Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/5/2009
03:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

BT Study: Most Enterprises Expect To Get Hacked This Year

A soon-to-be released ethical hacking report finds 60 percent of organizations budget for penetration testing

Call it realism, or call it pessimism, but most organizations today are resigned to getting hacked. In fact, a full 94 percent expect to suffer a successful breach in the next 12 months, according to a new study on ethical hacking to be released by British Telecom (BT) later this week.

The twist: Those who conduct network penetration tests think their chances of getting hacked are less likely than those who don't. Those who pen test estimated their chances of a breach at around 26 percent, while those who don't thought they had a 38 percent chance, according to BT's new 2009 Ethical Hacking study, which polled more than 200 IT professionals worldwide from mid-February through the end of March.

Around 60 percent of organizations have budgeted for pen testing, while around 38 percent have not, the study found. Nearly 70 percent allocate 1 to 5 percent of their security budgets for pen testing, 17 percent allocated 6 to 10 percent, and 2 percent set aside 20 percent.

"Those respondents with ethical hacking budgets are, on average, less likely to think they are going to be hacked," says Felicia Wetter, managing principal of managed security solutions at BT Americas. "Some of this may be psychological, but it has to do with people feeling more secure by knowing where their vulnerabilities [are]."

In BT's previous ethical hacking survey, in 2007, nearly half of all IT pros said their organizations had only a 1 to 10 percent chance of getting hacked. But that number dropped to about 40 percent in this year's study.

Rick Blum, author of the survey and director of strategic marketing at BT in North America, says PCI-DSS is helping drive demand for so-called ethical hacking. "I expect to see demand for penetration testing go up just from PCI," he says.

BT's Wetters says now that PCI has added network and application pen-testing requirements to its quarterly scanning rules, BT is seeing more pen-testing activity among its customers, and not just for PCI reasons. Survey respondents ranked the benefits of pen testing, performed either themselves or via a third party provider: "First, they're most concerned with improving their security posture," Wetters says. "Then protection against theft of intellectual property, and then regulatory requirements."

Around 43 percent said pen testing's No. 1 benefit is improving their security posture, 22 percent pointed to protection against intellectual property theft, and 20 percent cited regulatory or legislative mandates.

Meanwhile, more than 80 percent of the organizations in the survey have conducted pen tests on their networks, applications, systems, and wireless environments in the past two years. Around 70 percent have used these tests for code review, and 59 percent for war dialing. Around 60 percent of the respondents said network testing is the most important type of testing when it comes to keeping their data assets secure.

But, interestingly, those who have pen tested in the past year have found most serious vulnerabilities in their applications and operating systems, according to the survey -- around 20 percent cited each. Only about 7 percent found serious bugs in their landline networks, and 12 percent in their wireless ones.

Still, not all organizations use pen testing -- mainly due to upper management's lack of understanding about the benefits of hacking your own network and systems (59 percent) to find weaknesses. Another reason: lack of manpower and skills to fix vulnerabilities that are discovered (44 percent). In addition, roughly 26 percent said they don't have the money to fix potential flaws, and 13 percent are worried about the potential safety or fallout of a purposeful internal hack. Fewer than 5 percent said they worry that the results of the pen test "could be embarrassing," according to the report.

BT's survey also found that security budgets are faring better than expected in the current economic climate. Nearly 30 percent said they expect their security budgets to increase this year as a percentage of their overall IT budgets, and 24 percent expect an increase in actual dollars. Another 22 percent said they expect their security budget to decrease as a percentage of their overall IT budget, and 31 percent, to decrease in actual dollars.

Only about 6 percent allocate more than 20 percent of their IT budgets for security, while more than 80 percent allocate 10 percent or less of the IT budget specifically for security.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/1/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13757
PUBLISHED: 2020-06-01
Python-RSA 4.0 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing exces...
CVE-2020-13758
PUBLISHED: 2020-06-01
modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by placing %00 before the payload.
CVE-2020-9291
PUBLISHED: 2020-06-01
An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack.
CVE-2019-15709
PUBLISHED: 2020-06-01
An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI.
CVE-2020-13695
PUBLISHED: 2020-06-01
In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/*.db or /etc/shadow file.