At the beginning of each year, I like to take some time to reflect on the past year and plan for the coming year. I typically read, or re-read, various breach reports to remind myself of what to prepare for in the coming year.
In this video, I discuss a few points from the 2023 Verizon Data Breach Report.
✅ 74% of breaches involved a human element, including stolen credentials or social engineering.
✅ 49% of breaches involved credentials.
✅ 24% of breaches were related to ransomware.
What can your institution do to stay ahead of the bad guys?
🏋♂️ Perform information security training and social engineering testing.
📋 Get a password manager!
🛠 Check out the Ransomware Self Assessment tool.
🛡 Consider data protection tools such as a data discovery and classification tool and identity and access management system.
If you have any questions about this report or how you can properly protect your institution, please reach out.
#banking#creditunions#cybersecurity#technology#security#CIO#CTO#CISOProvision IAM
Hello everyone, my name is Matt Groudon with provision IM. Now this time of year, the beginning of the year, I always like to take some time to read or maybe reread some data breach reports that have been posted over the last year. Specifically, I really like the Verizon data breach report. The 2023 version was released I think in the summer time frame, but still a great report. A highly recommend reading that report every year to any security professional and also briefing your board on the data. So I want to talk about a few data points in the report specifically around. Financial institutions in ways that you can protect yourself. So 1st 74% of the breaches in this report involved the human element that included stolen credentials or social engineering. In fact, 49% of the breaches involved credentials. And as was reported by the IC3 organization, business e-mail compromise is still a really big deal. And according to this Verizon report, more than 50% of the social engineering incidents were, in essence, Business e-mail compromise attacks. So what about ransomware? I know you're thinking that, well, for the second year in a row, it stayed steady at 24% of the breaches. So ransomware is still really a large threat that you have to think about and mitigate against. OK, So what can your institution do to stay ahead of those bad guys? Well, first, I highly recommend having a platform for information security training and also social engineering testing. Now I really like the Nobel Award platform. That's just my personal opinion, has a lot of really good training built into it, but there's. Actual engineering testing platform is really really spectacular and just a piece of advice on using social engineering training. A lot of times you wanna shoot for near zero response rate. That's not really the world that we live in anymore. It might sound good to go to management and say, hey look, we had near 0 people clicking in this test or we're trending down. But the sophistication of the bad actors, AI, generative AI, they're very, very sophisticated social engineering attacks. So you want to start thinking about testing differently and really have really more challenging social engineering tests that really reflect the real world. Situations that your employees are going to be in. So that's saying the purposely try to trick them and have 20% reporting necessarily. But you certainly don't want to shoot for near 0 either. Secondly, get a password manager. You know, ideally every time that you log into a website or an application, that is a different credential, meaning a different password. But let's be honest, not many people were doing that. What are the password manager? And makes that really, really easy to accomplish. You can randomize your passwords, You can have them super long. Whatever the complexity rules are, it's going to manage all that for you because in the event of stolen credentials, which is going to happen to you, then you can easily change that password #1. More importantly #2, if you have a password manager and you're using a separate password for every site, that means when whatever the site was that got compromised, you're not reusing that credentials to, say, your bank. That's the risk there and reusing credentials. Thirdly, for ransomware, check out that ransomware self-assessment tool. You know, I spoke about that a few times recently on this platform. It really is a great guide to help you understand the controls that you need to put in your institution, the type of testing that you need to do to really mitigate ransomware and be prepared. In case you are a victim of ransomware and lastly consider data protection tools and also and Identity and Access Management system, having inventory of your both your data and of your accounts will enable your organization to properly safeguard those crown jewels by limiting who has access to what and enforcing that concept of least privilege. So do you have any questions about the report or how you can properly protect your institution? Just let me know.
What is Identity and Access Management (IAM)? Over the next few weeks, we will be taking a deeper look into how #IAM can work for your organization and the benefits of implementation. This week we will be laying the foundation for the series by defining Identity and Access Management.
In today’s fast-evolving digital landscape, community banks and credit unions face unprecedented challenges and opportunities. Security, efficiency, and compliance are more critical than ever. Our latest blog covers the future of Identity and Access Management (IAM) and how it will impact the way you operate.
Provision IAM is excited to be a sponsor for BaseCAMP this year. This is an excellent event for those new to identity and access management in the higher ed or research community. We hope to see you there!
Attending #FISEmerald this year? We'll be there — visit us at booth 73 in the solutions expo. To set up a meeting with one of our solution experts, contact [email protected].
Come say hello to the Provision IAM team April 15-18 at the NACUSO Network Conference in Orlando, FL! Please feel free to reach out to Bobbie Cooper or Rich Cohen if you'd like to connect during the conference.
Very valuable insights, Matt. Thanks for sharing!