According to Bit9’s online survey of 1,861 IT and security professionals, 64% of respondents believed their organization would be the target of a cyberattack in the next six months. Anonymous/hacktivists led the survey with 61% of respondents expecting attacks from that direction, 'cyber criminals' followed with 55%, nation states ranked third with 48%, and disgruntled employees with 28%.
At the same time, respondents were least concerned about SQL injection (4%) and distributed denial-of-service (11%) attacks, the preferred methods of hacktivists, and most concerned about malware (45%) and spear phishing (17%), techniques used by cybercriminals and state-sponsored groups.
“You can’t pick up a newspaper nowadays without seeing Anonymous attacking this particular government organization, threatening to take down the internet, or whatever it might be. So it is not surprising to see a heightened sense of concern about Anonymous, even though statistically speaking you are much less likely to be hit by Anonymous than by a criminal enterprise or targeted cyberespionage attack”, said Harry Sverdlove, chief technology officer with Bit9.
Despite the beehive of activity in Congress on cybersecurity legislation, only 7% of respondents believed that legislation would improve enterprise security. A majority said that companies implementing best practices and better security policies would improve enterprise security the most, and 19% believed individual employees play an important role in improving the state of security.
“There is a recognition that a lot of these attacks, especially when we talk about hacktivism, can be defended against by better security practices and policies”, Sverdlove told Infosecurity.
The survey showed that respondents considered endpoints most “at risk.” However, even those machines that scored the highest for most effective security – infrastructure servers at 40% and file servers at 36% – have been frequent targets for hackers.
Three-quarters of respondents said that their endpoint security solutions on their laptops and desktops are not doing enough to protect their companies and intellectual property from cyber attacks.
A full 95% of respondents said that cyber security breaches should be disclosed to customers and to the public. Almost half of respondents (48%) felt that breached companies should not only disclose the breach, but should also provide a description of what is stolen, while nearly a third believed a description of how the attack occurred should also be shared. Only 6% felt that nothing should be disclosed.
“From a security perspective, with companies sharing more information about the types of attacks they are seeing and how they are occurring, the industry as a whole can learn how to better protect itself from the next type of attack”, Sverdlove said.