Verizon Breach Report: Vulnerability Hacks Tripled in 2023 – Source: www.databreachtoday.com

Governance & Risk Management
,
Video
,
Vulnerability Assessment & Penetration Testing (VA/PT)

Data Breach Report Lead Author Alex Pinto Discusses Top Findings, Best Practices

Anna Delaney (annamadeline) •
May 1, 2024    

Verizon’s 17th annual 2024 Data Breach Investigations Report highlights a troubling trend: The exploitation of vulnerabilities in the wild has tripled, primarily due to ransomware actors targeting zero-day vulnerabilities. The MOVEit vulnerability serves as a poster child for this trend, illustrating how attackers quickly adapt to new opportunities.

See Also: OnDemand Webinar | Third-Party Risk, ChatGPT & Deepfakes: Defending Against Today’s Threats

“It’s concerning that we’re seeing this huge shift … a prelude for even more growth or a change in this power struggle,” said Alex Pinto, associate director at the Verizon Threat Research Advisory Center.

Pinto pointed to a growing disparity between the speed of exploitation and patching. Attacks often occur within five days, he said, while organizations take an average of 55 days to patch 50% of critical vulnerabilities. He stressed the importance of prioritizing vulnerability management, particularly for perimeter and external-facing vulnerabilities, and strengthening security outcomes through vendor management.

In this video interview with Information Security Media Group, Pinto discussed:

• The increase in breaches involving third-party and supply chain vulnerabilities;
• The evolving landscape of ransomware and extortion attacks;
• The importance of security training and awareness programs to address human errors.

Pinto has more than 20 years of experience in building security solutions that focus on the application of data science to cybersecurity. His teams at Verizon are responsible for the Verizon DBIR and support security research and thought leadership in the organization. Pinto joined Verizon in 2018 after it acquired his machine learning-based network detection company, Niddel.