What a Year! - Insights and Forecasts from the 2021 DBIR

### Overview In this presentation, Alex Pinto, the team lead for the Verizon Data Breach Investigations Report (DBIR), shares insights, data patterns, and strategic guidance based on the 2021 DBIR. Analyzing more than 5,000 breaches and nearly 80,000 incidents collected across various partners, the talk focuses on high-level threat landscape trends, particularly attacks driven by external actors pursuing financial gain. Pinto examines how attacker behavior optimizes for return on investment (ROI) through both incremental improvements to known methods and adoption of scalable monetization tactics like ransomware.

### Key Topics - **Attacker Motivation and Efficiency**: The vast majority of analyzed breaches are committed by external actors seeking financial gain. Attackers systematically seek the shortest path to profit, heavily favoring short attacks requiring fewer steps to minimize visibility and reduce the opportunity for defender detection. - **Top Threat Patterns and Incident Drivers**: Phishing, credential abuse (use of stolen credentials), and ransomware emerged as the top causes of breaches. While basic web application attacks and social engineering dominate, organizational errors account for nearly as many breaches as complex system intrusions. - **The Impact of 2020 and COVID-19**: Phishing saw an 11% increase, appearing in over a third of breaches, with 85% involving a human element. Rather than novel attack infrastructure, this rise was an incremental optimization capitalizing on cognitive overload and topical lures. - **Saturation of Credential Abuse**: 61% of all breaches involved credential abuse, driven by credential stuffing, brute force, and reuse across web applications and cloud email. Attempt volume is massive, with 95% of organizations experiencing between 600 and 3.3 billion malicious login attempts per year. - **Monetization Shifts: Ransomware and Business Email Compromise (BEC)**: Ransomware and BEC both reached roughly 10% of incidents due to straightforward monetization. Attackers shifted away from harvesting payment data toward availability attacks (data obscuration and encryption) that automate financial extortion without needing to identify or resell specific data assets.

### Technical Details - **VERIS Framework and Breach Categorization**: Verizon categorizes incidents and breach data using the VERIS (Vocabulary for Event Recording and Incident Sharing) standard. - **Data Skew and Gini Coefficient**: Attack distributions show extreme concentration, with calculated Gini coefficients ranging between 0.74 and 0.85 across breach action varieties. Overall, the top 3% of threat varieties account for 87% of all breaches. - **FBI IC3 Loss Comparisons**: Losses at the 95th percentile demonstrate comparable financial outcomes across attack classes: traditional computer data breaches (~$1.5 million), business email compromise (~$1 million), and ransomware (~$1.1 million).

### Takeaways - **Differentiated Defensive Strategy**: Organizations cannot engineer tailored controls for every possible threat variety. Instead, teams should engineer controls specifically for high-probability, high-volume threats relevant to their industry (phishing, credentials, ransomware) while relying on agile, versatile incident response operations to handle the long tail of outlier attacks. - **Prioritized Control Implementation**: Core recommendations include enforcing protections against credential abuse (mitigating credential stuffing and reuse), deploying secure configurations across enterprise software and assets to thwart malware and prevent misconfigurations/errors, and conducting continuous security awareness and skills training.