The study, carried out by AlienVault, found that there were varying degrees of a sense of duty when it came to keeping abreast of security threats. Only about half of respondents (52%) said they would research the impact, 31% said they look for a patch and 1% said they wait to see the full impact.
When it came to sharing intelligence with competitors following a hack, the survey revealed 50% said they would share, 35% would be willing to reveal it anonymously and 15% would be happy to be named.
Meanwhile, only 38% of those that suffered a data breach said that they opted to inform the relevant authorities, and 31% said they would tell their employees. But, most concerning, a mere 11% said they would share the information with the security community.
Information-sharing between security professions is of particular importance, said Barmak Meftah, CEO of AlienVault, noting his own company’s Open Threat Exchange, which helps security professionals connect with their peers, find free tools for security monitoring and learn about the latest threats and defensive tactics from industry experts and security researchers.
"In this way, the whole community has the intelligence needed to cope with an attack of a similar nature,” he said. "The growing complexity and sophistication of threats make it difficult for security professionals to have a clear view of possible vulnerabilities, threats and attacks that are out there."
When IT professionals were asked how get the information that they need, the responses were scattershot, ranging across informal communication channels such as blogs (14%), underground forums (6%) and through peers (13%). News websites numbered only 13%, through partners/resellers 10%, and via education/training, 14%. Those who said through advertising and marketing numbered only 6%, the same number as those who learned through their superiors. Responders who cited using their own research following a problem came in at 16%.
"Sharing information about the source and nature of attacks allows the security community to act fast, and quickly isolate malicious or compromised hosts," said Meftah. "In addition, it helps identify attack methods, tools and patterns, all of which help fuel research on new defense technologies."
Even so, Meftah noted, attitudes are changing, if slowly. "Security professionals are starting to share more and more. They are getting their information from different sources. AlienVault is aware that the only way to beat cybercriminals is to understand the security landscape as a whole and continue to facilitate this sharing among all security practitioners and the wider security community in general."
The survey results come as the European Commission prepares to implement mandatory breach notification laws that will see companies face fines of up to 2% of their global annual turnover. As reported, the survey also found that only 2% of respondents would be willing to go public should they suffer a security breach – indicating a deep fear of taking a hit to their brand equity. "On the one hand, publicizing a breach would help other businesses avoid falling prey to attacks,” Meftah said. “On the other, damage to your brand and reputation could be significant."