IT managers have more security headaches to deal with
NTA Monitor's 2008 Annual Security Report has revealed that the average number of vulnerabilities found per test have increased to 21 compared with 19 in 2007, showing that IT security managers now have more issues to contend with. The types of risk giving organisations the greatest headache are service specific vulnerabilities and these types of security issues accounted for 60% of all risks identified.
The report analyses data gathered from external Internet vulnerability tests conducted by NTA on UK organisations in a wide range of industry sectors, including finance, government, retail, IT, charities and law.
Overall, the indication is that organisations are becoming more successful at avoiding critical vulnerabilities, with only 25% of companies tested containing one or more high risk vulnerabilities - which are widely known and actively exploited by hackers - compared to 32% in 2007.
Whilst improvements in high risk security issues have been achieved, individual sectors have not performed so well. Finance, government, legal, retail and utilities sectors have all seen an increase in the number of overall vulnerabilities found. In particular, the average number of risks per test for financial institutions has increased to 20 compared with 19 in 2007, whilst the retail sector has seen an increase from 16 to 21 over the last year.
Of the 10 most commonly occurring critical vulnerabilities, seven were found in last year's report, indicating that these same issues continue to take their toll. All of the top 10 high risk flaws are associated with services that are being made available to Internet users, demonstrating that with increased functionality comes the threat of reduced security.
Roy Hills, Technical Director at NTA says: "The presence of high risk vulnerabilities may allow an attacker to cause a buffer overflow on a server, resulting in malicious code being executed. A hacker could also gain entry to the corporate network and change users' passwords or delete files, which could wreak corporate havoc. These high risk vulnerabilities are widely known and actively exploited by hackers, leaving many companies susceptible to attack."
NTA Monitor recommends that companies apply the following recommendations to raise awareness and minimise their exposure to IT security risks:
- Stay up to date on the latest vulnerabilities and apply patches and updates as soon as they become available
- Allocate sufficient management time, focus and control to ensure that preventative actions are carried out on an ongoing basis
- Involve and educate staff on Internet security issues
- Have a clear and up to date security policy. Publicise and update it regularly
A copy of the full report contains further recommendations and not only looks at the different types of vulnerabilities found in organisations, but also examines how a range of industry sectors fair against the average findings. It is available from NTA by emailing marketing@nta-monitor.com
This article was first released on: 11th May 2008