Global Organisations Unaware Of Their Online Risk Exposure

KPMG New Zealand

Media Release

Global Organisations Unaware Of Their Online Risk Exposure

Philip Whitmore – KPMG head of Security Advisory Services

Many global organisations can do a lot more to protect their private data and reduce exposure to attacks by hackers, according to KPMG. Calling on organisations to arm themselves better so they can withstand online threats, KPMG’s observation comes as they publish their ‘Cyber Vulnerability Index’ – a first-of-its-kind report assessing how businesses are leaking data that exposes them to cyber attacks.

As part of the research, over a six month period KPMG’s Security Advisory Services team simulated the initial steps would-be cyber attackers might undertake against the Forbes 2000 list of global companies. All the research was conducted using public domain data without breaching security.

Among the key headlines coming from the Cyber Vulnerability Index is the news that websites of over three-quarters (78 per cent) of organisations in the Forbes 2000 are leaking data, potentially creating opportunities for cyber attackers.

Other key findings include:

• 71% of the Forbes 2000 companies may be using potentially vulnerable and out-dated versions of Microsoft and Adobe software

• Technology and software sectors are most likely to disclose information in metadata in posts to online forums and newsgroups

• 16 per cent of companies may be vulnerable to attack due to poor patching or the use of out-of-date server software on their websites.

Reduce your company’s exposure

Based on the research it is clear that companies should do more to cleanse the amount of data they leak on the Internet and should spring clean their public facing documents of metadata. Philip Whitmore, KPMG New Zealand’s Security Advisory Services Director comments: “The profile of attackers has been changing over the last couple of years. Today’s cyber attacker is more likely to be a social activist with an axe to grind, rather than financially motivated. More troubling still has been the perceived rise of state-sponsored hackers who enjoy the luxury of time and seemingly unlimited resources.”

“Attackers are aiming to gain better access to greater intellectual property. While it’s difficult to stop these types of people, companies can, at the very least, deny them open access to their secrets which unwittingly, they may have laid bare.”

“Our findings send out a clear message to business – while the Internet may be your window to the world – it can also create a substantial security risk as well.”

Tech and software sectors: at risk

It is the technology and software sectors which are most likely to leave their information exposed in relation to metadata (information about a document or information on its properties) in documents they post to online forums and newsgroups – more than all the other sectors combined. For example, within these sectors, the research uncovered 419,430 possible usernames spread across the 2,000 sites.

Heat map of the world: countries most at risk

The research found that information disclosure was not confined to just one country or region of the world. Switzerland (40 per cent), Japan (22 per cent) and Spain (9 per cent) were the top three countries who were most open to attack via vulnerable web server software. In Japan, the banking sector was found to expose the most information that could be useful to cyber attackers. While emerging markets, such as Brazil, China, Thailand and Saudi Arabia, are also at risk.

Patching is still an issue

The research team also found that 16 per cent of companies may be vulnerable to attack due to poor patching or the use of out of date server software. Indeed, the utilities sector was identified as being the most vulnerable sector affected by issues with out of date software on their web servers. As a result, a successful attack on the website could lead to the attacker gaining control of the web server and its content.

ENDS

© Scoop Media