Attacks/Breaches
5/5/2009
03:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

BT Study: Most Enterprises Expect To Get Hacked This Year

A soon-to-be released ethical hacking report finds 60 percent of organizations budget for penetration testing

Call it realism, or call it pessimism, but most organizations today are resigned to getting hacked. In fact, a full 94 percent expect to suffer a successful breach in the next 12 months, according to a new study on ethical hacking to be released by British Telecom (BT) later this week.

The twist: Those who conduct network penetration tests think their chances of getting hacked are less likely than those who don't. Those who pen test estimated their chances of a breach at around 26 percent, while those who don't thought they had a 38 percent chance, according to BT's new 2009 Ethical Hacking study, which polled more than 200 IT professionals worldwide from mid-February through the end of March.

Around 60 percent of organizations have budgeted for pen testing, while around 38 percent have not, the study found. Nearly 70 percent allocate 1 to 5 percent of their security budgets for pen testing, 17 percent allocated 6 to 10 percent, and 2 percent set aside 20 percent.

"Those respondents with ethical hacking budgets are, on average, less likely to think they are going to be hacked," says Felicia Wetter, managing principal of managed security solutions at BT Americas. "Some of this may be psychological, but it has to do with people feeling more secure by knowing where their vulnerabilities [are]."

In BT's previous ethical hacking survey, in 2007, nearly half of all IT pros said their organizations had only a 1 to 10 percent chance of getting hacked. But that number dropped to about 40 percent in this year's study.

Rick Blum, author of the survey and director of strategic marketing at BT in North America, says PCI-DSS is helping drive demand for so-called ethical hacking. "I expect to see demand for penetration testing go up just from PCI," he says.

BT's Wetters says now that PCI has added network and application pen-testing requirements to its quarterly scanning rules, BT is seeing more pen-testing activity among its customers, and not just for PCI reasons. Survey respondents ranked the benefits of pen testing, performed either themselves or via a third party provider: "First, they're most concerned with improving their security posture," Wetters says. "Then protection against theft of intellectual property, and then regulatory requirements."

Around 43 percent said pen testing's No. 1 benefit is improving their security posture, 22 percent pointed to protection against intellectual property theft, and 20 percent cited regulatory or legislative mandates.

Meanwhile, more than 80 percent of the organizations in the survey have conducted pen tests on their networks, applications, systems, and wireless environments in the past two years. Around 70 percent have used these tests for code review, and 59 percent for war dialing. Around 60 percent of the respondents said network testing is the most important type of testing when it comes to keeping their data assets secure.

But, interestingly, those who have pen tested in the past year have found most serious vulnerabilities in their applications and operating systems, according to the survey -- around 20 percent cited each. Only about 7 percent found serious bugs in their landline networks, and 12 percent in their wireless ones.

Still, not all organizations use pen testing -- mainly due to upper management's lack of understanding about the benefits of hacking your own network and systems (59 percent) to find weaknesses. Another reason: lack of manpower and skills to fix vulnerabilities that are discovered (44 percent). In addition, roughly 26 percent said they don't have the money to fix potential flaws, and 13 percent are worried about the potential safety or fallout of a purposeful internal hack. Fewer than 5 percent said they worry that the results of the pen test "could be embarrassing," according to the report.

BT's survey also found that security budgets are faring better than expected in the current economic climate. Nearly 30 percent said they expect their security budgets to increase this year as a percentage of their overall IT budgets, and 24 percent expect an increase in actual dollars. Another 22 percent said they expect their security budget to decrease as a percentage of their overall IT budget, and 31 percent, to decrease in actual dollars.

Only about 6 percent allocate more than 20 percent of their IT budgets for security, while more than 80 percent allocate 10 percent or less of the IT budget specifically for security.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3304
Published: 2014-10-30
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.

CVE-2013-7409
Published: 2014-10-30
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.

CVE-2014-3446
Published: 2014-10-30
SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.

CVE-2014-3584
Published: 2014-10-30
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

CVE-2014-3623
Published: 2014-10-30
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vect...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.