Industries on the cyber war front line

ThreatTrack Security published a study that looks at the security vulnerabilities of two industries most often targeted by cybercrime: energy and financial services.

72% of respondents from these industries are confident that their organization will be the target of an APT, targeted malware attack or other sophisticated cybercrime or cyber-espionage tactic in the next 12 months, with 38% saying an attack is either a “certainty” or “highly likely.”

Both the energy and financial services sectors are under constant pressure from attackers due to the high-value assets they hold, which represents a significant risk to the U.S. economy and critical physical infrastructure.

According to the U.S. Department of Homeland Security, the highest percentage (more than half) of incidents reported to its Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) occurred in the energy industry. Similarly, in January of this year, the Financial Industry Regulatory Authority (FINRA) released a letter warning of increasing frequency and sophistication of attacks against financial services firms.

An independent blind survey of 200 IT security managers or IT security administrators in energy and financial services organizations (100 in each) was conducted by Opinion Matters on behalf of ThreatTrack Security in April 2014. There are a wide range of threat actors and attack vectors targeting these two industries, and ThreatTrack Security’s report investigates the challenges these organizations face in defending themselves, and what they plan to do to increase security.

Among the key findings of the survey:

• 34% of respondents say their endpoints have been infected in the last 12 months by malware that evaded detection by traditional signature-based defenses such as antivirus, email security or firewalls.
• 70% of respondents from companies with security budgets between $500,000 and $1 million had been infected at least once.
• 61% of energy firms say email is the biggest threat vector for malware, while 42% of financial services firms say it is the web (closely followed by 39% who indicate email as well)
• Only 3% of respondents say mobile is the biggest threat vector they are facing, indicating that many energy and financial services firms may be overlooking a growing source of malware delivery.
• The biggest perceived threat to energy firms is hacktivists and the number one threat to financial services companies is organized cybercrime syndicates.
• 12% of energy firms fear attacks from foreign governments.
• Less than 10% of energy firms or financial services companies fear the insider threat.
• 38% of respondents say it is either a “certainty” or “highly likely” that their organization will be the target of an APT or targeted malware attack in the next 12 months. Another 35% say it is “somewhat likely.” This means 72% of these organizations expect an attack in the near future.
• A higher percentage of energy firms (44%) say an attack is “a certainty” or “highly likely” than their financial services counterparts (31%).
• Half of all organizations (50%) surveyed say they plan to train existing IT staff on new technologies and cybersecurity strategies. 35% will implement new policies such as limiting network access privileges and educating employees. 34% will invest in advanced malware detection technology.

“Given the importance and value of the data that energy and financial services firms have access to, it is no surprise that they are being targeted aggressively by hackers,” said Julian Waits, Sr., president and CEO of ThreatTrack Security. “The question is, what can these organizations do to better stabilize their cyber defenses, in both their own self-interest, and to protect critical U.S. infrastructure? It’s good to see these firms are planning to train their IT teams on the latest cybersecurity technologies and strategies, and that they are going to invest in advanced malware detection. The time to act is now, or the next big data breach could be one that doesn’t just affect our wallets.”