Attacks/Breaches
5/5/2009
03:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

BT Study: Most Enterprises Expect To Get Hacked This Year

A soon-to-be released ethical hacking report finds 60 percent of organizations budget for penetration testing

Call it realism, or call it pessimism, but most organizations today are resigned to getting hacked. In fact, a full 94 percent expect to suffer a successful breach in the next 12 months, according to a new study on ethical hacking to be released by British Telecom (BT) later this week.

The twist: Those who conduct network penetration tests think their chances of getting hacked are less likely than those who don't. Those who pen test estimated their chances of a breach at around 26 percent, while those who don't thought they had a 38 percent chance, according to BT's new 2009 Ethical Hacking study, which polled more than 200 IT professionals worldwide from mid-February through the end of March.

Around 60 percent of organizations have budgeted for pen testing, while around 38 percent have not, the study found. Nearly 70 percent allocate 1 to 5 percent of their security budgets for pen testing, 17 percent allocated 6 to 10 percent, and 2 percent set aside 20 percent.

"Those respondents with ethical hacking budgets are, on average, less likely to think they are going to be hacked," says Felicia Wetter, managing principal of managed security solutions at BT Americas. "Some of this may be psychological, but it has to do with people feeling more secure by knowing where their vulnerabilities [are]."

In BT's previous ethical hacking survey, in 2007, nearly half of all IT pros said their organizations had only a 1 to 10 percent chance of getting hacked. But that number dropped to about 40 percent in this year's study.

Rick Blum, author of the survey and director of strategic marketing at BT in North America, says PCI-DSS is helping drive demand for so-called ethical hacking. "I expect to see demand for penetration testing go up just from PCI," he says.

BT's Wetters says now that PCI has added network and application pen-testing requirements to its quarterly scanning rules, BT is seeing more pen-testing activity among its customers, and not just for PCI reasons. Survey respondents ranked the benefits of pen testing, performed either themselves or via a third party provider: "First, they're most concerned with improving their security posture," Wetters says. "Then protection against theft of intellectual property, and then regulatory requirements."

Around 43 percent said pen testing's No. 1 benefit is improving their security posture, 22 percent pointed to protection against intellectual property theft, and 20 percent cited regulatory or legislative mandates.

Meanwhile, more than 80 percent of the organizations in the survey have conducted pen tests on their networks, applications, systems, and wireless environments in the past two years. Around 70 percent have used these tests for code review, and 59 percent for war dialing. Around 60 percent of the respondents said network testing is the most important type of testing when it comes to keeping their data assets secure.

But, interestingly, those who have pen tested in the past year have found most serious vulnerabilities in their applications and operating systems, according to the survey -- around 20 percent cited each. Only about 7 percent found serious bugs in their landline networks, and 12 percent in their wireless ones.

Still, not all organizations use pen testing -- mainly due to upper management's lack of understanding about the benefits of hacking your own network and systems (59 percent) to find weaknesses. Another reason: lack of manpower and skills to fix vulnerabilities that are discovered (44 percent). In addition, roughly 26 percent said they don't have the money to fix potential flaws, and 13 percent are worried about the potential safety or fallout of a purposeful internal hack. Fewer than 5 percent said they worry that the results of the pen test "could be embarrassing," according to the report.

BT's survey also found that security budgets are faring better than expected in the current economic climate. Nearly 30 percent said they expect their security budgets to increase this year as a percentage of their overall IT budgets, and 24 percent expect an increase in actual dollars. Another 22 percent said they expect their security budget to decrease as a percentage of their overall IT budget, and 31 percent, to decrease in actual dollars.

Only about 6 percent allocate more than 20 percent of their IT budgets for security, while more than 80 percent allocate 10 percent or less of the IT budget specifically for security.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.