Aug 30, 2010 (04:08 AM EDT)
Strategic Security Survey: Global Threat, Local Pain
Read the Original Article at InformationWeek
Operation Aurora, the massive cyberassault on Google, Adobe, Juniper, Rackspace and others, proved that intellectual property is as much a target as credit-card data and other customer info, so perhaps it's no coincidence that more than 90% of the 1,002 business technology and security professionals who responded to our survey expressed concern that such an exploit could affect their organizations. Nearly one-third are "very concerned" that it could happen to them.
As we watched the news and read the coverage in both technical and mainstream media outlets, we saw people finally waking up. CISOs everywhere got copies of the venerable, "Could this happen to us?" email from management and had to answer questions about how they could hope to fend off these attacks if Google, which employs hundreds of security pros, had to withdraw from the largest emerging market and leave millions on the table.
Security researchers group these attacks under the category of advanced persistent threat, or APT. We see APT as shorthand for a targeted assault, where the attacker’s skill level and resources are advanced. When they get in, often via social engineering, they seek to stay undetected and tunnel deeper into the network, then quietly export valuable data. Cleaning up the mess is an expensive nightmare. As we said, government entities have been using this terminology for some time, but this was the first major announcement of a successful zero-day attack being conducted against a private company. The fact is, after several years of both our budgets and our data being under siege, few organizations have the means to fight off world-class attackers. But putting your head in the sand is a bad plan, as is throwing up your hands and blaming upper management. As we’ve said before, in every security survey we deploy, a healthy percentage of commenters say they long for a major breach to wake business leaders up.
With worries about advanced persistent threat (APT) intensifying, companies are devoting more time and staff resources to related protective measures. For instance, 30% of our 1,002 survey respondents said they now spend a great deal of time and staff resources on virus and worm detection and research-that's a 25% increase over 2009. Likewise, the percentage of organizations dedicating a great deal of time and staff resources to incident response and end-user security awareness training has risen 14% and 22%, respectively.
Apparently, not everyone feels increasingly insecure. Only 16% of the 1,002 professionals we polled said their organizations are more vulnerable to malicious attacks and security breaches than they were a year ago, despite the seeming ability of attackers to infiltrate even the most well-defended networks. That's just slightly more than the previous year. Other respondents may be overly confident. Will their complacency leave them prime for problems?
More realistic expectations? More than one-third of our poll respondents -- 36% vs. last year's 32% -- told us they anticipate that their organizations will be the target of some form of security breach or espionage within the next year.
Fewer than one-quarter of all 1,002 business tech and security pros we polled said their organizations experienced a security breach or espionage in the past year, representing just a slight uptick over last year. The vast majority of companies, it seems, managed to stay safe despite the mounting challenges.
Learn more about InformationWeek Analytics' Global Threat, Local Pain: 2010 Strategic Security Survey.
Our survey respondents ranked hackers, at 77%, the biggest source of breaches or espionage posing a threat to their organizations, followed by authorized users/employees (70%), application vulnerabilities (63%), external users (44%) and contracted service providers/consultants/auditors (36%). Said one poll respondent, "Outsourcing has been our biggest source of breaches and data loss."