IT managers nervous about taking last minute summer holidays need not fear, most hackers planning corporate hacking are storing up their efforts for Christmas and New Year’s Eve.
Security lifecycle management player Tufin Technologies conducted a survey amongst 79 hackers at the annual gathering of hackers at Defcon 17 in Las Vegas earlier this month.
Eighty nine percent of hackers admitted that IT professionals taking a summer vacation would have little impact on their hacking activities, as a whopping 81pc revealed they are far more active during the winter holidays with 56pc citing Christmas as the best time to engage in corporate hacking and 25pc naming New Years Eve.
“It’s received knowledge in the security world that the Christmas and New Year season are popular with hackers targeting western countries,” said Michael Hamelin, chief security architect, Tufin Technologies.
“Hackers know this is when people relax and let their hair down, and many organisations run on a skeleton staff over the holiday period.”
If you want to know when you should be most on your guard it’s during weekday evenings with 52pc stating that this is when they spend most of their time hacking, 32pc during work hours (weekdays), and just 15pc hacking on weekends.
Ninety six percent of hackers in the survey said it doesn’t matter how many millions a company spends on its IT security systems, it’s all a waste of time and money if the IT security administrators fail to configure and watch over their firewalls.
Eighty six percent of respondents’ felt they could successfully hack into a network via the firewall; a quarter believed they could do so within minutes, 14pc within a few hours. Sixteen percent wouldn’t hack into a firewall even if they could.
“This may be stating the obvious,” said Hamelin, “but poorly configured firewalls remain a significant risk for many organizations. It’s not the technology that’s at fault, but rather the configuration and change control processes that are neglected or missing altogether. Best practice suggests you should test and review your firewall configuration regularly, but many organisations fail to do so.”
Validating the frustrating gap between compliance and security, seventy percent of the hackers interviewed don’t feel that regulations introduced by governments worldwide to implement privacy, security and process controls has made any difference to their chances of hacking into a corporate network.
Of the remaining 30pc, 15pc said compliance initiatives have made hacking more difficult and 15pc believe they’ve made it easier.
“These results further validate the reality that there is little common ground between compliance and security, but as an industry we have the collective knowledge and the resources to change that,” said Hamelin.
“As the media constantly reminds us, while standards such as PCI-DSS provide a good baseline, organizations that assume achieving PCI compliance will solve their security woes are in for a rude awakening.
!With security and compliance budgets so deeply intertwined, it serves us as security professionals to make the two more synonymous. At the end of the day, the more accountable we are willing to be, the less we’ll have to be.”
With the Network Solutions breach being the latest in a series of widely reported breaches of PCI compliant companies, how big is the threat of a high-profile malicious hack? One important factor in determining that is to understand the scope of criminal activity.
Seventy percent of those sampled believe the number of malicious hackers – criminals motivated by economic gain– is less then 25pc of the of hacker community.
“This survey highlights the fact cyber security investments are only as effective as the people, processes and technology tasked with managing them,” said Hamelin.
“Just as a small subset of criminal hackers can taint the reputation of an entire community, a few good guys willing to be accountable for their internal processes and technology can preserve a company’s reputation.
With winter right around the corner, we have time to shift the dynamic from 86pc who can hack into a network through its firewalls to 86pc that can’t,” Hamelin said.
By John Kennedy
