What is the CERT NZ quarterly report?
Each quarter, CERT NZ publishes a report that presents information and statistics on the cyber security incidents that have occurred during that quarter along with the latest cyber security threats in New Zealand.
They recently published their quarterly report for Q3 of 2018 (01 July – 30 September).
What happened in Q3?
Some of the key points contained within the report are:
- Q3 of 2018 saw the largest number of reported incidents per quarter to date. This is more than twice the volume a year ago, with a broad cross section of New Zealanders and organisations being impacted by cyber security issues.
- Reports related to scam and fraud rose by 90% from Q2 and resulted in NZ$2.3 million of loss; this accounted for 22% of the total reported incidents for Q3. The increase was mostly driven by webcam and password extortion scams and a number of smaller campaigns such as invoice scams and Facebook-based scams.
- Incidents involving unauthorised access increased by 28% from Q2 and remains the third highest type of incident. One of the strongest mitigations that CERT NZ recommends is protecting email accounts via the use of two-factor authentication (2FA) and strong passwords.
- Financial loss increased by 35% from Q2, with nearly NZ$3 million of losses reported. The cumulative financial loss for the three quarters of 2018 has reached $8.1 million, which is a 50% increase from the last three quarters of 2017.
- The 65+ age group experienced the highest value of direct financial loss – NZ$930,000 in Q3 compared to NZ$123,000 in Q2.
What is the greatest threat from Q3?
Phishing and credential harvesting remain the most common types of incident, although it has plateaued this quarter.
What is the most common vulnerability?
Out of all the vulnerabilities that can lead to cyber security incidents, vulnerabilities in websites and web servers continue to be the most common. In fact, 85% of vulnerabilities reported in Q3 were in regard to website and servers.
How do incidents vary across sectors?
Sixty-three percent of reported incidents in Q3 were from the financial and insurance services sector; it remains the most affected sector for two consecutive quarters.
The next most affected sectors were technology (6%) and professional, scientific, technical, administrative and support services sector (5%); these also remain the same in the ranking of incidents by sector (2nd and 3rd respectively) for two consecutive quarters.
What can our clients do about the current cyber security threats?
CERT NZ has provided a set of suggested critical controls; these aim to provide a base level of information security that will thwart the majority of attacks.
