C-Level view - Global Application and Network Security Report

Radware's report:

• C-suit cybersecurity awareness is up with 95% expressing important priority and 82% stating on CEO concern
• With uncertainty, spending is up. Maybe (in)directly related by numbers show 2/3 of executives reported 10%-59% increase in cybersecurity spend last year (72% bought into cyber insurance and 42% implemented stricter security policies for telecommuting).
• C-level may not be engaged in every breach (ransomware up from 16 to 25% in a year) visitbity is up with 54% admitted to paying ransom averaging $7500 in the US and 22K Euro.
• Jobs for ex-hackers are on the rise with 23% of respondents leverage their skills and another 36% would do the same.  In addition, automated model and alerting has spiked to 40% over the last couple years and continues to grow.
• Of course IoT and network infrastructure is a top concern with device takeovers and bots prevalent on a wide scale.  That said, security wearables policy have been in effect for about 2 years for almost half the respondents.
• Over the last 2 year 44% have include suppliers and partners into the security process and another 33% will do so in the 2 years though 22% have not addressed. 
• Greater emphasis are place in inbound/outbound packet inspection which is counterbalanced with increased SSL/encryption.
• Impact of Security Threats on Business for Brand Reputation Loss averages 34% for US and UK and Operational Loss 31%, and Revenue Loss at 30%
• Importance of thwarting security threats total 35% being changes to technology, followed by changes C-Level awareness at 33%, education/knowledge 32% and change in process at 28%

Refer to source for full details
https://www.radware.com/newsevents/pressreleases/execs-wont-pay-ransom-attacks-til-hacked/

40% spike in U.S. #DataBreach in 2016

1,093 from 780 from prior year with business sector topping the charts at 45.2% overall, followed by healthcare/medial industry with 34.5%.  And 55.5% (up from 17.7%) were related to hacking/skimming/phishing attacks.  Predominate were DEO spear phishing with related events to ransomware and SSN exposures.  Of course, the notification requirements may have trigger some but taking threshold for notification comes to balance out.
<source helpnetsecurity.com>

Top 2016 security breaches

2016 cybersecurity root cause:

·         #IAM - Unauthorized access to laptop

·         #DDoS likely

·         Still to be determined - Weebly

·         #SDLC - malicious code

·         #ThirdParty possibly

·         #VTM - vulnerability in portal

·         #PhysicalTheft

·         Just bad #securityPractices |

·         #Encryption

·         #DLP email and inadvertent leak

 

http://www.readitquik.com/articles/networking-2/data-breaches-that-shook-2016/

1.       HPE Navy Breach: In October, a grave access issue came to light, as the Navy identified that an HPE laptop had been accessed by "unknown individuals"... 

2.       Patient data gets exposed: 21st Century Oncology: Cancer care provider, 21st Century Oncology was hit by a cyber-attack that exposed its patient information to the order of 2.2 million patients globally... 

3.       Website builder Weebly is attacked: The web hosting and website building site was hit by a hack in October. It affected more than 43.5 million accounts including user names, passwords… 

4.       Oracle – Micros credit card systems hacked: One of the biggest data breaches was revealed in August, when Oracle-Micros data systems underwent a data breach, allegedly by a well-known Russian organized cybercrime group...

5.       State Fishing and Hunting Licence sites: The wildlife sports sites of four states, namely Washington, Kentucky, Oregon and Idaho were hacked in August. Hackers got unauthorized access to the personal information of 6 million users, including their Social Security numbers..

6.       Verizon enterprises systems: Verizon became sitting duck, as a hacking group broke into its enterprise network and dug into customer data of about 1.5 million... 

7.       US Dept. of Health and Human Services: This was a physical theft, with a laptop and some portable hard drives being stolen from the public entity... 

8.       Myspace breach: 360 million accounts were illegally accessed, primarily those accounts which were created before June 11, 2013. The breach was a result of not so great security measures...

9.       Yahoo: Yahoo was the scapegoat of two horrendous hacks- one that started in 2014, and involved more than 500 million users; and the other in December, that led to more than 1 billion user accounts being hacked  somewhere in August 2013... 

10.   Democratic National Committee: This was the biggest of the big, with direct repercussions on the US Presidential Elections. Numerous leaked emails from the DNC found their way to public forum, WikiLeaks...