Attacks/Breaches
4/20/2012
05:52 PM
50%
50%

Anonymous Drives Security Fears, But Not Spending

Information security budgets remain focused on stopping malware and advanced persistent threats (APTs), which tend to do more damage in the long run than hacktivists' SQL injection and DDoS attacks.

Anonymous: 10 Facts About The Hacktivist Group
Anonymous: 10 Facts About The Hacktivist Group
(click image for larger view and for slideshow)
Who are the groups voted most likely to lob cyber attacks at companies over the next six months? That would be the hacktivist set, including Anonymous, LulzSec Reborn, and their ilk.

So said 61% of 1,900 IT and information security personnel recently surveyed by endpoint security firm Bit9. Interestingly, however, the survey also found that actual information security program spending doesn't track this threat analysis.

Instead, most businesses are devoting the majority of their security resources to stopping what they see as the most prevalent attack techniques: malware (for 45%), as well as spear phishing (16%). Interestingly, both of these types of attacks--often used as part of advanced persistent threats (APTs)--are the hallmark not of hacktivists, but rather criminal enterprises, nation states, or sometimes even competitors. Although only 20% of respondents overall ranked corporate competitors as their most likely attackers in the next six months, one-third of all European respondents listed corporate espionage as their top threat concern.

[ Read 10 Strategies To Fight Anonymous DDoS Attacks. ]

Businesses spent markedly less to battle typical hacktivist attack vectors, such as SQL injection hacks or distributed denial-of-service (DDOS) attacks.

Why do companies fear Anonymous but spend more to stop malware and spear phishing? "My takeaway is that people are definitely more aware of the threat landscape we face, more than ever before. And Verizon's 2012 data breach report, for the first time ever, said that Anonymous or hacktivist organizations represented more than half of all the database records stolen in 2011. So it's not just fear," said Harry Sverdlove, CTO of Bit9.

Businesses, of course, are worried about seeing their name featured on newspaper front pages thanks to Anonymous hacking their servers, then very publicly releasing stolen records into the public domain. Even so, APTs are likely to be much more damaging to the business over the long term.

"The difference is, if you're attacked by a hacktivist organization, you might see your data posted immediately to the Web," Sverdlove said. "If you're attacked by a criminal enterprise, you might start seeing a trickle of compromised accounts after a few months. If you're attacked by a nation state, you might never find out about that."

Which parts of the IT infrastructure concern security personnel most? More than half of survey respondents characterized the weakest technology link in their IT program as the infrastructure servers, including domain controllers, DNS servers, and credential servers. Respondents were concerned, but less so, with their other servers--file, database, Web, email--and endpoints.

What's the best way to improve a business's information security posture? According to a majority of respondents, the secret is simple: follow security best practices, create better security policies, and enforce them. Interestingly, only 15% said that better technology would have the biggest impact on their security programs. Only 7% believe that government regulations and law enforcement would have the biggest impact on improving their cyber security.

In our InformationWeek Government virtual event, Next Steps In Cybersecurity, experts will assess the state of cybersecurity in government and present strategies for creating a more secure IT infrastructure. It happens May 24.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
Get Serious about IoT Security
Derek Manky, Global Security Strategist, Fortinet,  9/20/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.