Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics //

Security Monitoring

05:25 PM

Security Index Marks A Year Of Doing Business Dangerously

The Index of Cyber Security has measured top security officers' sentiment on cyberthreats for more than a year. So what does the index's steady rise mean?

People who believe the state of cybersecurity is worse for wear have good company: For its first year, the Index of Cyber Security -- a measure of the threat to companies as viewed by their top security officers -- has risen steadily at about 2 percent per month.

The index measures the opinions of cybersecurity experts on whether various facets of security are getting better, trending worse, or staying the same. The index started at a base value of 1,000 in March 2011 and stands at 1,292 a year later. Because the questions ask the respondents to answer relative to the previous month, the index measures the relative movement of the experts' opinions on threats and is not an absolute rating of threat.

"The considered opinion of that group of people is that the risk is rising," says Dan Geer, a well-known security professional and one of the two creators of the Index of Cyber Security.

Geer and co-creator Mukul Pareek started the ICS in April 2011, using the previous month as a baseline with a score of 1,000. The pair asked a vetted group of chief security officers and security managers to rate the current trajectory of different threats and factors that contribute to cybersecurity, such as the threat from malware, the risk to Internet-facing applications, or the danger posed by third-party custodians of data. Each respondent is asked to rate each factor as falling fast, falling, static, rising, or rising fast.

The results are delivered back to the group as a monthly report with anonymized comments. The creators acknowledge that the model is simple, but that's the point. By simplifying the data in the same repeatable way, they are able to create a measure that has some meaning.

"What practitioners can take away is that what they are seeing and how it might differ from our index is informative," Geer says. "They can go to the budget side of the house, and say, 'It is not just us. Here is what hundreds of my peers say.'"

The steady rise of the index has some experts questioning whether the Index of Cyber Security is measuring the relative threat or the mindset of security practitioners.

"Things seem to be going to hell in a hand basket if you believe the ICS," says Andrew Jaquith, chief technology officer for Perimeter E-Security. Jaquith does not question the usefulness of measuring the sentiment of security professionals, but adds, "The question that I suppose you got to ask is whether security people are just pessimists, because if they are you are always inclined to think that things might be getting worse."

Yet the single threat measurement does not tell the whole story. Peering at the individual components of the index reveals some interesting data. Two factors have regularly contributed to the perceived threat: political and ideological activity and the risk due to counterparties -- hardly surprising given the rise of Anonymous over the last year and the continuing parade of hefty breaches announced.

[ Anonymous is a brand, and one that is in danger of being overwhelmed by its own chaotic nature, two security professionals argue. See Anonymous Must Evolve Or Break Down, Say Researchers. ]

"It is interesting that that is the biggest risk, not the Chinese or APT," Jaquith says.

The general trend of the underlying factors that make up the index appeared to correlate to the major stories in any given month. Significant attacks by Anonymous would make chief security officers worry more about the hacktivism threat, while media coverage of large data breaches would boost the visibility of that threat.

Geer points out that the press stories may not be the influencers in this case.

"We are not sure which way causality runs," he says. "Are the people reading the press, or is the press reading the people?"

Perhaps as interesting, the factors that least contributed to the threat rating indicate that some aspects of cybersecurity are improving, or at least not getting much worse. Operational security officers seem to believe that information-sharing between companies had improved and that their defenses were more successful against attackers. Finally, the respondents felt that they were getting more support from the government in cybersecurity matters.

The general ICS is not meant to guide chief security officers in how much they should be investing in security, but it could help them review their priorities, Perimeter's Jaquith says.

"It is the relative ranking that matters," he says. "If things change place, you may want to look at your own priorities."

The Index of Cyber Security creators plan to use the anniversary to significantly change some of the underlying components. A year after the creation of the index, Geer and Pareek have discovered a number of ways that the system could be improved. Rather than changing the index piecemeal -- and measuring the impact of the change -- the two researchers will lump all of the changes together.

"It goes back to thinking about what the index is for and what purpose does it serve," Pareek says. "The responses that don't change in any significant way month to month do not contribute to decision support."

While the changes will make data comparisons with the past year less meaningful, it could make the index a better measure of threat for the future.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I like the old version of Google assistant much better.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-01-21
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
PUBLISHED: 2021-01-21
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that conta...
PUBLISHED: 2021-01-21
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, ...
PUBLISHED: 2021-01-21
Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executi...
PUBLISHED: 2021-01-21
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typicall...