Six Common Causes of Data Breaches

Common Causes of Data Breaches

Cause 1. Insider Threats Due to Misuse of Privileged Access

None of us want to believe that our trusted employees could stab us in the back, but the simple fact of the matter is that insiders are the most common cause of data breaches. Insider threats take a number of different forms, from the negligent employee through to the malicious disgruntled employee, but the consequences of a data breach can be devastating. Insiders may already have legitimate access to your most sensitive data, making it that much harder to spot threats.

Insiders can be a threat to your security in a number of ways, including through simple human error. To err is human, and nowhere is this truer than in cybersecurity. All too often, humans send confidential information to the wrong people or fall for phishing scams. All we can do to combat this kind of insider threat is educate our employees. A more malicious insider threat may take the form of a privileged user abusing their access rights by copying files that contain credit card information in order to sell that data for personal profit.

If you want to mitigate the risks of insider threats, it’s best to limit access to your sensitive data only those accounts that need access to it to perform their business functions – your privileged accounts. This practice is known as zero trust or the principle of least privilege. Once you have no more than a handful of those privileged accounts, you need to make sure you monitor them far more closely and are able to spot anomalous user behavior. Many insider threat detection and prevention tools will help you automate this so that you can detect and react quicker.

Cause 2. Weak and Stolen Passwords

This may also fall under insider threats but demands its own point on the list. If you do not have stringent password policies that demand complex and regularly rotated passwords, then you leave yourself open to external attacks. Opportunists are taking advantage of weak or easy-to-guess passwords or stealing passwords that are stored in obvious physical or virtual locations.

Make sure your users are using complex passwords unrelated to themselves and that they are changing this password at regular intervals. This will mean that if an attacker does manage to get hold of a password, then they cannot stay inside the system for a prolonged period of time. You should also make sure that your users are not storing their passwords anywhere where they can be stolen. Special attention should be placed on privileged accounts, as these should have the most stringent password policies applied to them.

Cause 3. Unpatched Applications

Any piece of software likely has vulnerabilities that can be exploited by attackers. When vendors release updated versions of software, the latest version usually contains patches to help plug up these vulnerabilities. Problems arise when users delay updates or ignore updates altogether. If you do not update your systems and applications the moment the latest patches are released, you leave yourself open to attackers who have identified the vulnerability.

It’s a good idea to go through your applications and determine when they were last updated, to make sure you plug gaps in your security as soon as possible.

Cause 4. Malware

Malware is malicious software that attackers attempt to implement on the target system, usually through vulnerabilities in unpatched applications, as mentioned above. It’s incredibly simple for an attacker to get their hands on a piece of malware. Some malware will track your typing to skim passwords and sensitive details, others will lock down systems and demand ransoms to unlock them. Malware can be implemented in a number of ways, but the most common is through phishing attacks; blanket targeting of users by email with malicious links or attachments.

The way to detect and prevent malware is to educate your users on how to spot phishing attacks or dodgy websites and monitor whenever suspicious changes take place to your systems, permissions and data.

Cause 5. Social Engineering

Social engineering is when external attackers are able to leverage credentials to the environment by convincing users to hand them over. They can do this in a number of ways but the most common is, again, through phishing attacks.

The only effective way to detect and prevent social engineering is by educating your users on what social engineering is, what attacks look like and what the appropriate reaction to an attack would be.

Cause 6. Physical Attacks

Although it is far less common than an insider threat or malware, physical breaches can still cause major damage. Whether it is an insider taking a look through a file cabinet they shouldn’t be or a smooth-talking outsider working his way into your server room, you should always be on the lookout for suspicious activity and report it to the relevant staff members.

Physical theft of devices that contain sensitive information, including laptops, mobiles, hard drives, and USB drives, can also severely damage your security posture. With Bring Your Own Device becoming a more popular working practice, employees are regularly connecting to the company network and accessing sensitive data through potentially unsecure devices. If one of these devices is stolen and the user does not have two step verification to unlock it, as perhaps your Active Directory does, it’s an easier route into your data than going through your infrastructure. As these types of threats are often opportunistic in nature, they can be difficult to mitigate. Often, the best thing to do is to prevent data storing devices from being used in the office.