Data Breaches and what you can do

In the most recent quarter, CERT NZ responded to 2,001 incident reports about individuals and businesses from all over New Zealand.

Internationally well known companies such as Apple, Meta, Twitter, and Samsung have all disclosed cybersecurity attacks this year.

In New Zealand Phishing and credential harvesting remains the most reported incident category (from CertNZ)

This graph shows the breakdown by incident category for the past quarter in New Zealand.

Australian telecoms company Optus – which has 9.7 million subscribers, suffered a “massive” data breach this year. According to reports, names, dates of birth, phone numbers, and email addresses may have been exposed, while a group of customers may have also had their physical addresses and documents like driving licenses and passport numbers accessed.

IBM found the cost of a breach hit a record high this year, at nearly $4.4 million.

So how does a data breach happen?

Data breaches happen mainly when hackers can exploit user behaviour or technology vulnerabilities.

A data breach involves any unauthorized access to confidential, sensitive, or protected information, and it can happen to anyone.

The threat surface continues to grow exponentially. We are increasingly reliant on digital tools such as smartphones and laptops. With the Internet of Things (IoT), we’re adding even more endpoints that unauthorized users can access.

Popular methods for executing malicious data breaches include:

• Phishing – emails in which hackers persuade users to hand over access credentials or the data itself.

• Brute-force attacks – hackers use software and sometimes even hijacked devices to guess password combinations until they get in.

• Malware – infects the operating system, software, or hardware (often without the user knowing) and steals private data.

• Disgruntled employees or political hacktivists can also be behind data breaches. However, more often than you would hope, the breach is due to poor cyber hygiene.

How to reduce risk to your business:

Here are some key tips for mitigating risks to your business. If you require help with these, contact GTB.

• Train your team: The vast majority of breaches occur because someone clicked on something when they shouldn't have! It is very important that you 'own' this in your business/organisation, and remind and support your team to be aware of the constant risk.

• Identify what is exposed to the internet: To help mitigate this risk, it’s important to identify what is being exposed to the internet. GTB can help you do this. You can also use scanning tools like Nmap and Nessus to help assess your situation.

• Only expose what you really need to: Reducing the number of services you use lowers the number of targets that attackers have access to. This is known as reducing your attack surface.

• Segment your network to stop – internet-exposed services from reaching your internal network. If your more vulnerable services get compromised, a segmented network will make it harder for attackers to reach other devices.

• Patch services and devices exposed on the internet. Having the latest version will fix many of the vulnerabilities known to the vendor, and that means attackers have fewer known vulnerabilities they can use to gain access.

• Turn on multi-factor authentication (MFA) to add an extra layer of security and help prevent unauthorized access.

• Use logging and alerting to help monitor devices and services, especially any that may be exposed on the internet. These are potential weak points that attackers may target. This can help notify you of an incident and provide details of what has happened.

Don’t risk data breach damage

Data breaches cause business downtime and can cost your reputation and bottom line. Once you’ve had a data breach and it has been made public, your customers may lose faith in your ability to protect their private information.

Here are some more GTB resources you may find helpful:

Need to know series - The Weakest Link in Data Security

Cyber Security - What you need to know!

A managed services provider can install protection and take precautions against data breaches.  Contact GTB to discuss this further.