2023年度数据泄露调查报告（英）-91页_9mb

DBIR 2023 Data Breach Investigations Report Summary

Main Executive Summary

The report highlights the increasing dominance of external threat actors, with 83% of breaches originating from outside the organization. Ransomware remains one of the top attack types, present in 24% of breaches, while BEC attacks nearly doubled, accounting for over 50% of social engineering incidents.

Key findings include:

1. Threat Actors:
   • External actors (e.g., organized crime) are the primary threat category.
   • Financial motivation drives 95% of breaches.
2. Attack Methods:
   • Malware and stolen credentials/access are leading entry points.
   • Ransomware is pervasive across all industries, encrypting data and exfiltrating information.
3. Vulnerability Exploitation:
   • The Log4j vulnerability (CVE-2021-44228) was widely exploited in unpatched systems.
   • Zero-day vulnerabilities continue to emerge, requiring rapid patching.
4. Industry Trends:
   • Finance, Healthcare, and Retail are frequently targeted for sensitive data like credentials and personal information.
   • Ransomware poses a significant threat in all sectors, but Small and Medium Businesses (SMBs) are particularly vulnerable due to limited resources for protection.
5. Recommendations:
   • Emphasize multifactor authentication (MFA) to mitigate credential theft.
   • Improve patch management processes to address known vulnerabilities like Log4j.
   • Strengthen incident response capabilities, especially for ransomware and phishing attacks.

Incident Classification Patterns

• Social Engineering: Dominated by BEC attacks, which nearly doubled from the previous year.
• System Intrusion: Includes Ransomware, with attackers leveraging multifaceted techniques like malware deployment and lateral movement.
• Basic Web Application Attacks: Remains prevalent due to weak credential management and unpatched web servers.

Regional Insights

• NA (Northern America) leads globally in breach volume, driven by widespread adoption of digital services.
• EMEA and APAC show increasing sophistication in espionage and financially motivated attacks.
• LAC (Latin America and the Caribbean) faces resource constraints and underreported incidents.

Bias Mitigation

• Report rigorously defines population boundaries, sample variation, and method conditions to address inherent reporting biases.

Conclusion

The report underscores that human error and malware exploitation remain the most alarming threats. Proactive investment in security controls (e.g., MFA, vulnerability management) and incident response planning is critical to mitigate evolving cyber risks.