Fábricas

This combination of obtain password, infiltrate network, download software and then capture data paints a very clear picture of what’s going on in this vertical, but it may not be a picture you want hanging on your wall if you do business in this area. But while we are on the topic of malware in general, keep in mind that ransomware (while not considered a breach in this report) is still a very present danger for this industry at 23% of all malware found in incidents.

Web Applications attacks took the number-two place this year and are dominated by the Use of the stolen credentials to compromise a variety of web apps used in enterprises. Sometimes these credentials are obtained via malicious links served up in successful phishing attacks, sometimes they are obtained via desktop sharing and sometimes it is unclear how the victim is infected. Regardless of how they are compromised, these credentials, often of the cloud-based email variety, are very successful as a means to an end in this vertical, as you can see in Figure 76. 

There are several patterns that are closely grouped around the third-place position for Manufacturing: Misuse (13%), which by definition involves insiders, and is mostly Privilege abuse—the actor has legitimate access but they use those privileges to do something nefarious—and Data mishandling, of which prime examples are sending company data via personal email or placing it on cloud drives in order to work from home (Figure 77). 

Error is ubiquitous in all of the verticals this year, and in Manufacturing it is in keeping with the trend of Misdelivery and Misconfiguration that we see in other industries. Finally, we would be remiss to not say a word or two regarding cyber-espionage- related attacks.

As a glance at Figures 78 and 79 reveals, 38% of actors were of the Nation-state variety, and 28% of breaches were motivated by Espionage. As we have mentioned in previous reports, it is cheaper and simpler to steal something than to design it yourself. And while large organizations are often willing to outsource their help-desk functions, they are, as a rule, not as eager to ship off their intellectual property and research-and-design generation to foreign locales.