Protiviti Cybersecurity Lab Tests and Analysis Reveal Companies’ IT Systems Still Vulnerable to Exploits and Digital Treachery

Analysis of testing data in U.S. labs finds almost half of organisations’ vulnerabilities have publicly available exploit code

MENLO PARK, CA – April 16, 2018 – A new report released today by global consulting firm Protiviti shares the most common digital threats challenging companies today. The report is based on in-depth analyses of vulnerability scans and tests of IT systems and infrastructure at over 500 organisations. The scans and tests were conducted in the firm’s cybersecurity labs across the U.S. over the course of a nine-year period. For the study, Protiviti compiled, assessed and quantified the anonymous vulnerability and threat discoveries in the data, which reveals trends in vulnerabilities, exposures and security posture by industry and company size. The Protiviti study, presented in its “2018 Security Threat Report,” provides a roadmap for organisations to improve their overall security posture.

“Our hope is that companies will see the results of our study as a wake-up call to the potential vulnerability of their own IT systems and then proactively make the necessary changes to protect the confidentiality, integrity and availability of the key business processes supported by IT operations, as well their sensitive data ‘crown jewels,’” said Scott Laliberte, managing director and global security and privacy practice leader at Protiviti.

The firm’s analysis of its wealth of testing data from nearly a decade’s worth of security scans reveals several key takeaways, including:

• Vulnerabilities that can be easily patched are not being fixed in a timely manner, particularly within applications
• Organisations are still running a significant number of unsupported systems, greatly increasing the risk for breaches
• There have been consistent challenges with SSL, especially with weak ciphers and diversions
• Every few years, a major critical exploit comes along that has a dramatic impact on the security landscape (e.g. Heartbleed, Shellshock)
• Just under half of the vulnerabilities identified during testing have publicly available exploit code (as of the time of testing)
• Companies in the consumer products; financial services; healthcare and life sciences; technology, media and telecommunications; manufacturing; and energy industries are the most vulnerable

“Most of the issues we identified in our assessment can be easily rectified by taking a proactive and programmatic approach to cybersecurity,” said Laliberte. “By evaluating security posture on a periodic basis and implementing changes to update IT procedures, companies can significantly lower the risks associated with potential security breaches and attacks. Unfortunately, as the threat landscape has become more perilous, it’s only a matter of ‘when’ your organisation will get targeted, so we can’t overstate the importance of implementing continuous improvement within your security programme immediately.”

Based on the security scans and analysis, Protiviti has identified five basic security principles that organisations should implement now to reduce the risk of a breach:

1. Maintain strong permission and user access controls: By periodically checking networks and default permissions/credentials, organisations can reduce the likelihood of a hacker gaining easy access to a network.
2. Provide employee security awareness: Inform employees of the latest security threats and social engineering techniques, how they can protect themselves, and what the organisation is doing to mitigate these risks.
3. Implement a patch management programme: Organisations should use automated tools to both identify and apply patches within network devices, operating systems and applications. For systems that cannot be upgraded or patched, compensating controls (e.g., VLAN’s or firewalls) should be implemented to protect the rest of the network.
4. Ensure strong system configuration management: Be sure to look into areas such as password and audit policies, services, and file permissions, as these should be controlled through the configuration management process.
5. Conduct periodic penetration testing: Penetration testing and ongoing vulnerability management across various pieces of IT infrastructure can help organisations identify security vulnerabilities and stay up-to-date with the latest tricks and techniques attackers are using.

“In addition to data breach preventative measures, organisations and their third-party providers must work on maturing detective controls and response procedures,” said Andrew Retrum, a managing director in Protiviti’s security and privacy practice. “Activities that simulate common attack patterns should be carried out to determine whether the organisation’s defenses can detect and respond effectively in real-world situations.”

Methodology

Protiviti compiled the anonymous, aggregated data, and analysis and trends that are presented in the new report by reviewing in-depth security vulnerability scans of IT systems on behalf of more than 500 organisations in a broad range of industries. From 2009 to 2017, Protiviti’s security experts were engaged by these organisations to scan their networks, detect vulnerabilities and help fix issues and establish proper mechanisms for monitoring and prevention. The resulting 47-page report is designed to be a practical resource for CIOs and CISOs, while also revealing the issues and challenges that senior management and boards of directors will want to monitor to help safeguard their companies’ data and reputations.

Resources Available

The full report of Protiviti’s study, along with an infographic and short video, is available for complimentary download at www.protiviti.com/threatreport. Copies of the report are also available at Protiviti’s booth #4912 at the RSA security conference in San Francisco (April 16-19, 2018).