IT MANAGERS HAVE MORE SECURITY HEADACHES TO DEAL WITH

Published 13th June 2008

NTA Monitor’s 2008 Annual Security Report has revealed that the average number of vulnerabilities found per test have increased to 21 compared with 19 in 2007, showing that IT security managers now have more issues to contend with. The types of risk giving organisations the greatest headache are service specific vulnerabilities and these types of security issues accounted for 60% of all risks identified.

The report analyses data gathered from external Internet vulnerability tests conducted by NTA on UK organisations in a wide range of industry sectors, including finance, government, retail, IT, charities and law.

Overall, the indication is that organisations are becoming more successful at avoiding critical vulnerabilities, with only 25% of companies tested containing one or more high risk vulnerabilities - which are widely known and actively exploited by hackers - compared to 32% in 2007.

Whilst improvements in high risk security issues have been achieved, individual sectors have not performed so well. Finance, government, legal, retail and utilities sectors have all seen an increase in the number of overall vulnerabilities found. In particular, the average number of risks per test for financial institutions has increased to 20 compared with 19 in 2007, whilst the retail sector has seen an increase from 16 to 21 over the last year.

Of the 10 most commonly occurring critical vulnerabilities, seven were found in last year’s report, indicating that these same issues continue to take their toll. All of the top 10 high risk flaws are associated with services that are being made available to Internet users, demonstrating that with increased functionality comes the threat of reduced security.

Roy Hills, Technical Director at NTA says: “The presence of high risk vulnerabilities may allow an attacker to cause a buffer overflow on a server, resulting in malicious code being executed. A hacker could also gain entry to the corporate network and change users’ passwords or delete files, which could wreak corporate havoc. These high risk vulnerabilities are widely known and actively exploited by hackers, leaving many companies susceptible to attack.”

NTA Monitor recommends that companies apply the following recommendations to raise awareness and minimise their exposure to IT security risks:

• Stay up to date on the latest vulnerabilities and apply patches and updates as soon as they become available
• Allocate sufficient management time, focus and control to ensure that preventative actions are carried out on an ongoing basis
• Involve and educate staff on Internet security issues
• Have a clear and up to date security policy. Publicise and update it regularly


A copy of the full report contains further recommendations and not only looks at the different types of vulnerabilities found in organisations, but also examines how a range of industry sectors fair against the average findings. It is available from NTA by emailing marketing@nta-monitor.com

-ends-

About NTA Monitor

NTA Monitor, www.nta-monitor.com, is a market leading, innovative Internet security testing, auditing and consultancy company that helps to protect its 500+ customers from loss of revenue and reputation.

The company provides a range of security services including vulnerability testing, web application testing, wireless infrastructure testing, BlackBerry and laptop security testing, IT risk assessments, security policy and procedure reviews and network architecture auditing in order to help prevent unauthorised access to organisation’s networks and data. NTA regularly finds new vulnerabilities through its test projects and research and development programmes.

NTA is a founder member of the CESG 'CHECK' scheme and the newly-founded CREST (Council for Registered Ethical Security Testers). NTA is also an Approved Scanning Vendor (ASV) under the Payment Card Industry Data Security Standard (PCI DSS).

For further information, please contact:
Jacqui Delbaere
Delbaere Public Relations
Email: jacqui@delbaere.fsbusiness.co.uk
Tel: 0207 787 6218/ 07981 504468

Elaine Calvert
Email: elaine.calvert1@talktalk.net
Tel: 07764 614113