News Feed Item

Protiviti Cybersecurity Lab Tests and Analysis Reveal Companies' IT Systems Still Vulnerable to Exploits and Digital Treachery

Analysis of testing data in U.S. labs finds almost half of organizations' vulnerabilities have publicly available exploit code

MENLO PARK, Calif., April 16, 2018 /PRNewswire/ -- A new report released today by global consulting firm Protiviti shares the most common digital threats challenging companies today. The report is based on in-depth analyses of vulnerability scans and tests of IT systems and infrastructure at over 500 organizations. The scans and tests were conducted in the firm's cybersecurity labs across the U.S. over the course of a nine-year period. For the study, Protiviti compiled, assessed and quantified the anonymous vulnerability and threat discoveries in the data, which reveals trends in vulnerabilities, exposures and security posture by industry and company size. The Protiviti study, presented in its "2018 Security Threat Report," provides a roadmap for organizations to improve their overall security posture.

Protiviti logo. (PRNewsFoto/Protiviti)

"Our hope is that companies will see the results of our study as a wake-up call to the potential vulnerability of their own IT systems and then proactively make the necessary changes to protect the confidentiality, integrity and availability of the key business processes supported by IT operations, as well their sensitive data 'crown jewels,'" said Scott Laliberte, managing director and global security and privacy practice leader at Protiviti.

The firm's analysis of its wealth of testing data from nearly a decade's worth of security scans reveals several key takeaways, including:  

  • Vulnerabilities that can be easily patched are not being fixed in a timely manner, particularly within applications
  • Organizations are still running a significant number of unsupported systems, greatly increasing the risk for breaches
  • There have been consistent challenges with SSL, especially with weak ciphers and diversions
  • Every few years, a major critical exploit comes along that has a dramatic impact on the security landscape (e.g. Heartbleed, Shellshock)
  • Just under half of the vulnerabilities identified during testing have publicly available exploit code (as of the time of testing)
  • Companies in the consumer products; financial services; healthcare and life sciences; technology, media and telecommunications; manufacturing; and energy industries are the most vulnerable

"Most of the issues we identified in our assessment can be easily rectified by taking a proactive and programmatic approach to cybersecurity," said Laliberte. "By evaluating security posture on a periodic basis and implementing changes to update IT procedures, companies can significantly lower the risks associated with potential security breaches and attacks. Unfortunately, as the threat landscape has become more perilous, it's only a matter of 'when' your organization will get targeted, so we can't overstate the importance of implementing continuous improvement within your security program immediately."

Based on the security scans and analysis, Protiviti has identified five basic security principles that organizations should implement now to reduce the risk of a breach:

  1. Maintain strong permission and user access controls: By periodically checking networks and default permissions/credentials, organizations can reduce the likelihood of a hacker gaining easy access to a network.
  2. Provide employee security awareness: Inform employees of the latest security threats and social engineering techniques, how they can protect themselves, and what the organization is doing to mitigate these risks.
  3. Implement a patch management program: Organizations should use automated tools to both identify and apply patches within network devices, operating systems and applications. For systems that cannot be upgraded or patched, compensating controls (e.g., VLAN's or firewalls) should be implemented to protect the rest of the network.
  4. Ensure strong system configuration management: Be sure to look into areas such as password and audit policies, services, and file permissions, as these should be controlled through the configuration management process.
  5. Conduct periodic penetration testing: Penetration testing and ongoing vulnerability management across various pieces of IT infrastructure can help organizations identify security vulnerabilities and stay up-to-date with the latest tricks and techniques attackers are using.

"In addition to data breach preventative measures, organizations and their third-party providers must work on maturing detective controls and response procedures," said Andrew Retrum, a managing director in Protiviti's security and privacy practice. "Activities that simulate common attack patterns should be carried out to determine whether the organization's defenses can detect and respond effectively in real-world situations."

Protiviti compiled the anonymous, aggregated data, and analysis and trends that are presented in the new report by reviewing in-depth security vulnerability scans of IT systems on behalf of more than 500 organizations in a broad range of industries. From 2009 to 2017, Protiviti's security experts were engaged by these organizations to scan their networks, detect vulnerabilities and help fix issues and establish proper mechanisms for monitoring and prevention. The resulting 47-page report is designed to be a practical resource for CIOs and CISOs, while also revealing the issues and challenges that senior management and boards of directors will want to monitor to help safeguard their companies' data and reputations.

Resources Available
The full report of Protiviti's study, along with an infographic and short video, is available for complimentary download at www.protiviti.com/threatreport. Copies of the report are also available at Protiviti's booth #4912 at the RSA security conference in San Francisco (April 16-19, 2018).

An archived Protiviti webinar exploring the security scans' key vulnerability and threat discoveries is also available for free here.

About Protiviti
Protiviti (www.protiviti.com) is a global consulting firm that delivers deep expertise, objective insights, a tailored approach and unparalleled collaboration to help leaders confidently face the future. Through its network of more than 70 offices in over 20 countries, Protiviti and its independently owned Member Firms provide clients with consulting solutions in finance, technology, operations, data, analytics, governance, risk and internal audit.

Named to the 2018 Fortune 100 Best Companies to Work For® list, Protiviti has served more than 60 percent of Fortune 1000® and 35 percent of Fortune Global 500® companies. The firm also works with smaller, growing companies, including those looking to go public, as well as with government agencies. Protiviti is a wholly owned subsidiary of Robert Half (NYSE: RHI). Founded in 1948, Robert Half is a member of the S&P 500 index.

Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer attestation services.

Editor's Note: photos and infographic available upon request.


Cision View original content with multimedia:http://www.prnewswire.com/news-releases/protiviti-cybersecurity-lab-tests-and-analysis-reveal-companies-it-systems-still-vulnerable-to-exploits-and-digital-treachery-300630128.html

SOURCE Protiviti

More Stories By PR Newswire

Copyright © 2007 PR Newswire. All rights reserved. Republication or redistribution of PRNewswire content is expressly prohibited without the prior written consent of PRNewswire. PRNewswire shall not be liable for any errors or delays in the content, or for any actions taken in reliance thereon.

Latest Stories
DXWorldEXPO LLC announced today that Dez Blanchfield joined the faculty of CloudEXPO's "10-Year Anniversary Event" which will take place on November 11-13, 2018 in New York City. Dez is a strategic leader in business and digital transformation with 25 years of experience in the IT and telecommunications industries developing strategies and implementing business initiatives. He has a breadth of expertise spanning technologies such as cloud computing, big data and analytics, cognitive computing, m...
22nd International Cloud Expo, taking place June 5-7, 2018, at the Javits Center in New York City, NY, and co-located with the 1st DXWorld Expo will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud ...
As DevOps methodologies expand their reach across the enterprise, organizations face the daunting challenge of adapting related cloud strategies to ensure optimal alignment, from managing complexity to ensuring proper governance. How can culture, automation, legacy apps and even budget be reexamined to enable this ongoing shift within the modern software factory?
In past @ThingsExpo presentations, Joseph di Paolantonio has explored how various Internet of Things (IoT) and data management and analytics (DMA) solution spaces will come together as sensor analytics ecosystems. This year, in his session at @ThingsExpo, Joseph di Paolantonio from DataArchon, added the numerous Transportation areas, from autonomous vehicles to “Uber for containers.” While IoT data in any one area of Transportation will have a huge impact in that area, combining sensor analytic...
Bill Schmarzo, author of "Big Data: Understanding How Data Powers Big Business" and "Big Data MBA: Driving Business Strategies with Data Science," is responsible for setting the strategy and defining the Big Data service offerings and capabilities for EMC Global Services Big Data Practice. As the CTO for the Big Data Practice, he is responsible for working with organizations to help them identify where and how to start their big data journeys. He's written several white papers, is an avid blogge...
Charles Araujo is an industry analyst, internationally recognized authority on the Digital Enterprise and author of The Quantum Age of IT: Why Everything You Know About IT is About to Change. As Principal Analyst with Intellyx, he writes, speaks and advises organizations on how to navigate through this time of disruption. He is also the founder of The Institute for Digital Transformation and a sought after keynote speaker. He has been a regular contributor to both InformationWeek and CIO Insight...
Michael Maximilien, better known as max or Dr. Max, is a computer scientist with IBM. At IBM Research Triangle Park, he was a principal engineer for the worldwide industry point-of-sale standard: JavaPOS. At IBM Research, some highlights include pioneering research on semantic Web services, mashups, and cloud computing, and platform-as-a-service. He joined the IBM Cloud Labs in 2014 and works closely with Pivotal Inc., to help make the Cloud Found the best PaaS.
It is of utmost importance for the future success of WebRTC to ensure that interoperability is operational between web browsers and any WebRTC-compliant client. To be guaranteed as operational and effective, interoperability must be tested extensively by establishing WebRTC data and media connections between different web browsers running on different devices and operating systems. In his session at WebRTC Summit at @ThingsExpo, Dr. Alex Gouaillard, CEO and Founder of CoSMo Software, presented ...
@DevOpsSummit at Cloud Expo, taking place November 12-13 in New York City, NY, is co-located with 22nd international CloudEXPO | first international DXWorldEXPO and will feature technical sessions from a rock star conference faculty and the leading industry players in the world.
One of the biggest challenges with adopting a DevOps mentality is: new applications are easily adapted to cloud-native, microservice-based, or containerized architectures - they can be built for them - but old applications need complex refactoring. On the other hand, these new technologies can require relearning or adapting new, oftentimes more complex, methodologies and tools to be ready for production. In his general session at @DevOpsSummit at 20th Cloud Expo, Chris Brown, Solutions Marketi...
In a world where the internet rules all, where 94% of business buyers conduct online research, and where e-commerce sales are poised to fall between $427 billion and $443 billion by the end of this year, we think it's safe to say that your website is a vital part of your business strategy. Whether you're a B2B company, a local business, or an e-commerce site, digital presence is key to maintain in your drive towards success. Digital Performance will take priority in 2018 for the following reason...
At the keynote this morning we spoke about the value proposition of Nutanix, of having a DevOps culture and a mindset, and the business outcomes of achieving agility and scale, which everybody here is trying to accomplish," noted Mark Lavi, DevOps Solution Architect at Nutanix, in this SYS-CON.tv interview at @DevOpsSummit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
I think DevOps is now a rambunctious teenager - it's starting to get a mind of its own, wanting to get its own things but it still needs some adult supervision," explained Thomas Hooker, VP of marketing at CollabNet, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
What's the role of an IT self-service portal when you get to continuous delivery and Infrastructure as Code? This general session showed how to create the continuous delivery culture and eight accelerators for leading the change. Don Demcsak is a DevOps and Cloud Native Modernization Principal for Dell EMC based out of New Jersey. He is a former, long time, Microsoft Most Valuable Professional, specializing in building and architecting Application Delivery Pipelines for hybrid legacy, and cloud ...
In this presentation, you will learn first hand what works and what doesn't while architecting and deploying OpenStack. Some of the topics will include:- best practices for creating repeatable deployments of OpenStack- multi-site considerations- how to customize OpenStack to integrate with your existing systems and security best practices.