Data Breaches

  1. Common Vulnerabilities and Attack Vectors
    1. Technical Vulnerabilities
      1. Software Vulnerabilities
        1. Unpatched Software
          1. Legacy System Vulnerabilities
            1. Zero-Day Vulnerabilities
              1. Third-Party Component Flaws
              2. Web Application Vulnerabilities
                1. SQL Injection
                  1. Union-Based Injection
                    1. Boolean-Based Injection
                      1. Time-Based Injection
                      2. Cross-Site Scripting (XSS)
                        1. Reflected XSS
                          1. Stored XSS
                            1. DOM-Based XSS
                            2. Cross-Site Request Forgery (CSRF)
                              1. Insecure Direct Object References
                                1. Security Misconfigurations
                                2. Network Vulnerabilities
                                  1. Weak Network Protocols
                                    1. Unencrypted Communications
                                      1. Network Segmentation Issues
                                        1. Wireless Network Weaknesses
                                        2. API Vulnerabilities
                                          1. Broken Authentication
                                            1. Excessive Data Exposure
                                              1. Lack of Rate Limiting
                                                1. Injection Flaws
                                                2. Cryptographic Vulnerabilities
                                                  1. Weak Encryption Algorithms
                                                    1. Poor Key Management
                                                      1. Insufficient Randomness
                                                        1. Certificate Validation Issues
                                                        2. Cloud-Specific Vulnerabilities
                                                          1. Misconfigured Storage Buckets
                                                            1. Insecure APIs
                                                              1. Shared Technology Vulnerabilities
                                                                1. Account Hijacking
                                                              2. Human Vulnerabilities
                                                                1. Social Engineering Susceptibility
                                                                  1. Phishing Susceptibility
                                                                    1. Authority Deference
                                                                      1. Urgency Response
                                                                        1. Curiosity Exploitation
                                                                        2. Poor Security Practices
                                                                          1. Weak Password Habits
                                                                            1. Password Sharing
                                                                              1. Unverified Software Installation
                                                                                1. Unsafe Browsing Habits
                                                                                2. Lack of Security Awareness
                                                                                  1. Unrecognized Threats
                                                                                    1. Inadequate Training
                                                                                      1. Complacency
                                                                                    2. Process and Organizational Vulnerabilities
                                                                                      1. Access Control Weaknesses
                                                                                        1. Overprivileged Accounts
                                                                                          1. Lack of Role-Based Access
                                                                                            1. Inadequate Account Management
                                                                                              1. Missing Access Reviews
                                                                                              2. Monitoring and Detection Gaps
                                                                                                1. Insufficient Logging
                                                                                                  1. Poor Log Analysis
                                                                                                    1. Delayed Incident Detection
                                                                                                      1. Inadequate Alerting
                                                                                                      2. Change Management Issues
                                                                                                        1. Uncontrolled Changes
                                                                                                          1. Inadequate Testing
                                                                                                            1. Poor Documentation
                                                                                                            2. Vendor Management Weaknesses
                                                                                                              1. Inadequate Due Diligence
                                                                                                                1. Poor Contract Terms
                                                                                                                  1. Insufficient Monitoring

                                                                                                              Previous

                                                                                                              3. Causes and Sources of Data Breaches

                                                                                                              Go to top

                                                                                                              Next

                                                                                                              5. Threat Actors and Motivations