In the “Year of the Hack,” Survey Reveals Enterprises Are Most Concerned About “Advanced Persistent Threat” Attacks by Wide Margin

In a year that IT security experts have labeled the “Year of the Hack,” Bit9’s Third Annual Endpoint Survey of 765 IT executives revealed that Advanced Persistent Threat (APT) attacks -- like the one that infiltrated RSA, a division of EMC, and defense contractors this year – are of most concern to IT and security professionals.

However, despite the concerns about APT attacks, the survey also showed that executives are not doing enough to protect against unauthorized software and malware from infecting their desktops, laptops and servers.

Sixty percent of the respondents said they are concerned about APT attacks, more than double the next closest response, showing the growing anxiety among IT executives around modern threats. The second biggest hacking concern among IT executives, at 28 percent, is having one of their own employees steal company data and post it online, much like what happened at the Department of Defense (DoD) with WikiLeaks. In third place, at 26 percent, are concerns around a vendor partner being hacked, much like what happened to Epsilon earlier this year. And in fourth place, at 25 percent, are concerns over a cloud application breach, much like what happened with Sony.

The Third Annual Endpoint Survey from Bit9 Inc., the market leader in adaptive application whitelisting, provides insight from IT and security professionals in technology/software, government and defense, financial services/banking, and retail. The survey is designed to gauge endpoint security issues, employee behaviors and topline concerns that enterprise professionals grapple with every day.

While worry remains high around cyber security breaches, the survey also showed a surprising 60 percent of the IT executives use either a written policy based on an “honor system,” or have an open software environment without a security policy in place. However, risky behavior doesn’t stop there. A narrow majority of companies surveyed (51 percent) said they allow their employees to download and install software.

The companies that allow employees to download software often find digital music sites like iTunes, social media sites and instant messaging software on its endpoints. Additionally, almost 80 percent of companies allow employees to use removable storage devices, exposing companies to the loss of sensitive data and intellectual property while increasing exposure to malware.

“Breaches that occurred in the first half of 2011 have changed the rules of security by exposing high profile companies like RSA, Sony, Lockheed Martin and numerous others,” said Tom Murphy, chief strategy officer, Bit9. “Our data finds that companies are increasingly worried about advanced persistent threat attacks, but they continue to engage in risky behaviors. Companies are gambling on a losing game by failing to put security policies in place. It’s not a case of if a breach will occur, but when and how severe.”

Additional findings from the survey include:

• Companies continue to allow employees to engage in risky behaviors: IT executives have become even more hands-off in their software usage policy over the past three years, with 51 percent of respondents admitting that users have full rights to download and install applications. These relaxed download policies have increased 12 percent from 2010 when 39 percent said they did not have a policy that prohibits employee downloads. That figure increased by 22 percent from 2009 figures. Additionally, nearly 30 percent of IT executives allow the use of personal mobile devices at work that connect to the company Intranet.
• Endpoint security failures can take down networks: While the majority said they have not experienced network outages due to unauthorized software or malware, almost 20 percent of IT executives admit that unusual software found on the endpoint has resulted in crashing the company’s networks. These crashes meant lost productivity. Of those who experienced downtime, 30 percent said the crashes took down their network for three to six hours and 89 percent said the crashes lasted two hours or less.
• Successful breach of company’s inbox stirs emotions: More than a quarter of IT executives would be mildly embarrassed by a breach exposing their company’s inbox, while more than half admitted to being mortified. Most noteworthy is that seven percent claim that their company would be out of business if such a breach would occur.

For more information on the survey, and to view the full results, please visit www.bit9.com/Bit9-Endpoint-Security-Survey-2011.

NOTES

2010 Release

http://www.bit9.com/company/news-release-details.php?id=158

2009 Release

http://www.bit9.com/company/news-release-details.php?id=113

About Bit9

Bit9 is the market leader in adaptive application whitelisting. The company's award-winning endpoint protection solutions provide total visibility and control over all software on endpoints, eliminating the risk caused by malicious, illegal and unauthorized software. Bit9 specializes in protecting organizations against Advanced Persistent Threat attacks.

Bit9 leverages the Bit9 Global Software Registry™ – the world's largest database of software intelligence – to identify and classify software, delivering the highest levels of endpoint security, compliance, and manageability. Bit9's dynamic application whitelisting technology makes it simple to deploy application whitelisting in the largest of organizations. The company's global customers come from a wide variety of industries, such as government, financial services, retail, healthcare, e-commerce and education.

Bit9 is privately held and based in Waltham, Massachusetts. For more information, visit http://www.bit9.com or call +1 617.393.7400.