Data Breaches in 2019: Why the Hackers are Winning (And What You Can do About It)

Hackers are winning. As noted by Information Age, data breach reports are up 75 percent over the last two years — while part of this increase is tied to emerging legislation and disclosure requirements, a quick look at tech headlines makes it clear that attackers are coming out ahead in the fight to keep corporate networks, applications and data secure.

But it’s not all bad news. Armed with knowledge of the current breach landscape — along with actionable insight to protect critical assets — organizations can start to even the score and put hackers on the defensive. Here’s what you need to know.

A Brief History of Breaches

2018 saw substantial breach activity. In May, social platform Twitter reported that 333,000,000 records were breached after a glitch that stored passwords in plain text on internal systems. The month before, Facebook reported 29,000,000 compromised records after “malicious third-party scrapers” grabbed user data.

It gets worse: August 2018 saw 14.8 million voter records exposed in Texas after a single file was stored without a password on an insecure server. Names, addresses and voting history and gender data were compromised. And in December, Marriott Hotels reported that half a billion customer records were breached across multiple hotel chains — and revealed the hack began in 2014. So far, there’s no word on the threat vector used.

Also worth mentioning? The massive Equifax breach from last year which exposed the credit information of almost 150 million Americans, supposedly because security patches weren’t properly applied.

Even a cursory glance at the data makes it clear: Big companies are getting hit by bigger and bigger breaches — and in many cases hackers don’t even have to try that hard. What’s the disconnect?

Common Sources

Why are hackers enjoying so much success while IT teams struggle to keep up? Increasing malware availability is one concern: As noted by IT Pro Portal, 2019 will likely see an increase of “malware-as-a-service” — tools and kits that low-skilled attackers can buy on the Dark Web and come complete with customer service emails and ongoing support.

But here’s the hard truth: Despite increasing hacker savvy and growing malware markets, cybercriminal success stems in large part from in-house IT sources, including:

• People Problems — As noted by the Information Age piece, the vast majority of breach reports point to human error, not malicious action. Top concerns include emails sent to the wrong recipients and physical data misplaced by employees.Staff also struggle to identify and avoid phishing attacks: 76 percent of organizations say they were targeted by malicious email scams last year.
• Patch Pressures — Without regular patching, systems and networks are left vulnerable. That’s what happened to Equifax: The necessary update for Apache Struts to combat CVE-2017-5638 was never installed, allowing hackers to access corporate systems. While the company’s former CEO blames an unidentified IT staff member for failing to download and apply the patch, there’s a bigger problem here: Poor patch management frameworks that let hackers slip through.
• Timid Testing — Hackers look for any vulnerability they can use to compromise your network. This includes less common weaknesses that may allow lateral access to peripheral services but offer a potential pathway to more critical applications. Here, the biggest problem facing organizations is timid testing — companies may simply test for the vulnerabilities they expect to see, get the all clear and assumer hackers will never think outside the box. Or, they may skip testing altogether under the assumption that up-to-date security tools will protect key assets. 
• Application Avenues — Applications are eating the world. They’re also providing a veritable buffet for attackers; if malicious actors can insert commands during application runtime, reverse engineer code or hijack application sessions, they can quickly (and often silently) infiltrate corporate networks.
• Variable Visibility — While Marriott can now identify which records were breached and what type of data was compromised, Bloomberg notes that there’s still “no information about the cause of this incident”. This is a common concern for companies: Visibility into the aftermath of data breaches but no insight about the cause.

Leveling the Field

While the nature of attackers means they’re always pushing the bounds of IT security measures, it’s possible for businesses to level the playing field and deny hackers another win.

Best bet? Start with regular penetration tests carried out by reputable third-party providers. This circumvents the unconscious bias of in-house testers who often avoid out-of-the-box attacks in favor of more traditional methods — which typically report secure systems. Next, enable or deploy automatic patch policies to ensure the latest application and OS updates are applied to critical systems. While there’s potential here for lost productivity if patching doesn’t schedule properly or encounters unexpected conflicts, it’s better than the Equifax alternative.

Last but not least? Protect your mobile apps. Protect your client and server applications. Between these and now IoT apps hackers have plenty to choose from: Just one reverse-engineered app or privilege escalation could lead to a full-on network breach. Ideally? Implement the app hardening trifecta: Code obfuscation to protect IP and mask potential vulnerabilities, encryption to hide valuable data, and runtime application self-protection to detect and reject tools and techniques hackers use such as debuggers, emulators, code injection, etc.

Hackers are winning the data breach battle — but the war isn’t over. Know their methods, understand common risks and implement straightforward strategies to take the tactical advantage.