There’s much concern in the industry about the cloud being a major security risk, but a recent survey at the Black Hat 2015 Conference found that it’s really endpoints that experts think are most susceptible to intrusion or attack.
Bromium Inc., a security firm using isolation technology to prevent network breaches, surveyed more than 100 IT security professionals at the annual conference and found that they’re most worried about threats reaching the network from the outside in, with the endpoint the source of greatest risk.
Fifty-five percent of those surveyed felt this way about the endpoint, but others felt the greatest security risks were elsewhere. Twenty-seven percent of those surveyed said insider threats posed the greatest risk, while 9 percent each said the network and the cloud had this honor.
“One reason that the endpoint is the source of the greatest security risk is because of how difficult it is to balance security and productivity,” said Clinton Karr, senior security strategist at Bromium, in a press release.
He used Flash—an application that security professionals widely disparage—as an example, saying that 90 percent or more organizations would be more secure if they disabled this endpoint application. However, 41 percent believe they would be less productive, so the applications remains a security risk, Karr said.
“Traditional security solutions have proven ineffective at mitigating this dilemma, putting our critical infrastructure at significant risk,” he said.
The report also had some other sobering findings about the general state of security in the enterprise. One is that the majority of organizations find that implementing security patches is a challenge, so they can sometimes be slow to do it.
The majority of organizations said they implement patches quickly for zero-day vulnerabilities in software such as Flash and Internet browsers in the first week—with 50 percent doing it within this time and a speedy 10 percent doing it on the first day. However, 22 percent of those surveyed said they can take more than a month to deploy the same types of patches for other programs, which gives malware ample time to do its work.
Those surveyed also had opinions about which industries—particularly those in charge of critical infrastructure—are most at risk for cyber attack. Financial services—which actually was lauded by 60 percent of organizations as having the best security practices—topped the list of verticals at risk, with 30 percent of respondents citing it as being in particular danger for cyberattacks. The energy industry and health care tied for second among those surveyed, with 17 percent each thinking these industries are high risk. Meanwhile, 12 percent of those surveyed said the government was most likely to be hit with a cyberattack.