NTA Monitor

Latest News

Will IE6 be the next NT4?

1st October 2009 All penetration testers will remember the long tail of Windows NT 4.0, and how this operating system continued to be used long past the point when security updates stopped at the end of 2004. For many years the presence of an unpatchable NT4 server was a common issue in a penetration test report, and it is only now, almost five years after security support ended, that finding an NT4 system on a network is becoming a rare event. Read More

One in four web applications susceptible to high risk security flaws

7th September 2009 NTA Monitor has reported a 10% increase in the total number of web applications found to have at least one high-risk security issue... Read More

Organisations facing a changing threat landscape

20th July 2009 According to NTA Monitor's 2009 Annual Security Report, the average number of Internet security vulnerabilities is on the rise... Read More

The Return of the Insider Threat

1st July 2009 When NTA started security testing twelve years ago, the main focus was on the insider threat. There were many reports with statistics showing that most security breaches were due to insiders. By contrast there was very little focus on the external threat via Internet and third-party network links. Back then many companies did not even have a firewall. Read More

IT managers have more security headaches to deal with

NTA Monitor's 2008 Annual Security Report has revealed that the average number of vulnerabilities found per test have increased to 21 compared with 19 in 2007, showing that IT security managers now have more issues to contend with. The types of risk giving organisations the greatest headache are service specific vulnerabilities and these types of security issues accounted for 60% of all risks identified.

The report analyses data gathered from external Internet vulnerability tests conducted by NTA on UK organisations in a wide range of industry sectors, including finance, government, retail, IT, charities and law.

Overall, the indication is that organisations are becoming more successful at avoiding critical vulnerabilities, with only 25% of companies tested containing one or more high risk vulnerabilities - which are widely known and actively exploited by hackers - compared to 32% in 2007.

Whilst improvements in high risk security issues have been achieved, individual sectors have not performed so well. Finance, government, legal, retail and utilities sectors have all seen an increase in the number of overall vulnerabilities found. In particular, the average number of risks per test for financial institutions has increased to 20 compared with 19 in 2007, whilst the retail sector has seen an increase from 16 to 21 over the last year.

Of the 10 most commonly occurring critical vulnerabilities, seven were found in last year's report, indicating that these same issues continue to take their toll. All of the top 10 high risk flaws are associated with services that are being made available to Internet users, demonstrating that with increased functionality comes the threat of reduced security.

Roy Hills, Technical Director at NTA says: "The presence of high risk vulnerabilities may allow an attacker to cause a buffer overflow on a server, resulting in malicious code being executed. A hacker could also gain entry to the corporate network and change users' passwords or delete files, which could wreak corporate havoc. These high risk vulnerabilities are widely known and actively exploited by hackers, leaving many companies susceptible to attack."

NTA Monitor recommends that companies apply the following recommendations to raise awareness and minimise their exposure to IT security risks:

A copy of the full report contains further recommendations and not only looks at the different types of vulnerabilities found in organisations, but also examines how a range of industry sectors fair against the average findings. It is available from NTA by emailing marketing@nta-monitor.com

This article was first released on: 11th May 2008