Data Breaches: Two Tales, Two Motives: Financial vs. Espionage

For the 2014-2020 DBIR (Data Breach Investigations Report) timeframe, annually, we see Financial motive underlying breaches between 67% and 86% of the time and Espionage motive as the driver between 10% and 26% of the time. Given their nature (e.g., stealthy tactics, specific targeting), Espionage attacks can be difficult to detect and identify as an actual Espionage-related attack (given scant IoCs and other details). Whereas Financial attacks—if not detected while occurring or soon thereafter—eventually become apparent when money goes missing. At that point, the Financial motive, if not already ascertained, can be determined. When we look at the VERIS (Vocabulary for Event Recording and Incident Sharing) A4 Threat Model—Actors, Actions, Attributes, Assets—we see similarities with and differences between data breaches involving Financial attacks and Espionage attacks. Join this session and discover: · how data breaches with Financial and Espionage motives compare · how data breaches with Financial and Espionage motives differ · what can be done to counter either Financial and Espionage attacks