DFIR_Gecko

DFIR, data breach, Research Gecko. Co-author, @VZDBIR; Curator, @VERISDB. Author Computer Forensics & Digital Investigation with EnCase Forensic v7. My opinions

[Ryan K. Louie, MD, PhD @ryanlouie]

#DBIR! 74% of all breaches include the human element. Social engineering incidents have increased, mainly due to pretexting. Healthcare is highly targeted by ransomware. @alexcpsec @idavehy @SuzanneWidup @langloisSec @gdbassett @VZDBIR @VerizonBusiness https://t.co/Zm8lVOEaGf

[Alex Pinto @alexcpsec]

Well, we did it again! The great @VZDBIR team (@idavehy, @SuzanneWidup, @langloisSec and yours truly) has braved the threat landscape wilderness and tamed the data beast to the best possible demeanor we could. It is now live at https://t.co/S4pbrvnl6k

[ARCHIVED: Jen Easterly @CISAJen]

Check it out! @Verizon’s Data Breach Investigations Report helps defenders better understand how attackers operate & how we can use data to raise threat actor costs. As always, #DBIR is chalk full of good info, but one stat stands out. A brief thread🧵

[Pokémon GO @PokemonGoApp]

What’s in the box? 👀

You can RT and find out!

Roaming Form Gimmighoul can now be caught in #PokemonGO! We’re celebrating by giving away Gimmighoul-themed prizes!🥳🎉

To claim:

Follow us on Twitter
RT this post with #GOGimmighoul

You’ll get a code to redeem. Let’s GO!

[DFIR_Gecko @SuzanneWidup]

@MrMeritology @BSidesLV Ping me when you get back. I’m not in Vegas this week.

[DFIR_Gecko @SuzanneWidup]

@wadebaker I’m glad you didn’t squish him too. He’s so cute!!

[DFIR_Gecko @SuzanneWidup]

@indi303 @RSAConference Same.

[Rick Holland @rickhholland]

New @digitalshadows #ShadowTalk out w @DCSecuritydk "David Thejl-Clayton Talks Rolling Your Own Verizon #DBIR." We dig into this year's rpt & David releases a template to roll your own cc: @VZDBIR @idavehy @gdbassett @pinto @SuzanneWidup @philpraxis https://t.co/neRhzxWMZI

[The Javvad Malik A.I. @J4vv4D]

Everyone reading the #VDBIR be like https://t.co/z2myqnm9oD

Am i right @gdbassett ? BTW well done to you and the whole team on another great publication.

[DFIR_Gecko @SuzanneWidup]

Two more exciting webinars for @VZDBIR launch day. We have a CISO panel and our Behind the Science (a bit of history of the #DBIR with current and past authors) register at https://t.co/DyOt02CyAs

[Rick Holland @rickhholland]

Ok, this ends my 1st pass at analyzing the @VZDBIR. More to follow for sure. I obviously recommend you read the report, use the Industry section, and map against @CISecurity controls. Thanks again to @alexcpsec @gdbassett @idavehy @SuzanneWidup @langloissec for another great year

[Rick Holland @rickhholland]

One of the other email trends from the #DBIR is the increase in email server targeting. It went up from 3% to 30% from the last report. In March of 2021, Hafnium was very active with zero-day exploits of MS Exchange servers. Those attacks seems like ages ago.

[Rick Holland @rickhholland]

The fact that phishing is still a thing is an indictment on the sec industry. 15 years into #DBIR this still works. "As u can see in Figure 49 the Social Engineering pattern is dominated by Phishing. & we know what you’re going to say: “I’m so surprised! Fetch my fainting couch"

[Rick Holland @rickhholland]

Proponents of "killing the password" will find much evidence to support their cause. Stolen credentials are highly featured throughout the #DBIR and are the "top action variety." If not passwordless, then certainly MFA all the things, now, seriously MFA all the things.

[Rick Holland @rickhholland]

Unless it is specific to your threat model, your time would be better spent prioritizing 3rd party risk management over insider risk management. E.g.: PolarShins and the like. #DBIR

[Rick Holland @rickhholland]

In bad news for insider threat vendors, insider threats continue to NOT feature significantly in the #DBIR dataset. "We can confidently state that External actors are consistently more common than Internal, with 80% of breaches being caused by those external"

[Rick Holland @rickhholland]

Don't be the "get off my lawn" anti security awareness training guy. It is one of many tools in your arsenal, why not use it. #DBIR

[Rick Holland @rickhholland]

Is security awareness going to stop all the attacks? Of course not, but even a modest improvement can reduce defenders' detection and response burden elsewhere. The #DBIR has a nice section on changing behavior which is applicable here.

[Rick Holland @rickhholland]

Don't discount security awareness training either; it can be engaging and improve your security posture. @knowbe4's "Inside Man" series is a great example of training done right. #DBIR https://t.co/2Ox3rHFu37

[Rick Holland @rickhholland]

At a macro level, it isn't the employees who are failing but rather the controls we have put in place to protect them. "User" has such a negative connotation as well. Don't victim blame! Instead of assigning blame, develop solutions. #DBIR