Connect with us

Security

Data Leaks Surge 1,453% in 5 Years to 36bn Cases in 2020 Alone

Published

on

Data Leaks Surge 1453% in 5 Years to 36bn Cases in 2020 Alone, SiliconNigeria

With a global pandemic, devastating wildfires, racial tension, and political divide, it is not surprising that 2020 was named the most challenging year in the past decades. The year has been grim for data privacy as well, with leaked personal data records reaching numbers the world has never seen before.

Atlas VPN analysis based on Risk Based Security data reveals that exposed data hit a record 36.1 billion in the first three quarters of 2020. The number of data records leaked this year is more than two times higher than in the entire year of 2019 and make up more than half (51%) of all exposed data in the past five years.

The first three quarters of 2020 saw a 332% increase in leaked data records compared to the same period last year when 8.35 billion records were exposed. Looking at the historical data, leaked data records surged by a whopping 1,453% from 2.33 billion through Q3 in 2016 to 36.1 billion in 2020.

A number of leaked data records already hit an all-time high in the second quarter of this year. However, the three months of Q3 brought in additional 8.43 billion records to the toll.

Let’s look at the data leak numbers quarter by quarter. From Q4 of 2019 to Q1 of 2020, leaked data numbers rose by 24%, from 6.84 billion to 8.45 billion — the most records exposed in any Q1 period over the past five years.

In Q2, the numbers of data leaked increased again, spiking by 128% to a historical high of 19.23 billion. Finally, in Q3, the number of exposed data records dropped by 56% to 8.43 billion. Nevertheless, the number is still higher than in any Q3 period since 2015.

A record-high number of data leaked this year is a result of 2,953 publicly reported data breaches. However, unlike leaked data records, data breaches dropped by 51% compared to the same period last year when 6,021 violations were reported.

The decrease in the number of breaches is caused by a general slowdown in such event reporting rather than the actual drop in breach activity. The global Covid-19 pandemic and remote work are likely to be one of the primary reasons for such a change in reporting behavior.

We can still expect to see bigger numbers by the end of this year as lagging sources reveal additional information. However, data breach levels are unlikely to reach those of 2019.

Looking at the breach data on a quarterly basis, it is evident that more frequent data breaches do not always result in a more significant amount of records leaked. Yet, breaches are growing in severity, exposing more and more records every year.

The first three months of 2020 had the most data breaches this year (1,337), which caused 8.45 billion leaked records. One breach that happened due to a misconfigured ElasticSearch cluster alone exposed 5.1 billion records. Eleven data breaches each were responsible for leaks of more than 100 million data records.

While Q2 saw the least amount of data breaches (848), these breaches resulted in the most records exposed (19.23 billion). The two largest breaches ever reported surfaced during the second quarter of 2020, accounting for more than 18 billion records put at risk.

Q3 had 768 breaches and 8.43 billion records leaked. Two breaches in the third quarter of 2020 exposed over 1 billion records each, while four breaches exposed over 100 million records per event.

The most commonly exposed data types are names (45%), emails (36%), and passwords (29%) — all the key information needed for accessing someone’s account.

Hacks are the leading cause of data breaches this year, while misconfigured databases and services are the main reason behind a staggering number of records exposed.

Source: ITWeb.co.za

Continue Reading
Advertisement Advertisement
Click to comment

Leave a Reply

Security

Cybersafe Foundation, UK Govt help vulnerable groups, SMEs upskill on cybersecurity

Published

on

Cybersafe Foundation UK Govt help vulnerable groups SMEs upskill on cybersecurity, SiliconNigeria

. Over 10million Nigerians reached via mass cyber hygiene awareness

. Set to continue project in 2021

A leading non-governmental organization in the information security ecosystem in Nigeria, CyberSafe Foundation and its partners – Foreign CommonWealth & Development Office (FCDO), have hit the set targets to equip digitally vulnerable groups and Small & Medium Enterprises (SMEs) with the knowledge and skills required to identify, protect, detect, defend and respond to COVID-19 instigated cyber threats, enabling a safe digital community.

The UK Government, through its Prosperity Fund Digital Access Programme, signed a grant agreement with CyberSafe Foundation to carry out the “Safe Digital Community during COVID-19 Project” as part of UK’s cyber risk mitigation support to Nigeria’s COVID-19 response.

The grant agreement which was signed FCDO and CyberSafe Foundation on the 7th of September 2020, led to equipping digitally vulnerable groups and 1,504 Small and Medium Enterprises (SMEs).

The Safe Digital Community Project directly benefited 1,504 SMEs across 35 States in Nigeria, and upskilled 3,057 employees in cyber safety essentials.

For the digitally vulnerable groups including people with limited digital experience, the project helped raise their awareness in safe cyber hygiene, enhance their online security and enable a safer digital community, reaching over 10 million people.

Speaking on the project, the Executive Director, Cybersafe Foundation, Confidence Staveley,  thanked UKAID and 18 volunteer cyber security expert trainers for aligning with the Foundation to empower the participants, adding that through the ‘No Go Fall Maga’, cyber awareness comedy skits, more than 3.3 million people were educated on vishing, multi-factor authentication and phishing.

She said that beneficiaries cut across computing/technology, real estate, transport & services, oil & gas, retail/manufacturing, fashion, hospitality & leisure, healthcare, charity/NGO, education, consulting, financial services, amongst others.

Also, the partners executed massive work through the radio and did a novel cybersecurity awareness song in collaboration with Cobhams Asuquo which was played 3,973 times on 32 radio stations across Nigeria. In addition, 13 episodes of the “No Go Fall Maga” radio drama series created to drive awareness about cyber hygiene best practices, reached more than 5.2 million radio listeners.

During the project’s duration, an intensive social media mass awareness campaign saw close to 10 million people digesting 20 short cyber hygiene videos developed by the team.

Statistics also show that the SME upskilling and upscaling cyber security training garnered a lot of results. With 1,504 SMEs participating, 40.7% of the beneficiaries are female-owned.

Prior to the training, 57% of the beneficiaries could not identify a phishing email. However, post-training review indicates that 83% of them now understand prevalent attack vectors and preventive measures.

Interestingly, 76% have now implemented one or more security controls.  

Staveley who is visibly elated by the growing testimonials from participants, said, “the impact has been massive and we are prepared to sustain the tempo even in 2021. We are going to increase the number of SMEs by 100%; in other words, we are targeting 3,000 SMEs in this rerun and will continue to use social media and radio to drive cybersecurity awareness. We are calling for SMEs to join the new batch for training. They can register via this link http://learn.cybersafefoundation.org/”.

Commenting on the project, the UK Government’s Head of Digital Access Programme and Country Adviser, Idongesit Udoh, said, “The first run of the Safe Digital Community During COVID-19 project recorded enormous impact courtesy of the excellent delivery by Cybersafe Foundation. The project afforded approximately 3057 employees the opportunity to get cybersecurity training, raising the bar in cybersecurity preparedness for Small and Medium Scale Businesses in Nigeria, also impacting millions via social media and radio.””This project demonstrates the UK Government’s continued support for Nigeria and its digital sector, recognizing the tech ecosystem’s role in inclusive growth and development. A rerun of this project will sustain the huge impact recorded by the CSF on cyber awareness and extend cyber capacity building to more SMES across the country during this pandemic where there is increased cyber risk for small businesses”.  

Continue Reading

Security

Obaro Urges Cybersecurity Attention Over Increasing Digital Transformation

Published

on

Obaro Urges Cybersecurity Attention Over Increasing Digital Transformation, SiliconNigeria

The Managing Director of SystemSpecs, leading financial technology and human resources solutions powerhouse, Mr. John Obaro said as the pace of digital transformation ramps up with increased use of data and cloud technology by organisations and governments,  there is need for a renewed focus on cybersecurity to ensure data protection and privacy. He said the increasing spate of cyber-attacks and the role of malicious insiders indicate that traditional approaches to data security are no longer sufficient. Therefore, individuals, organisations and governments must be one or more steps ahead of cyber attackers.

Obaro spoke recently during the second edition of the Art of Technology conference, tagged “Smart Data, Smarter Lagos” which held in Lagos.

Organised by the Lagos state government in conjunction with the private sector, the event facilitated multi-stakeholder discussions, exchanges and collaborations aimed at identifying and leveraging the outcomes of data and its insights to the development of smart cities.

According to Obaro, malicious actors now have access to billions of interconnected devices with ransomware, phishing, data leakage, hacking and insider threat as some of the most common global scourges to the cyberspace.

He listed artificial intelligence and deep learning, behavioural analytics, embedded hardware authentication, blockchain cyber security, and the zero-trust model as some of the various security technologies available to tackle the threats.

“Already, many progressive organisations that are security-conscious are adopting some of these measures to ensure they avert direct and third-party security breaches,” Obaro said.

The technology expert further highlighted data breaches, data loss, access control, denial of service, insecure interfaces and poor API implementations, as some of the security challenges faced by organisations and government today in the use of cloud. He, nevertheless, encouraged the continued use of big data, video analytics and predictive analysis in order to detect and resolve cyber security threats, predict and avoid the possibilities of intrusion and invasion, and take intelligence-based action, amongst other benefits.

John Obaro founded SystemSpecs, one of the oldest technology companies in Nigeria, 29 years ago. Since then, the company has grown into an African giant, expanding internationally and creating customer-centric solutions that include Remita, an innovative payment solution; HumanManager, a human resource and payroll management solution; and Paylink.ng, an ecommerce platform for SMEs.

Other speakers at the Art of Technology conference include Michael Seibel, CEO, Y-Combinator; Ibukun Awosika, Chairman, First Bank of Nigeria; Lisa Da Silva, Principal Investment Officer, IFC; Demola Sogunle, CEO, Stanbic IBTC; and Tomi Davies, Collaborator-in-Chief, TVC Labs.

Continue Reading

Security

Phillips Consulting’s Guide To Avoiding Security Complexities

Published

on

Phillips Consulting's Guide To Avoiding Security Complexities, SiliconNigeria

Many years ago, the firewall was everything. Defence-in depth was a concept defined as layered defence with multiple firewalls on the path. Behind the firewall was a fortress. Organisations designed networks with strong perimeters and demilitarised zones to ensure the crown jewels were well-protected. Attackers had a difficult time trying to break into the firewalls.

On the physical layer, Network Admission Control (NAC) technologies were implemented to prevent intruders from having direct access into the network by preventing them from plugging unauthorised devices into the network. Before a device was admitted, it had to meet a minimum requirement defined by the organisation.

Those years are gone and maybe gone forever. Cloud computing, Bring Your Own Device (BYOD), Artificial Intelligence, Internet of Things (IoT), VPNs and Remote Working Capabilities have dramatically changed the way businesses run. These technologies have introduced a level of innovation and disruption that were unimaginable only a few years ago.

They have resulted in the collapse of the traditional network perimeter, thereby increasing the attack surface for cyber-attacks. Enterprise networks coverage is today being extended beyond our imagination – outside the traditional datacentres to smartphones, cloud platforms, mobile computers and IoT interfaces without geographical boundaries.

 The bad guys now have a plethora of interfaces to launch their attacks on; they do not have to breach the network using traditional social engineering tactics physically. The recent changes in the work environment occasioned by the COVID-19 has further amplified the extension of network boundaries beyond the traditional datacentres.

Employees work from home with devices and connections into the enterprise networks that were not originally designed for such. Improvised connections were made to allow functionality because the pandemic came without an announcement.

The danger this poses is that some of these end devices were not originally designed with security in mind. Even if security was a consideration, not so much for enterprise data protection. These devices are most of the time not hardened, and their owners may not understand the effects on the overall organisational security posture.

 A handful of these devices are installed with default passwords, and most times, these passwords are not changed during or after installation. So it is easy to guess the password by manual methods or using advanced dictionary or brute force attack methods. Another risk posed by these endpoints is the lack of security updates and patches.

 Because they are sometimes not seen to be part of the enterprise network, they are not included in the patch management programme, and their presence introduces high-level vulnerabilities within the enterprise network. It then becomes easier to utilise malware that could tunnel through the firewall to breach the enterprise network, instead of spending months and years trying to break into the firewall or layers of firewalls.

 In recent years, large-scale attacks have been launched using malware by exploiting known vulnerabilities and security gaps on endpoints. For example, the WannaCry, Petya and another variant of Petya, the NotPetya were employed to launch attacks on enterprise networks through vulnerable endpoints. Another danger with this trend is potential data leakage because these devices are used to either temporarily or permanently store organisational data.

There is also concern about device loss. If these devices are lost, there is a risk of exposing the organisation’s data to unauthorised entities, and that could both result in financial and reputational damage. These dangers are also expanded by the impact of the COVID 19 pandemic, where organisations made ad hoc improvisions to support businesses while employees work from home.

As commerce resumes, organisations are beginning to discover some capabilities to support their businesses remotely, and they are also rethinking their business continuity strategies. For some businesses, this is not just a temporal shift, but a change which has permanently altered the operational procedures of the organisation.

Legacy cybersecurity strategies, techniques and investments will not be enough to mitigate the rising cybersecurity concerns introduced by this new way of working. Protection has gone beyond throwing in uncoordinated technical solutions and efforts.

Organisations need to rethink a new approach for the protection of their assets within the ever-growing complexity both to remain afloat and also to derive commensurate Returns On Security Investments (ROSI). A well-crafted strategy will ensure that cybersecurity efforts are coordinated within the enterprise, without duplication of efforts and resources, which will, in turn, drive down the cost of implementing cybersecurity initiatives.

To improve the security posture, organisations must do the following:

1.     Continuously monitor the devices, applications, and processes running on the network.

2.     Automate security monitoring and mitigation.

3.     Implement systems that are capable of automatic detection, isolation and containment of threats within the network.

4.     Ensure that monitoring covers event data, session data, and historical data on endpoint usages, such as past processes, network connections, and other information.

Another measure organisations should take is reducing complexities. The extension of the network boundaries has not stopped organisations from using existing network solutions to protect the enterprise network. However, in a bid to ensure the protection of the on-premise infrastructure and the ones beyond the organisational traditional network boundaries, organisations combine existing technologies with new solutions and the resultant effect is an increase in complexity. To effectively manage security, organisations should put measures in place to ensure a reduction in complexity and enhancing visibility. This can be achieved by unifying all efforts and technologies for managing both on-premise and off-premise infrastructure in a single platform. Beyond technical controls, organisations should develop procedures, standards, and policies for acceptable use of organisational resources.

Continue Reading

Popular News

%d bloggers like this: