The Tech Column: What the DBIR Means for Manufacturers

The second edition of The Tech Column kicks off this morning with a little more coverage of the 10th annual Verizon Data Breaches Investigations Report. The DBIR is one of our favorite reads every year, and this year was no different: when it was released Thursday morning, it included a little more coverage focused on manufacturing in particular than in previous years. We talked with Marc Spitler, one of the report’s co-authors, about how cybersecurity might affect manufacturers and what still be to come in 2017.

IndustryWeek: This report seemed to include more focused coverage and analysis than previous reports, and there were a handful of facts that jumped out from that coverage. One was that manufacturing had more incidents categorized as “Everything Else” than any other industry. There was some explanation that those incidents just couldn’t be classified, that more information was needed. Should this be any cause for concern for manufacturing?

Marc Spitler: No, it’s nothing as exciting as that. (Laughs) Typically, what it is is that we’re just not getting the level of detail from certain sources. Say a data base was hacked, or there was a phishing attack, but the level of detail received isn’t up to the level that allows us to put it into another category. A lot of the “Everything Else” incidents, we knew what happened, we knew the story, but it just didn’t fit into any of these other buckets and we hadn’t seen quite enough of it yet for it to get its own pattern. … We have enough of those little data points where those can go into the corpus, but we don’t know the motivation. Was it part of a cyber-espionage campaign? Was it more opportunistic in nature? We don’t know enough about the payload of the malware received for us to classify it further, and that’s really what those are falling into. It’s not an indictment on the industry itself.

IW: With that in mind, the nine categories you do use are pretty well defined. Is there a possibility next year there are more categories, and some industries are maybe classified a little differently?

MS: We would certainly like to see some other categories or patterns develop as a result of the disruption of the nine we see. Right now, though, we haven’t seen a drastic enough switch in tactics for another one to be created. We certainly are seeing evolution in the patterns. … We’re still seeing a lot of similarities in the way adversaries are going after industries from a remote-attack standpoint — we’re still seeing phishing, getting that malware on there, moving around with credentials.

Most mature companies have done a good job of really limiting what they have open to the Internet. So you can look for remote access ports, you can look for things you might have had success with 15 years ago, but we’ve tightened it down pretty well. One thing everybody has is a web presence, so that will be targeted because it’s available. Phishing is still really used  a lot, because it’s a way for outsiders to have some level of interaction with somebody on the end of the user device on the internal network. It’s not surprising to us that we see emails and web drive-byes as the No. 1 and No. 2 vectors of malware. That’s where things might change based on industry and data type and the threat actors involved. With manufacturing, we’ve found it’s affected primarily be cyber-espionage, and there will be more sophisticated threat actors, potential state affiliation, looking for a particular type of data.

IW: Do you see manufacturing as maybe a little more susceptible in the quarters and years to come, just because there are so many more connected devices on the factory floor and so many more potential points of entry?

MS: We’ll have to see how it plays out. Certainly if the attack surface changes for manufacturers and there are more things to attack, we may see a more opportunistic style of attack. Different sectors and different industries are based on the people that contribute data to us, which is why the public sector has always had a lot of incidents, and we have a disclaimer saying, “We don’t think it’s any worse than anybody else, we just get a lot of data that’s going to make those numbers increase.” In manufacturing, there is a lot of care and a lot of focus on state-affiliated actors, and we’re looking at those kinds of breaches. Manufacturers might not have the reporting requirements around some of those other data types, like employee information or PII, so I’m always hesitant to say any industry is any better or worse than another.

IW: According to the report, 62% of breaches featured hacking, and 81% of those hacking-related breaches leveraged either stolen or weak passwords. How is this still a thing in 2017?

MS: As far as the weak passwords, those are predominantly small and medium businesses, and a lot of those came in the point-of-sale intrusion section, which is what we have seen historically. The stolen passwords are almost as frustrating because we do put a lot of emphasis on things like minimum ages, maximum ages, special characters, complexity. If you have a key piece of sensitive information that you need to protect and you have the ability for people to access it in a remote manner, if you’re only relying on static authentication, you’re behind the times. Keyloggers have been around for some time, they’re specifically designed to capture user input including passwords, so you do need another factor — and one that can’t be captured in the same way as the first factor. You need to at least double the efforts of the adversary.

IW: If we transition from specifics to the proverbial 25,000 feet, 30,000 feet, what else really popped out at you?

MS: We are seeing more ransomware than in previous years. It’s an interesting topic, and it’s an interesting way for the financially-motivated criminal groups to try to earn a buck. There is some targeting, but a lot of it is opportunistic, so regardless of your industry, …it’s something to be cognizant of.

We talk about manufacturing, obviously, quite a bit, and some of the common, scalable, automated attacks have dropped down a little bit, in the form of point-of-sale intrusion. I’ll be interested to see how that turns out. We didn’t have a mega-breach last year, and I’m hoping that’s not just an anomaly. Let’s see what we can do to break up the pattern of phishing, malware, credentials, and disrupt that in the years to come.

IW: Do you see that decrease in big-name and headline hacks decreasing?

MS: Hesitant to say, because the last time we were thinking in that manner was 2011, when we only had 4 million records. We thought then, “Did we just miss everything?” and we started to freak out a little bit, but those mega-breaches just weren’t happening until 2013. We are still seeing some high loss numbers, but they’re going after these websites and portals, not retail, that have a large user base. How those are being monetized and used? We know they have large databases of compromised credentials from all over the internet that they’re trying to re-use. I don’t know if that’s going to bear a lot of fruit, but ransomware certainly short-circuits the typical attack pattern.