Vulnerabilities / Threats

02:26 PM
Dark Reading
Dark Reading

Strategic Security Survey: Global Threat, Local Pain

Highlights of exclusive InformationWeek Analytics research as it appears in "Global Threat, Local Pain," our report assessing whether the high-profile infiltration of corporate networks worldwide (Google China leaps to mind) is forcing execs to reconsider their security strategies and pony up related resources.
1 of 6

Operation Aurora, the massive cyberassault on Google, Adobe, Juniper, Rackspace and others, proved that intellectual property is as much a target as credit-card data and other customer info, so perhaps it's no coincidence that more than 90% of the 1,002 business technology and security professionals who responded to our survey expressed concern that such an exploit could affect their organizations. Nearly one-third are "very concerned" that it could happen to them.

As we watched the news and read the coverage in both technical and mainstream media outlets, we saw people finally waking up. CISOs everywhere got copies of the venerable, "Could this happen to us?" email from management and had to answer questions about how they could hope to fend off these attacks if Google, which employs hundreds of security pros, had to withdraw from the largest emerging market and leave millions on the table.

Security researchers group these attacks under the category of advanced persistent threat, or APT. We see APT as shorthand for a targeted assault, where the attacker’s skill level and resources are advanced. When they get in, often via social engineering, they seek to stay undetected and tunnel deeper into the network, then quietly export valuable data. Cleaning up the mess is an expensive nightmare. As we said, government entities have been using this terminology for some time, but this was the first major announcement of a successful zero-day attack being conducted against a private company. The fact is, after several years of both our budgets and our data being under siege, few organizations have the means to fight off world-class attackers. But putting your head in the sand is a bad plan, as is throwing up your hands and blaming upper management. As we’ve said before, in every security survey we deploy, a healthy percentage of commenters say they long for a major breach to wake business leaders up.

Learn more about InformationWeek Analytics' Global Threat, Local Pain: 2010 Strategic Security Survey.

1 of 6
Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
The Case for Integrating Physical Security & Cybersecurity
Paul Kurtz, CEO & Cofounder, TruSTAR Technology,  3/20/2018
A Look at Cybercrime's Banal Nature
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/20/2018
City of Atlanta Hit with Ransomware Attack
Dark Reading Staff 3/23/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.