that mergers/acquisitions have on one’s cybersecurity program. (UnitedHealth’s acquisition of Change Healthcare was completed in October 2022.) There’s the due diligence part during company acquisition; but then comes the part in merging different security technologies into a common cybersecurity program. Yes, lack of MFA is a big whiff, but I suspect there were other factors at play that led to this sizeable security incident.

Curtis Dukes

Beyond credit protection, and the touted neatly $900 million this breach has cost, there should also be consequences from the regulators.

Lee Neely

Some airports in the area had to cancel flights as their approaches require GPS. For network security, GPS is often used as a time source. So far, I have not seen any measured effects on time keeping, but it is something to keep in mind as you are designing a time synchronization infrastructure. Maybe we have tomust consider internal time standards again.

Johannes Ullrich

I like how CISA recently focuses on essentials like SQL Injection and Path Traversal. Sadly, it won’t matter because the money needed to fix old code is wasted on buying GPUs to train machine learning models that can identify hot dogs. The new ML model will keep investors happy, but the data breach caused by path traversal will just require a subscription to an identity protection service.

Johannes Ullrich

An interesting note in the breach report indicates the leak of MFA information. I assume these are the seeds for one-time pass codes. These seeds are usually not encrypted (and can't be hashed like passwords).

Johannes Ullrich

The compromise of the service account didn’t appear to access payment information or user documents. They did access the Sign user database, usernames, email, hashed passwords, preferences and authentication data. Dropbox is terminating Sign sessions and having users change passwords, including MFA tokens, as well as changing API keys and OAuth tokens. It’s not clear how they are preventing recurrence, something to consider including with you breach communication plan.

Lee Neely

While introduction into the KEV signals active exploitation, the flaw has been known since January when the patch was made available. Hopefully, organizations were already using multi-factor authentication in which case they are safe. For those that haven’t, patch, implement some form of multi-factor authentication, and review your code now to protect against future software supply chain attacks.

Curtis Dukes

All good mitigation recommendations that should be applied regardless of the threat actor. If the OT device is Internet-facing it becomes part of the attack surface available to the evildoer. Address the easy to fix vulnerabilities first, by changing default passwords and updating the software.

Curtis Dukes