Attacks/Breaches
5/5/2009
03:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

BT Study: Most Enterprises Expect To Get Hacked This Year

A soon-to-be released ethical hacking report finds 60 percent of organizations budget for penetration testing

Call it realism, or call it pessimism, but most organizations today are resigned to getting hacked. In fact, a full 94 percent expect to suffer a successful breach in the next 12 months, according to a new study on ethical hacking to be released by British Telecom (BT) later this week.

The twist: Those who conduct network penetration tests think their chances of getting hacked are less likely than those who don't. Those who pen test estimated their chances of a breach at around 26 percent, while those who don't thought they had a 38 percent chance, according to BT's new 2009 Ethical Hacking study, which polled more than 200 IT professionals worldwide from mid-February through the end of March.

Around 60 percent of organizations have budgeted for pen testing, while around 38 percent have not, the study found. Nearly 70 percent allocate 1 to 5 percent of their security budgets for pen testing, 17 percent allocated 6 to 10 percent, and 2 percent set aside 20 percent.

"Those respondents with ethical hacking budgets are, on average, less likely to think they are going to be hacked," says Felicia Wetter, managing principal of managed security solutions at BT Americas. "Some of this may be psychological, but it has to do with people feeling more secure by knowing where their vulnerabilities [are]."

In BT's previous ethical hacking survey, in 2007, nearly half of all IT pros said their organizations had only a 1 to 10 percent chance of getting hacked. But that number dropped to about 40 percent in this year's study.

Rick Blum, author of the survey and director of strategic marketing at BT in North America, says PCI-DSS is helping drive demand for so-called ethical hacking. "I expect to see demand for penetration testing go up just from PCI," he says.

BT's Wetters says now that PCI has added network and application pen-testing requirements to its quarterly scanning rules, BT is seeing more pen-testing activity among its customers, and not just for PCI reasons. Survey respondents ranked the benefits of pen testing, performed either themselves or via a third party provider: "First, they're most concerned with improving their security posture," Wetters says. "Then protection against theft of intellectual property, and then regulatory requirements."

Around 43 percent said pen testing's No. 1 benefit is improving their security posture, 22 percent pointed to protection against intellectual property theft, and 20 percent cited regulatory or legislative mandates.

Meanwhile, more than 80 percent of the organizations in the survey have conducted pen tests on their networks, applications, systems, and wireless environments in the past two years. Around 70 percent have used these tests for code review, and 59 percent for war dialing. Around 60 percent of the respondents said network testing is the most important type of testing when it comes to keeping their data assets secure.

But, interestingly, those who have pen tested in the past year have found most serious vulnerabilities in their applications and operating systems, according to the survey -- around 20 percent cited each. Only about 7 percent found serious bugs in their landline networks, and 12 percent in their wireless ones.

Still, not all organizations use pen testing -- mainly due to upper management's lack of understanding about the benefits of hacking your own network and systems (59 percent) to find weaknesses. Another reason: lack of manpower and skills to fix vulnerabilities that are discovered (44 percent). In addition, roughly 26 percent said they don't have the money to fix potential flaws, and 13 percent are worried about the potential safety or fallout of a purposeful internal hack. Fewer than 5 percent said they worry that the results of the pen test "could be embarrassing," according to the report.

BT's survey also found that security budgets are faring better than expected in the current economic climate. Nearly 30 percent said they expect their security budgets to increase this year as a percentage of their overall IT budgets, and 24 percent expect an increase in actual dollars. Another 22 percent said they expect their security budget to decrease as a percentage of their overall IT budget, and 31 percent, to decrease in actual dollars.

Only about 6 percent allocate more than 20 percent of their IT budgets for security, while more than 80 percent allocate 10 percent or less of the IT budget specifically for security.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2808
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Bionic in Android before 4.1.1 incorrectly uses time and PID information during the generation of random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a rel...

CVE-2015-0800
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2...

CVE-2015-0801
Published: 2015-04-01
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.

CVE-2015-0802
Published: 2015-04-01
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a p...

CVE-2015-0803
Published: 2015-04-01
The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) ...

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.