NTA Monitor’s 2008 Annual Security Report has revealed that the average number of vulnerabilities found per test have increased to 21 compared with 19 in 2007. According to the IT security testing firm, this is showing that IT security managers now have more issues to contend with.
The types of risk giving organisations the greatest headache are service specific vulnerabilities and these types of security issues accounted for 60pc of all risks identified.
The report analyses data gathered from external Internet vulnerability tests conducted by NTA on UK organisations in a wide range of industry sectors, including finance, government, retail, IT, charities and law.
Overall, the indication is that organisations are becoming more successful at avoiding critical vulnerabilities, with only 25 per cent of companies tested containing one or more high risk vulnerabilities – which are widely known and actively exploited by hackers – compared to 32pc in 2007.
Whilst improvements in high risk security issues have been achieved, individual sectors have not performed so well. Finance, government, legal, retail and utilities sectors have all seen an increase in the number of overall vulnerabilities found. In particular, the average number of risks per test for financial institutions has increased to 20 compared with 19 in 2007, whilst the retail sector has seen an increase from 16 to 21 over the last year.
Of the 10 most commonly occurring critical vulnerabilities, seven were found in last year’s report, indicating that these same issues continue to take their toll. All of the top 10 high risk flaws are associated with services that are being made available to Internet users, demonstrating that with increased functionality comes the threat of reduced security.
Roy Hills, Technical Director at NTA says: “The presence of high risk vulnerabilities may allow an attacker to cause a buffer overflow on a server, resulting in malicious code being executed. A hacker could also gain entry to the corporate network and change users’ passwords or delete files, which could wreak corporate havoc. These high risk vulnerabilities are widely known and actively exploited by hackers, leaving many companies susceptible to attack.”
NTA Monitor recommends that companies apply the following recommendations to raise awareness and minimise their exposure to IT security risks:
Stay up to date on the latest vulnerabilities and apply patches and updates as soon as they become available
Allocate sufficient management time, focus and control to ensure that preventative actions are carried out on an ongoing basis
Involve and educate staff on Internet security issues
Have a clear and up to date security policy. Publicise and update it regularly
A copy of the full report contains further recommendations. It is available from NTA by emailing marketing@nta-monitor.com
About NTA Monitor
NTA is a founder member of the CESG ‘CHECK’ scheme and the newly-founded CREST (Council for Registered Ethical Security Testers). NTA is also an Approved Scanning Vendor (ASV) under the Payment Card Industry Data Security Standard (PCI DSS).
