Companies always need to be on the lookout for cyber attacks — regardless of their size and industry. But what are the most dangerous types of cyber attacks? And based on your industry, what is the most common type of cyber attack? Read on to learn more about what you should be most worried about, why, and how to mitigate all risks facing your company.
What is the Most Dangerous Cyber Attack to My Business?
This article will break down risks facing the following industries, ranked by the number of incidents experienced in 2020, according to Verizon’s 2020 Data Breach Investigations Report (DBIR):
- The most targeted industries, including Professional, Scientific, and Technical Services, Public Administration (government contractors), and Information Technology
- The second tier of most targeted industries, including Financial Institutions, Manufacturing Plants and related businesses, and Healthcare Providers and their business associates
The same risks facing your company are unique to your particular needs, means, and business environment. Understanding what your industry competitors are facing is the best indicator of what threats you are likely to navigate.
Threats Facing Three Most Attacked Industries
Each year, Verizon publishes a comprehensive study of cybersecurity incidents and breaches, indexed by various factors: attack type, motivation, and most importantly, industry. In 2020, the executive summary highlighted a total of 32,002 incidents. However, just 3,950 of these were confirmed to be data breaches. Nevertheless, all incidents are still indicators of risk.
There was a clearly defined tier of industries with far more measured events than all others in 2020 (several thousand per industry). The following subsections break down the number of security events and attacks in these industries, including which kinds were most common.
We’ll also provide insights and resources for preventing the most significant risks in each industry.
Schedule a Free Consultation!
Cyber Attacks and Risks in Professional Services
The industry known as Professional, Scientific, and Technical Services saw the most security incidents in 2020, according to the DBIR. This industry includes a wide variety of professions, most of which offer services directly to customers — attorneys, accountants, architects, etc.
A total of 7,463 incidents were measured, of which just 326 were confirmed to be actual data breaches. Insights across Verizon’s survey of the industry include the following:
- Most attacks came from web applications and miscellaneous errors (~79%).
- Among the errors, misconfiguration and misdelivery were especially prevalent.
Training and awareness are essential for businesses in this sector to keep all personnel actively involved in prevention rather than passive vectors for attack.
Also Read: Cybercrimes to Watch for in 2021
Public Administration Cybersecurity Threats
Like Professional Services, Public Administration is an umbrella category, including a wide variety of government agencies and contractors in public-private partnerships. Similar to Professional Services, Public Administration saw a high number of incidents (6,843; second highest) with a relatively low number of corresponding breaches (346). One final similarity: Public Administration was also victim to a large number of error-related incidents.
Ransomware is uniquely potent as an attack vector in Public Administration. It accounted for 61% of all malware, albeit seldom leading to an actual breach. For this reason, a cyberdefense plan for this sector must include a robust firewall, ideally with proactive web filtering integrated.
Cyberthreats Facing Information Technology (IT)
Rounding out the trio of industries with the most incidents, per DBIR 2020, is Information Technology (IT). This category includes everything from technology and software-as-a-service (SaaS) startups to multinational data and broadband providers.
The IT industry saw 5,741 incidents in 2020; 360 were confirmed data breaches. Across them:
- Credentials were among the most commonly compromised forms of data (~41%).
- Denial of service (DoS) attacks were more common than in most other industries.
Given the complexity and difficulty of identifying and mitigating DoS and DDoS attacks, internal and external Managed Detection and Response programs are one solution to this risk factor.
Risks of Other Commonly Attacked Industries
Outside of the most attacked industries, a second-tier saw fewer overall incidents (incidents were measured in the hundreds). These industries tended to see a higher percentage of their incidents confirmed as data breaches. In this way, they may be considered more at risk.
The following subsections break down what to look for in the industries Verizon identifies as somewhat likely to have events but very likely for those events to be emergencies.
We’ll also note some valuable resources for preventing these attacks.
Finance, Banking, and Insurance Industry Threats
The category for Financial and Insurance companies saw 1,509 incidents. Of these, 448 were confirmed to be data breaches. Insights across them unveil the following patterns:
- Stolen credentials via phishing (>80%), including “pretexting,” is a significant vector.
- Attacks related to misuse errors were down to 8% in 2020 from ~21% in 2019.
These data suggest that a robust identity and access management program would be an ideal safeguard for your financial sector company to control gaps that occur even without misuse. In addition, FINRA compliance services can help to ensure all required controls are in place.
Cyber Vulnerabilities Within Manufacturing
The Manufacturing industry leverages several “off the grid” technologies, depending less on “smart” machines and internet of things (IoT) networks — especially when compared with the other industries listed here. Nonetheless, it was targeted frequently by cybercriminals in 2020. Namely, it saw 922 incidents and 381 breaches.
Some unique facts about the cybersecurity risks facing this industry include the following:
- Over 50% of attackers had ties to organized crime, and nearly 40% to nation-states.
- Related to the latter, ~28% of breaches were motivated by espionage.
These spy-related attacks tend to be among the most advanced and challenging to navigate of all attacks faced by any industry. To counteract them, commensurate vulnerability management, including internal and external penetration testing and root cause analysis, may be necessary.
Cybercriminals’ Impact on Healthcare Services
The Healthcare sector is one of the most interesting cases of all the industries surveyed in the DBIR. It comprises hospitals and all businesses defined as “covered entities” and their business associates by the Health Insurance Portability and Accessibility Act (HIPAA).
The industry as a whole saw the fewest incidents of any listed here (798). However, of those incidents, 521 were confirmed to be actual data breaches. For reference, this is about 200 more than Professional Services, which saw just 326 breaches out of over 7,000 security incidents. In practice, this means that every incident needs to be taken very seriously.
As with the Finance industry, compliance is critical in this sector. Following the Privacy and Security rules of HIPAA is much easier with dedicated HIPAA advisory services.
Protect Against All Threats of Cybercrime
What is the most dangerous cyber attack? It depends primarily on what type is most common to your industry. In the sections above, we detailed the specific kinds of attacks your company can expect to face. We also noted a handful of security practices that are essential if you encounter those particular risks. But is it better to be protected against only one set of possible risk vectors or all types of cyber-attacks? At RSI Security, we understand a holistic approach is ideal. To see how streamlined and powerful your cyberdefenses can be, contact us today!
Download Our Cybersecurity Checklist
Prevent costly and reputation damaging breaches by implementing cybersecurity best practices. Get started with our checklist today. Upon filling out this brief form you will receive the checklist via email.