Calling on organisations to arm themselves better so they can withstand online threats, KPMG’s observation comes as the consultancy publishes its Cyber Vulnerability Index – a first-of-its-kind report assessing how businesses are leaking data that exposes them to cyber attacks.
As part of the research, over a six-month period KPMG’s Cyber Response Team simulated the initial steps would-be cyber attackers might undertake against the Forbes 2000 list of global companies. All the research was conducted using public domain data without breaching security.
Among the key headlines coming from the Cyber Vulnerability Index is the news that the websites of over 78% of those organisations in the Forbes 2000 are leaking data, potentially creating opportunities for cyber attackers. However, the UK stood out as a country that’s relatively well protected compared to its international counterparts (not even featuring in the Top 10 most vulnerable countries).
In addition, it emerges that the technology and software sectors are most likely to disclose information in metadata in posts to online forums and newsgroups, while 16% of companies may be vulnerable to attack due to poor patching or the use of out-of-date server software on their websites.
Reduce your company’s exposure
Based on the research it’s clear that companies should do more to cleanse the amount of data they leak on the Internet and should ‘spring clean’ their public-facing documents of metadata.
Martin Jordan, KPMG’s director of information protection, explained: “The world of cyber security has been tilted on its axis over the past two years, from the actions of hacktivists and associated groups through to state-sponsored agencies with seemingly unlimited resources.”
Jordan added: “Attackers are aiming for an increased competitive edge or to gain better access to greater intellectual property – whatever their level of sophistication. While it’s difficult to stop these groups, companies can – at the very least – deny them ‘open all areas’ access to their secrets which, unwittingly, they may have laid bare.”
He also commented: “Our findings send out a clear message to businesses – while the Internet may be your shop window to the world, it can also be a substantial security risk as well.”
Tech and software sectors: at risk
It’s the technology and software sectors which are most likely to leave their information exposed in relation to metadata (information about a document or information on its properties) in documents they post to online forums and newsgroups – more than all the other sectors combined.
For example, within these sectors the research uncovered 419,430 possible usernames spread across the 2,000 sites.
Heat map of the world: countries most at risk
The research found that information disclosure was not confined to just one country or region of the world. Switzerland (40%), Japan (22%) and Spain (9%) were the top three countries who were most open to attack via vulnerable web server software.
In Japan, the banking sector was found to expose the most information that could be useful to cyber attackers while emerging markets (such as Brazil, China, Thailand and Saudi Arabia) are also at risk.
Patching is still an issue
The KPMG research team also found that 16% of companies may be vulnerable to attack due to poor patching or the use of out-of-date server software.
Indeed, the utilities sector was identified as being the most vulnerable sector affected by issues with out of date software on their web servers.
As a result, a successful attack on the website could lead to the attacker gaining control of the web server and its content.