Also read and respond to: THE LANDMINE OF P2P FILE-SHARING
Threats posed by zero-day vulnerabilities were ranked by global IT decision makers as their topmost security concern, according to a recent survey by security firm PatchLink.
Fifty-three per cent of respondents put zero day vulnerabilities as the No. 1 security concern, followed by hackers, cited by 35 per cent, and malware and spyware with 34 per cent. PatchLink surveyed 250 of its customers worldwide in June 2007, including CIOs, CSOs, IT directors and managers.
“The prospect of zero-day attacks is extremely troubling for organizations,” said Charles Kolodgy, research director for security products at IDC in Framingham, Mass. “Today’s financially motivated attackers are creating customized, sophisticated malware designed to exploit unpublished application vulnerabilities in specific applications before they can be fixed.”
Many IT departments are spread thin and lack the resources to proactively defend against zero-day threats, and attackers are using this to their advantage, said Kolodgy.
Hackers are also counting on the human element part of the security equation to help them accomplish their attacks, Kolodgy added.
“User behaviour is difficult to control, and many hackers rely on users’ lapses in judgment to carry out their malicious activity,” the IDC analyst said.
Controlling user behaviour was cited by 32 per cent of IT executives as the primary challenge to vulnerability management.
PatchLink also asked IT executives to rank the application that they are most concerned about protecting, and Internet Explorer landed on top cited by 83 per cent of the respondents.
Various Internet security threat reports earlier indicated an increasing trend in attacks targeted towards Web browsers and Web applications, serving as an avenue to gain access to corporate networks.
“Those vulnerabilities are often used in ‘gateway’ attacks, in which an initial exploitation takes place not to breach data immediately, but to establish a foothold from which subsequent, more malicious attacks can be launched,” according to Symantec’s latest Internet Security Threat Report.
If successful, vulnerabilities in Web browsers and Web applications can enable an attacker to install malware and subsequently gain control of a compromised system.
icon.
