Ransomware is considered the top overall threat to businesses’ data, with user credentials and privileged accounts the most common data types involved in significant breaches, according to according to the SANS Institute.
Front-line professionals believe the growing threat of ransomware is the top overall threat to data availability, based on occurrences in the past 12 months.
Insider threats and denial of service are also considered top threats to sensitive data. While the majority of respondents indicated that they escaped actual compromise of sensitive data, enough respondents did lose sensitive data to provide valuable lessons from these events.
>See also: The ransomware business model
Of the respondents, 78% reported two or more threats occurring in the past 12 months; 68% reported the same threat occurring multiple times over that same period.
User credentials and privileged accounts represented the most common data types involved in these breaches, highlighting the fact that access data is prized by attackers.
Access information is most sought after because it grants the attackers the same privilege as their victims. They often use this privilege to escalate and spread their attacks, allowing them to gather more types of sensitive information.
Other key data being targeted in significant breaches includes customer personally identifiable data, selected by 31% of respondents, and employee data and intellectual property, each chosen by 28%.
>See also: Held hostage: the rise of ransomware
“I used to consider data sources such as network and personnel directories as items that need to be protected—although not at the level of ‘sensitive’ data, such as financial and healthcare records,” says Barbara Filkins, SANS Analyst Program Research Director and author of the survey report.
“Maybe access information needs even greater protection, given that this survey showed that user credentials and privileged accounts represented the most common data types involved in breaches.”
Knowing what the attackers are looking for is half the battle. Understanding how data flows through systems, which is done by less than 4% of the survey sample, is an example of a step defenders can use to aid in both detection and remediation of breaches. Yet 62% indicate that identifying all pathways to their sensitive data is a key challenge.
>See also: The real damage of a ransomware attack is felt in the downtime
“When defenders know what attackers want most, they know how to prioritise their efforts,” says Benjamin Wright, an expert on the legal aspects of data protection and advisor on this project. “This survey shows how much attackers covet user credentials and privileged accounts.”
“Drawing data maps and flows may not be perfect, but the process illustrates a key starting point,” continues Filkins. “A picture—or in this case a map—is worth a thousand words in understanding where to start protecting data.”
