Vulnerabilities / Threats

5/22/2018
03:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Las Vegas Most Insecure Cyber City in US; St. Louis Least Vulnerable

Forty-three percent chance of users connecting to high or medium-risk networks in Las Vegas - compared to less than 1% risk in least vulnerable areas, Coronet says.

Turns out that what happens in Las Vegas actually happens in at least a couple of other places as well - from a cybersecurity standpoint.

Residents of the Las Vegas, Memphis, and Charlotte metro areas are at substantially higher risk of data theft and other cybersecurity incidents compared to residents in more than four-dozen other areas in the US.

Cloud security vendor Coronet recently analyzed network connectivity and device related data in the 55 most populated areas in the country and found Wi-Fi and cellular networks — and the devices connecting to them — to be the most insecure in these three areas, the new study shows.

The risk level of a user, expressed in the form of a threat index score, was 10 on a scale of 10 in Las Vegas and 9.8 in both Memphis and Charlotte. People logging into websites or accessing cloud data in these designated market areas (DMAs) were most at risk of experiencing security incidents than anywhere else in the country.

"While in Las Vegas there was a 43% probability of users connecting to medium-risk or high-risk networks, in the least vulnerable cities the average probability was less than one percent," says Dror Liwer, Coronet's founder and CISO. "While in Memphis 7% of devices had no malware protection, the national average was 0.2%," he says.

Other risky cities and areas included Houston (9.2), Providence, RI (9.0), Birmingham, AL (9.0), and Jacksonville, FL (8.9). Rounding off the list of the Top 10 most insecure locations were three market areas in Florida — West Palm Beach-Ft. Pierce (8.9), Orlando-Daytona Beach (8.5), and Tampa–St. Petersburg–Sarasota (8.3).

For purposes of the ranking, Coronet considered any region with a threat index of 6.5 or less to be at an acceptable level of risk. By that metric, the least vulnerable metro in America from a cybersecurity standpoint in Coronet's list was the Richmond-Petersburg area in Virginia with a threat index of just 5.8.

Others in the Top 5 least vulnerable market areas were Greensboro-Winston Salem (6.2); Norfolk-Portsmouth-Newport News (6.2); Seattle-Tacoma (6.3) and St. Louis (6.3).

To arrive at the rankings, Coronet analyzed data collected from more than one million PCs, mobile devices, and tablets running its SecureCloud endpoint software. The collected data included device posture information as well as threat, attack, and vulnerability data gathered from the cellular and Wi-Fi networks to which the devices connected.

Scoring Cities

Coronet scored connectivity infrastructure based on factors like vulnerabilities and misconfigurations that were present on them as well on metrics like wrong routing and spoofing. Among the issues the company looked at were risks posed by captive portals, rogue access points, and honeypots. Devices were scored based on things like the presence or absence of active and updated anti-malware tools, active and updated firewalls, password protection, disk and storage encryption, and operating system integrity.

The company then combined and standardized the infrastructure vulnerability score with the device vulnerability score in each region to arrive at the overall Threat Index Score using a risk score range of 1 to 10,  where 10 represented the highest risk and 1 the lowest.

So why are some regions more risky than others from a security standpoint? It has a lot to do with the presence of more threat actors and activity in certain regions than others, Liwer says. "The main issue is not so much the carriers or network providers that are mostly standardized, but rather, the presence of malicious actors," Liwer says. "While the coffee chain network is configured the same way in [most] of its locations, the fact that three of its locations in Las Vegas are under attack has impact on the probability that users will connect to a malicious node." 

Coronet identified several factors as contributing to heightened threat activity in certain regions of the country. For instance, locations in which there are a lot of defense, financial services companies, manufacturing activity and aerospace firms — like the Tampa-St. Petersburg area and Jacksonville – generally tend to see heightened levels of threat activity.

Fast-growing metro regions and tourist destinations like the Orlando-Daytona DMA tend to be risky as well. For instance, more than 60 million people visited the Central Florida region in a 12-month period flooding the area with unsafe devices from around the world and making them a target for attackers, Coronet said.

Regions with aged or aging populations tend to attract a higher than average amount of threat activity as well. The West Palm Beach-Fort Pierce area with its large population of mostly older, wealthy and likely digitally unsophisticated residents makes for an attractive target for criminals as well.

Mixed Signals

The factors that make a region safer than others are less clear. For instance, the Seattle-Tacoma area, which ranked as the fourth safest in the Coronet report, is one of the most high tech regions in the country. But threat activity here is relatively low compared to areas with a similar high-tech profile. One reason could be because the state of Washington operates one of the most efficient cybersecurity agencies in the country. Similarly, the reason why St. Louis ranked as the fifth least vulnerable region in the country could have to do with presence of Missouri Cybersecurity Center.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Lessons from My Strange Journey into InfoSec
Lysa Myers, Security Researcher, ESET,  7/12/2018
What's Cooking With Caleb Sima
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-9574
PUBLISHED: 2018-07-19
nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
CVE-2017-2673
PUBLISHED: 2018-07-19
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.
CVE-2017-7481
PUBLISHED: 2018-07-19
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templati...
CVE-2018-12911
PUBLISHED: 2018-07-19
WebKitGTK+ 2.20.3 has an off-by-one error, with a resultant out-of-bounds write, in the get_simple_globs functions in ThirdParty/xdgmime/src/xdgmimecache.c and ThirdParty/xdgmime/src/xdgmimeglob.c.
CVE-2018-14404
PUBLISHED: 2018-07-19
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulne...