Just under 1500 incidents have been reported to the Information Commissioner’s Office (ICO) in the period of Q1 for 2020, with around a third classified as “cybersecurity incidents.”
According to 2020-21 statistics released this week, among the 1446 reported incidents, 412 were classified as cybersecurity incidents, and these 185 reports of “phishing.” Fewer than 100 were down to “unauthorized access” (87), ransomware (61) and malware (16). Also there were 266 instances of “data emailed to incorrect recipient,” and 140 incidents of “data posted or faxed to incorrect recipient” among the non- cybersecurity incidents.
Overall, the numbers are improved from the 2019 report, and Rick Goud, CEO and founder of ZIVVER, commented that there was a 50% decline in reported data leaks. “In a period with increased cyber-threats, a big shift to working from home, with more digital communication and more employee behavior change – inevitably leading to more data leaks – this suggests that UK organizations don't see the necessity to comply with GDPR in terms of reporting data leaks, because the consequences of not complying are considered less costly than the alternative,” he said.
However, Martin Jartelius, CSO at Outpost24, argued that things are improving, as “users have never been this aware, firewalls and anti-virus this advanced or security frameworks as widely adopted.”
He also added that attackers have never been this efficient, and more actors are entering the criminal market space. “The reason phishing and ransomware are open and visible is that they, in part, are easy to detect; ransomware is very hard to miss for example, and users report attempted or successful phishing,” he said. “A good old fashioned data breach, such as an employee reading medical records of someone not their patient – often tops those lists in countries with stringent record keeping and audit trails.”
Sam Curry, chief security officer at Cybereason, said the state of overall security is about changes in rates, that the attackers still win too much and enjoy the expectation of victory too much, but the rate of improvement among defenders is growing faster and it’s about speed. “I believe changes in 2020 are going to help reverse the hacker advantage long term, but it’s still a fight and one we shouldn’t let up on,” he said.
Javvad Malik, security awareness advocate at KnowBe4, said it is “natural that some of the trends may have shifted slightly” considering the COVID-19 pandemic, and with many people working remotely, there has been a change in infrastructure, and many organizations have had to move services to the cloud, implement VPNs, MFA and a whole host of other technologies.
He continued: ““The good thing is that many of these security technologies are quite mature and offer good protection. However, email has been the favored attack vector for criminals for some time now, and phishing seems to have only increased since lockdown. Without colleagues to bounce opinions off, and with the many distractions that home working brings, it can be easy for employees to fall for phishing emails.
“Perhaps the biggest issue has been the psychological toll extended home working has taken on employees. Without clear boundaries between home and work life, it can be easy to make mistakes, or errors. So, emailing the wrong people, especially on BYOD laptops or computers which may autofill email addresses , is definitely something that can happen.
“While technology can solve many security issues, it cannot account for all human error. For example, people taking photos of their meetings (thus exposing meeting IDs or other sensitive info) and posting them on social media can also inadvertently leak sensitive information.”