Attacks/Breaches
5/5/2009
03:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

BT Study: Most Enterprises Expect To Get Hacked This Year

A soon-to-be released ethical hacking report finds 60 percent of organizations budget for penetration testing

Call it realism, or call it pessimism, but most organizations today are resigned to getting hacked. In fact, a full 94 percent expect to suffer a successful breach in the next 12 months, according to a new study on ethical hacking to be released by British Telecom (BT) later this week.

The twist: Those who conduct network penetration tests think their chances of getting hacked are less likely than those who don't. Those who pen test estimated their chances of a breach at around 26 percent, while those who don't thought they had a 38 percent chance, according to BT's new 2009 Ethical Hacking study, which polled more than 200 IT professionals worldwide from mid-February through the end of March.

Around 60 percent of organizations have budgeted for pen testing, while around 38 percent have not, the study found. Nearly 70 percent allocate 1 to 5 percent of their security budgets for pen testing, 17 percent allocated 6 to 10 percent, and 2 percent set aside 20 percent.

"Those respondents with ethical hacking budgets are, on average, less likely to think they are going to be hacked," says Felicia Wetter, managing principal of managed security solutions at BT Americas. "Some of this may be psychological, but it has to do with people feeling more secure by knowing where their vulnerabilities [are]."

In BT's previous ethical hacking survey, in 2007, nearly half of all IT pros said their organizations had only a 1 to 10 percent chance of getting hacked. But that number dropped to about 40 percent in this year's study.

Rick Blum, author of the survey and director of strategic marketing at BT in North America, says PCI-DSS is helping drive demand for so-called ethical hacking. "I expect to see demand for penetration testing go up just from PCI," he says.

BT's Wetters says now that PCI has added network and application pen-testing requirements to its quarterly scanning rules, BT is seeing more pen-testing activity among its customers, and not just for PCI reasons. Survey respondents ranked the benefits of pen testing, performed either themselves or via a third party provider: "First, they're most concerned with improving their security posture," Wetters says. "Then protection against theft of intellectual property, and then regulatory requirements."

Around 43 percent said pen testing's No. 1 benefit is improving their security posture, 22 percent pointed to protection against intellectual property theft, and 20 percent cited regulatory or legislative mandates.

Meanwhile, more than 80 percent of the organizations in the survey have conducted pen tests on their networks, applications, systems, and wireless environments in the past two years. Around 70 percent have used these tests for code review, and 59 percent for war dialing. Around 60 percent of the respondents said network testing is the most important type of testing when it comes to keeping their data assets secure.

But, interestingly, those who have pen tested in the past year have found most serious vulnerabilities in their applications and operating systems, according to the survey -- around 20 percent cited each. Only about 7 percent found serious bugs in their landline networks, and 12 percent in their wireless ones.

Still, not all organizations use pen testing -- mainly due to upper management's lack of understanding about the benefits of hacking your own network and systems (59 percent) to find weaknesses. Another reason: lack of manpower and skills to fix vulnerabilities that are discovered (44 percent). In addition, roughly 26 percent said they don't have the money to fix potential flaws, and 13 percent are worried about the potential safety or fallout of a purposeful internal hack. Fewer than 5 percent said they worry that the results of the pen test "could be embarrassing," according to the report.

BT's survey also found that security budgets are faring better than expected in the current economic climate. Nearly 30 percent said they expect their security budgets to increase this year as a percentage of their overall IT budgets, and 24 percent expect an increase in actual dollars. Another 22 percent said they expect their security budget to decrease as a percentage of their overall IT budget, and 31 percent, to decrease in actual dollars.

Only about 6 percent allocate more than 20 percent of their IT budgets for security, while more than 80 percent allocate 10 percent or less of the IT budget specifically for security.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2003-1598
Published: 2014-10-01
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

CVE-2011-4624
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

CVE-2012-0811
Published: 2014-10-01
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files gene...

CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Chris Hadnagy, who hosts the annual Social Engineering Capture the Flag Contest at DEF CON, will discuss the latest trends attackers are using.