Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics //

Security Monitoring

05:25 PM

Security Index Marks A Year Of Doing Business Dangerously

The Index of Cyber Security has measured top security officers' sentiment on cyberthreats for more than a year. So what does the index's steady rise mean?

People who believe the state of cybersecurity is worse for wear have good company: For its first year, the Index of Cyber Security -- a measure of the threat to companies as viewed by their top security officers -- has risen steadily at about 2 percent per month.

The index measures the opinions of cybersecurity experts on whether various facets of security are getting better, trending worse, or staying the same. The index started at a base value of 1,000 in March 2011 and stands at 1,292 a year later. Because the questions ask the respondents to answer relative to the previous month, the index measures the relative movement of the experts' opinions on threats and is not an absolute rating of threat.

"The considered opinion of that group of people is that the risk is rising," says Dan Geer, a well-known security professional and one of the two creators of the Index of Cyber Security.

Geer and co-creator Mukul Pareek started the ICS in April 2011, using the previous month as a baseline with a score of 1,000. The pair asked a vetted group of chief security officers and security managers to rate the current trajectory of different threats and factors that contribute to cybersecurity, such as the threat from malware, the risk to Internet-facing applications, or the danger posed by third-party custodians of data. Each respondent is asked to rate each factor as falling fast, falling, static, rising, or rising fast.

The results are delivered back to the group as a monthly report with anonymized comments. The creators acknowledge that the model is simple, but that's the point. By simplifying the data in the same repeatable way, they are able to create a measure that has some meaning.

"What practitioners can take away is that what they are seeing and how it might differ from our index is informative," Geer says. "They can go to the budget side of the house, and say, 'It is not just us. Here is what hundreds of my peers say.'"

The steady rise of the index has some experts questioning whether the Index of Cyber Security is measuring the relative threat or the mindset of security practitioners.

"Things seem to be going to hell in a hand basket if you believe the ICS," says Andrew Jaquith, chief technology officer for Perimeter E-Security. Jaquith does not question the usefulness of measuring the sentiment of security professionals, but adds, "The question that I suppose you got to ask is whether security people are just pessimists, because if they are you are always inclined to think that things might be getting worse."

Yet the single threat measurement does not tell the whole story. Peering at the individual components of the index reveals some interesting data. Two factors have regularly contributed to the perceived threat: political and ideological activity and the risk due to counterparties -- hardly surprising given the rise of Anonymous over the last year and the continuing parade of hefty breaches announced.

[ Anonymous is a brand, and one that is in danger of being overwhelmed by its own chaotic nature, two security professionals argue. See Anonymous Must Evolve Or Break Down, Say Researchers. ]

"It is interesting that that is the biggest risk, not the Chinese or APT," Jaquith says.

The general trend of the underlying factors that make up the index appeared to correlate to the major stories in any given month. Significant attacks by Anonymous would make chief security officers worry more about the hacktivism threat, while media coverage of large data breaches would boost the visibility of that threat.

Geer points out that the press stories may not be the influencers in this case.

"We are not sure which way causality runs," he says. "Are the people reading the press, or is the press reading the people?"

Perhaps as interesting, the factors that least contributed to the threat rating indicate that some aspects of cybersecurity are improving, or at least not getting much worse. Operational security officers seem to believe that information-sharing between companies had improved and that their defenses were more successful against attackers. Finally, the respondents felt that they were getting more support from the government in cybersecurity matters.

The general ICS is not meant to guide chief security officers in how much they should be investing in security, but it could help them review their priorities, Perimeter's Jaquith says.

"It is the relative ranking that matters," he says. "If things change place, you may want to look at your own priorities."

The Index of Cyber Security creators plan to use the anniversary to significantly change some of the underlying components. A year after the creation of the index, Geer and Pareek have discovered a number of ways that the system could be improved. Rather than changing the index piecemeal -- and measuring the impact of the change -- the two researchers will lump all of the changes together.

"It goes back to thinking about what the index is for and what purpose does it serve," Pareek says. "The responses that don't change in any significant way month to month do not contribute to decision support."

While the changes will make data comparisons with the past year less meaningful, it could make the index a better measure of threat for the future.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.