A data breach occurs when a cybercriminal successfully infiltrates the data source and extracts sensitive information.
TechTarget defines a data breach as “an incident in which sensitive, protected, or confidential data has potentially been viewed, stolen, or used by an individual unauthorized to do so”.
Data breaches may involve:
- Payment card information (PCI),
- Personal health information (PHI),
- Personally identifiable information (PII),
- Trade secrets, or intellectual property.
Now that we know what a data breach is let’s dive into its main types.
4 common types of data breaches are:
Ransomware – Once a malicious link is clicked or an infected file opened, the ransomware is able to gain a foothold, quickly infiltrating the network and locking up files. In a matter of seconds, malware executables are released into the victim’s system where they begin to quickly wreak havoc.
Malware – A malware attack is when cybercriminals create malicious software that’s installed on someone else’s device without their knowledge to gain access to personal information or to damage the device, usually for financial gain.
Phishing- Phishing occurs when someone or something mimics a trusted, reputable entity in order to collect sensitive data (often banking or highly personal details). These attacks are not exclusive to the Internet. Common methods for phishing scams can include:
- A pop-up on your browser
- An email with a link
- A person on the phone claiming to be a representative of a reputable company
Denial-of-service (DOS)- This breach essentially takes away access to websites and webpages. When this happens at a large scale, it’s known as a distributed denial-of-service (DDoS). These attacks typically function by overwhelming or flooding a targeted machine with requests until normal traffic is unable to be processed, resulting in denial-of-service to additional users.
Well then, the bigger question here is how can you save your organization from these attacks?
- Know your strengths and weaknesses– Despite your organization’s industry or size, it likely possesses information that is valuable to a hacker. Understand the reputational and financial impacts to your organization if this information were exploited. Ensure the proper controls are in place to secure sensitive data.
- Build security awareness into your organizational culture- Many employees become unknowing contributors when they do something as innocent and simple as click on a link in an email message that appears to come from an internal team member or outside vendor, and thus activate a malware attack. Organizations need to communicate and conduct frequent and recurring educational sessions to alert employees to the various techniques cybercriminals use and build an awareness of these risks into their corporate culture.
- Make cybersecurity assessment a continuous process- Every time a network changes, organizations face the possibility of introducing new risks to their systems. Adding a router, replacing a server, or implementing new software can create vulnerabilities for cybercriminals to exploit. Cybersecurity assessment should be a continuous learning cycle.
- Take control– Implementing the right security controls can help deter hackers and other criminals, but each type of internal control requires its own focus. Preventive controls keep incidents from occurring and deter unauthorized access.
- Turn your vendors into partners- Know the policies and practices of organizations that have access to your corporate or customer data. Responsibility and liability don’t end once the information handoff has occurred. Partner together to protect sensitive information.
Large corporations are not the only targets that cybercriminals have in their sights; unfortunately, mid-size and even smaller entities are increasingly becoming victims of cyberattacks.
“Ensure your organization has the appropriate security controls in place to help protect your valuable corporate and customer data, and mitigate the chance of becoming the next cyberattack headline”.
Shaunak Mody, Co-founder at Tixter cyber solutions.
Follow Trixter on LinkedIn for regular cybersecurity-related updates.
