Highlights

• Only six percent of respondents think there is no chance that their networks or applications will be hacked in thecoming year. Those with an ethical hacking budget reduce the perceived chance of being hacked by nearly one-third.

• The top three benefits of ethical hacks, in order of importance, are improving overall security posture, protectingagainst theft of intellectual property and fulfilling regulatory/legislative mandates.

• A majority of IT organizations conduct ethical hacks on wireline and wireless networks, applications and operatingsystems either annually or more frequently. However, in each of these categories, between 14 and 21 percent ofrespondents never conduct ethical hacks. The main reasons for not doing so are because management does notvalue this service and they don’t have the manpower and/or skills to fix potential vulnerabilities.

• Respondents who have conducted an ethical hack in the last year have found serious vulnerabilities most often inapplications and operating systems.

• Network testing is the most important type of ethical hack for keeping information assets secure–consideredcritical by 60 percent of respondents.

• Lack of experienced staff is most often cited (by 53 percent of respondents) as a significant barrier to conductingethical hacks internally or improving ethical hacking capabilities.

• Cost is by far the most common barrier to using an ethical hacking vendor, though most respondents have usedthis service in the past.

The Bottom Line

IT networks are the vascular system of today’s businesses, providing pathways for information to flow throughout theorganization. However, when these pathways are penetrated, they also provide attackers access to those assets, as wellas the means to cripple IT systems and applications. Therefore, just as we as individuals get regular check-ups tomaintain good health, it is critical for IT organizations to regularly be testing for weaknesses in networks, systems andapplications that would allow access to information assets. Based on the results of this survey, IT security managersshould heed the following:

• Nearly all IT systems have a vulnerability that can be exploited by a hacker intent on stealing information orcausing damage. Whether this vulnerability is an unpatched application, a misconfigured router or rogue modem,unless you look, you’ll never know it’s there … not until your servers suddenly go down or proprietary informationshows up on the Internet.

• Most IT organizations will conduct ethical hacks to search for vulnerabilities at least annually, althoughapproximately one third of IT organizations wisely test wireline networks and operating systems quarterly.Although these can be done using internal resources, a third-party vendor provides a more unbiased view.

• With IT budgets tight right now, prioritize various types of ethical hacks by potential loss impact. Wireline networksand systems should be at the top of your list.

• When hiring an ethical hacking vendor, first decide whether you want to work with one vendor on an ongoingbasis, or instead rotate vendors to insure against any weaknesses a single vendor may have. Without a strategy, thecost and value of each purchase decision is left to chance.

Ethical HackingBy Rick Blum, Director, Strategic Marketing

IT Industry Survey

Introduction

Identifying vulnerabilities in networks, applications and systems before they can beexploited is a critical step in preventing exposure of sensitive data, which can severelydamage a corporation’s reputation. Smart IT organizations manage risk by conductingethical hacks on a regular basis in order to identify vulnerabilities that need remediation,thus improving their security posture.

From February 17 through March 31, 2009, BT conducted a Web-based survey on EthicalHacking, which was completed by 222 IT professionals around the globe. This survey wasdesigned to yield valuable insights into the usage of ethical hacking to improve network,systems and application security. Results of this survey are also compared, whenappropriate, to the results of two previous ethical hacking surveys conducted by BT(formerly BT INS) published in January 2005 and March 2007.

For this survey, ethical hacking, also called penetration testing, was defined as a methodfor verifying the true state of security controls for the protection of assets andinformation by simulating an attack on a network in a controlled and safe manner. Ethicalhacks are typically conducted by a third party in a manner similar to naturally occurringattacks to provide an unbiased assessment of the security of a system and the viability ofimplemented controls, although they may be conducted using internal resources. Theprimary types of ethical hacks are:

• Application testing - uncovers design and logic flaws in applications that couldresult in the compromise or unauthorized access of your networks, systems,applications or information.

• Network testing - identifies vulnerabilities in external and internal networks,services, protocols, convergence solutions and systems and devices, including VPNtechnologies.

• Code review – examines the source code that is part of the authentication systemand identifies the strengths and weaknesses of the software modules.

• Wireless network testing – determines your network's vulnerability to an attackerwith radio access to the wireless network space.

• War dialing - identifies unauthorized modems that endanger the corporate infrastructure.

• System hardening - analyzes possible configuration issues, running services, andvulnerabilities that reside on the system.

The survey was posted on the BT Professional Services Web site. Invitations to participate inthe survey were also sent to subscribers of BT’s customer newsletter. All Web survey responseswere automatically collected into a survey tool. Any questions skipped or incorrectlyanswered by survey respondents were not included in the tabulations. Not-applicableresponses were also not included in the tabulations. Each chart includes the number of validresponses for that particular question (e.g., N=100 indicates 100 responses). Percentagesshown in some charts may not sum to 100 percent due to rounding.

May 2009 BT 2

Ethical Hacking

Hacking Success

As the incidence of networks being compromised continues to make the news on an almost daily basis, it is clear thatmaking networks–and the applications that run over them–invulnerable to attack is extremely difficult. Recognizing thisreality, 94 percent of survey respondents acknowledge that there is some likelihood that their network will besuccessfully hacked in the next 12 months, about on par with expectations of respondents to the 2007 survey.

However, the steady drumbeat of networkincursions has lowered the percentage ofrespondents who believe that the chance ofbeing successfully hacked is relatively low,i.e., only 1-10 percent. In fact, only 38percent of respondents fall into thiscategory, down from 46 percent in the2007 survey and 41 percent in the 2005survey. Whether this decline is due to amore realistic view, or the recognition thatattackers are becoming more proficient, thetrend is distinctly in the wrong direction.

The silver lining to this dark cloud is thatthere is a way to reduce the likelihood ofbeing successfully hacked, and that is toconduct regular ethical hacks. This isborne out by comparing the perceptionsof respondents who have an ethicalhacking budget to those who don’t. Onaverage, the latter group believes thatthey have a 38 percent chance of theirnetworks and/or applications beinghacked in the next 12 months. However,on average, respondents with an ethicalhacking budget believe that they haveonly a 26 percent chance of being hacked.Clearly, setting aside some of the securitybudget for ethical hacking raises theperception (and in most cases the reality)of being less vulnerable to hacks.

Ethical Hacking

May 2009 BT 3

Ethical Hacking

May 2009 BT 4

Network testing, application testing, system hardening and wireless network testing have all been conducted in the lasttwo years by a high percentage (80 percent or more) of respondents’ IT organizations. Code review (70 percent) andwar dialing (59 percent) are conducted less often, though both by a significant number of IT organizations.

On the flip side, 42 percent of respondents’ IT organizations have not conducted war dialing, sometimes called modemscanning, in more than two years, and 30 percent have not conducted a code review in that same time period. Whilethe former can be time-consuming, just one unauthorized modem can jeopardize the entire network infrastructure,which makes it well worth checking on a regular basis.

To better protect their networks (wirelineand wireless), operating systems andapplications from attack, a majority ofrespondents’ IT organizations conducteach of four types of ethical hacks,although with varying degrees ofregularity. These include ethical hacks thatare conducted by the IT organization or bya third party.

Wireline networks and operating systemsare most frequently subject to ethicalhacks–approximately one-third ofrespondents on a quarterly basis, andanother 14-15 percent on a semi-annualbasis. The percentage of respondents whoconduct these hacks on a quarterly basis isup slightly from 2007, though not quiteenough to deem this uptick significant.

Applications and wireless networks don’treceive quite as much attention, with onlyabout one quarter being ethically hackedon a quarterly basis. These figures arealmost unchanged from the 2007 survey.In fact, both of these have a slightlyhigher percentage of respondents whonever conduct hacks, although, again, nota large enough difference to indicate asignificant change.

As might be expected, a much higherpercentage of respondents (54 percent) whoconduct ethical hacks quarterly on boththeir wireless and wireline networks believethat the chance of being successfully hackedin the next year is 10 percent or less thanthe percentage of respondents (21 percent)who never conduct ethical hacks on eitherof these networks.

Ethical Hacking

May 2009 BT 5

We then asked those respondents whose IT organizations never conduct ethical hacks in any one of these four categorieswhat contributes to this deficit. The most common reason (selected by 59 percent of respondents) is simply thatmanagement does not understand the value of ethical hacks and, presumably, will not allocate the time and moneyrequired to conduct them. Surprisingly, despite the extremely negative publicity that accompanies a data breach,management’s perception of the value of ethical hacking has been waning since 2005. Security professionals need toreexamine how they are presenting ethical hacking to management, perhaps with greater focus on business consequences.

The next most common reason–alsoincreasing this year compared to 2007and 2005–for not conducting ethicalhacks is that the IT organization doesn’thave the manpower and/or skills to fixvulnerabilities uncovered during the hack,which was selected by 44 percent ofrespondents. This “see no evil”justification for not conducting ethicalhacks is one that can come back to bite anorganization. Certainly, if significantvulnerabilities are found, the will would befound to fix them

Similarly, 26 percent of respondents saytheir IT organizations don’t have the fundsto fix potential vulnerabilities. Again, it’slikely that funds could be found to fixsignificant vulnerabilities. And even iffunds weren’t forthcoming, it would stillbe preferable to know the problem thanto have to plead ignorance when anattack brings down the ecommerce serverfor two days.

Many fewer respondents (13 percent) areconcerned about the safety of ethical hacks,and just four percent are worried that resultsof an ethical hack could be embarrassing.Both of these have declined significantly asissues over the last four years.

We then asked respondents who have conducted at least one ethical hack in the last year either internally or using a thirdparty to tell us for each of the four categories if the vulnerabilities they found were insignificant, moderate or serious.

Overall, wireline and wireless networks are the most secure, with 48 percent of the former and 45 percent of the latterhaving no significant vulnerabilities. An additional 45 percent and 43 percent, respectively, had vulnerabilities with onlymoderate impact.

Applications and operating systems did less well, although only by a small percentage. Thirty-four percent ofapplications had no vulnerabilities found, compared to 31 percent of operating systems. Forty-six percent of the formerhad moderate vulnerabilities, while 49 percent of the latter had the same. As a cautionary note, though, on average 15percent of respondents who have conducted an ethical hack in the last year found a serious vulnerability. We suspectthat percentage is even higher among respondents who have not conducted ethical hacks recently.

Ethical Hacking

May 2009 BT 6

Ethical Hacking

May 2009 BT 7

Importance and Benefits of Ethical Hacks

The reason for conducting an ethical hack, obviously, is to keep information assets secure. One survey respondentstated that “It (ethical hacking) is very important and helps save you money and reputation in the long run.” Not alltypes of ethical hacks, however, have equal importance in achieving these goals. For instance, respondents considernetwork testing as the most important type of ethical hack, with 60 percent deeming it critical, and another 35 percentsaying it is very important. System hardening is also considered critical by a majority of respondents (53 percent) andsomewhat critical by another 36 percent.

Application testing and wireless network testing are a bit less important than network testing and system hardening,although both are considered critical or very important by more than three quarters of respondents. Code review isconsidered critical by 28 percent of respondents, and war dialing is critical for 21 percent. War dialing is the only type ofethical hack that more than six percent of respondents (17 percent) deem not at all important to keeping theirinformation assets secure.

Ethical Hacking

May 2009 BT 8

Though the primary function of ethical hacks is to uncover vulnerabilities, there are a number of corollary benefits thatcan be derived from this activity. With that in mind, we presented respondents with a list of eight potential benefits thatcould result from conducting an ethical hack, and asked them to rank the top three in order of importance.

Not surprisingly, improving their overall security posture is the number one benefit by a wide margin, being listed in thetop three by 85 percent of respondents, and the most important benefit by more than 43 percent. These percentagesare similar to the results in both the 2005 and 2007 surveys, except that the percentage of respondents ranking itnumber one jumped from 35 percent (in both surveys) to 43 percent.

Also placed in their top three benefits by more than half of respondents is protecting against theft of intellectualproperty. Twenty-two percent of respondents list this as their top benefit, compared to 34 percent in the 2007 surveyand 23 percent in the 2005 survey. Ranked very closely behind is fulfilling regulatory and/or legislative mandates,which 20 percent rank number one, up from 12 percent in 2007 and 17 percent in 2005. Taken together, 85 percent ofrespondents consider the top benefit of ethical hacks to be one of these three.

Two other benefits were selected by more than a quarter of respondents in their top three: baselining of the currentenvironment, and validating previous security investments. Providing justification for additional funding and the abilityto do trending analyses are among the top three benefits for less than one out of six respondents.

Ethical Hacking

May 2009 BT 9

Ethical Hacking Strategy

Ethical hacks can be conducted internally by the IT organization or by a third-party. The advantage of having the lattergroup conduct the hacks is that it more closely simulates an actual attacker in terms of knowledge of the organization’snetworks and systems. Third parties also usually have greater knowledge of the latest hacking techniques and ploys.However, many IT organizations still eschew this path–at least for some types of ethical hacks. So we provided a list ofpotential barriers to conducting ethical hacks internally, and asked which are significant barriers to either conductingthese activities, or improving their capabilities for conducting them.

The significant barrier cited most often isthe lack of experienced staff, a problemfor 53 percent of respondents. Asmentioned previously, this is one of thestrengths of ethical hacking vendors.Closely related to this is a barrier faced by39 percent of respondents: the amount ofstaff training required to be able toeffectively conduct the ethical hack.

But other reasons also plague a largepercentage of respondents’ ITorganizations. Other projects with ahigher priority is a problem for 44 percentof respondents, unrelenting introductionof new threats for 41 percent and cost ofethical hacking products and/or tools for40 percent.

Other reasons for not using third-partiesare common to many IT projects, i.e.,justifying costs and benefits to uppermanagement (35 percent), organizationaland process issues (31 percent) anddifficulty in implementing productsand/or tools (29 percent).

Ethical Hacking

Most respondents who conduct ethical hacks internally also use third-party vendors of these services. As onerespondent said, “An objective, third-party, ethical hacking assessment is crucial to maintaining a verifiable level ofinformation security.” In general, ethical hacking vendors promote the following benefits of using their services:

• Ethical hacking specialists have more expertise and tools than in-house resources • Tests can be conducted with zero-knowledge to truly mimic a random intruder • Testing can be done without the knowledge of other IT employees

When deciding to use a third-party vendor, there are two typical approaches: 1) choose the best vendor and stick withthem through multiple rounds of ethical hacks over time, and 2) rotate vendors on a regular basis. The thinking behind thelatter strategy is to get different approaches, covering the widest possible range of simulated attacks, thus maximizing thelikelihood of uncovering a vulnerability.

Both approaches have their proponentsand detractors. Respondents, however,consistently split evenly betweenemploying one of these two strategies andhaving no strategy at all. We can onlyassume that those organizations with nostrategy operate on an ad hoc basis,making a decision whether to use the sameor a new vendor with each ethical hack.While not necessarily a terrible approach,proactively selecting a multivendor orsingle-source strategy is likely to yield morebenefits than an ad hoc approach.

Of the half of respondents who do have adefined strategy, again, their approach isfairly evenly split between rotatingvendors and sticking with just one. Andthis has been true for the last two surveys.

We then asked all respondents, whetherthey currently use an ethical hackingvendor or not, to tell us which of fourpotential barriers to using these vendorsare significant for them. Slightly more thanone-quarter of respondents do not see anyof these barriers as significant. Of the four,though, cost is far and away the mostsignificant, with 62 percent seeing this as aproblem. None of the others register withas many as one-quarter of respondents.

May 2009 BT 10

Ethical Hacking

May 2009 BT 11

Security Budgets

Twenty-six percent of respondents’ IT organizations have annual budgets of less than $500 thousand. Another third fallin the $500 thousand to $9.9 million range. Twenty-two percent have IT budgets of between $10 million and $49.9million. The remaining 18 percent of respondents’ IT budgets are $50 million or more.

The vast majority of respondents ITorganizations spend 10 percent or less oftheir IT budget on security, i.e., 47percent spend between one and fivepercent, and 36 percent spend betweensix and ten percent. Only six percentdedicate more than 20 percent of theirbudget for security.

Ethical Hacking

May 2009 BT 12

In these tight economic times, security budgets are holding up fairly well. Twenty-eight percent of respondents expecttheir security budget to increase in 2009 as a percentage of the IT budget, and 24 percent expect it to increase inabsolute dollars.

On the other side of the coin, 22 percent of respondents expect the security budget to decline as a percentage of the ITbudget, and 31 percent expect it to decline in absolute dollars.

A hefty 38 percent of respondents do notspecifically allocate a portion of thesecurity budget for ethical hacking, morethan in the 2007 and 2005 surveys.Sixty-nine percent of respondents allocatefrom 1-5 percent of their security budgetsfor ethical hacking, and 17 percentallocate from 6-10 percent. At the topend, just two percent of respondentsspend more than 20 percent of theirbudgets on ethical hacking.

Ethical Hacking

May 2009 BT 13

Respondent Comments

• An objective third-party ethical hacking assessment is crucial to maintaining a verifiable level of informationsecurity. Although not all environments may have the financial resources to commission regular andcomprehensive third-party assessments, an effort should be made to at least classify your most sensitiveorganizational assets and focus your resources accordingly.

• [Ethical hacking is a] critical component of our overall security program. Keeps our internal, contracted securityguys performing their best; it's a level check.

• Ethical hacking is a necessity in order to protect company assets and stay close to the reality of unethical hacking.

• It (ethical hacking) is very important and helps save you money and reputation in the long run.

• It (ethical hacking) is the best way to assess the network from an outsider's perspective.

• I think it (ethical hacking) is a must have for any serious organization today.

• It (ethical hacking) should be a critical part of any proactive organization in today's global competitive market.

• It's difficult to see the pimple on our face, but others can see all of our blemishes.

• The issue with 3rd parties in our environment is the overall cost. Our environment is very large and to bring anoutside team in would mean we would have to make them "full time" resources to allow them to do the hackingwithin a year of all segments.

• Presentation/delivery of [ethical hacking] results and findings by external providers are "all over the map", withminimal consistency.

• Tools and 3rd parties are expensive when you have a lot of address space as most are priced by number of IPsscanned, not actual number of hosts found.

• Social networking sites are a huge factor in contributing to the rise of hacking activities.

• I would love to go through the training, but it's too costly for me personally, and my employer won't [pay for it].

About BT

For more than 20 years, BT has provided solutions in U.S. and Canadathat help enterprises effectively use technology to drive businessgrowth. The expertise of our employees enables us to help customersglobalize their businesses in innovative and sustainable ways. Throughstrategic development, strong alliances and a diverse collection of bestpractices and methodologies, BT has emerged as a leader in networkedIT services providing professional services and consultancy, managedservices, and full outsourcing for business and IT transformation.

BT has the experience and knowledge to design, manage andoperate solutions that overcome business challenges and createsustainable value in the areas of:

• Secure Networking – drive cost efficiency and risk reductionacross security operations while enabling greater support forcompliance and productivity.

• Mobility - reduce cost and increase productivity throughinformation access and collaboration regardless of location, bysimplifying the complexity attributed to the control andmanagement of mobile assets and expenses.

• Contact Center - deliver improved customer service while reducingcosts and increasing operational flexibility and agent productivity.

• Infrastructure Optimization – fully integrate businesscommunications and IT infrastructures onto a single, cost-effective platform to reduce infrastructure complexity whileenabling streamlined centralized management, morecomprehensive security monitoring and enhanced businessapplications performance.

• Unified Communications – unify complex network environmentsto connect the people, applications and devices needed toachieve business goals.

• Audio and Visual Conferencing – enables users to meet withcolleagues—anywhere, anytime—using an electroniccommunications system such as a phone, personal computer orspecialized video conferencing equipment.

At BT we also know it is important to work with a provider whounderstands the nature of your business. We have built an eco-systemof collaborative relationships with companies such as Microsoft, Cisco,EMC and HP enabling us to deliver integrated solutions that are flexibleand focused on the things that will make your business succeed. Intailoring our global networked IT services to the needs of our customers,we offer a unique combination of global reach with local experience andknowledge, global account management and excellent customer service.

We provide solutions to more than 1,000 customers in the U.S. andCanada in all major industries, and have been selected as a trustedpartner by many large enterprises including Unilever, Reuters,Cadbury and Procter & Gamble. For additional information, pleasevisit www.bt.com/globalservices or contact us at 1-888-767-2988 in the U.S. or 1-408-330-2700 worldwide.

About BT IT Industry Surveys

BT conducts industry survey projects intended to provide ITmanagers with insight into key issues impacting the ability todevelop and deploy IT-infrastructure-dependent businessinitiatives. Previous survey report topics include:

• Application Impact Assessment• Ethical Hacking• IP Address Management• IPv6• IT Infrastructure Library (ITIL)• IT Operations Centers • Malicious Code• Network Access Control• Network and Systems Management Total Cost of Ownership• Network Quality of Service• Network Security• Outsourcing and Offshoring• Patch Management• Performance Management and Engineering• Server Virtualization• Service Level Management and Service Level Agreements• Storage Networking• Unified Communications and Collaboration• Virtual Private Networks • Voice Over IP• Wireless LANs

To see the results of previous surveys, go tohttp://www.bt.com/us/resources

For more information regarding the IT industrysurvey program, please contact:

Rick BlumDirector, Strategic MarketingEmail: rick.blum@bt.com

Ethical Hacking

May 2009 BT 14

Offices worldwide

The services described in this publication are subject to availabilityand may be modified from time to time. Services and equipmentare provided subject to British Telecommunications plc’s respectivestandard conditions of contract. Nothing in this publication formsany part of any contract.

© British Telecommunications plc 2009

05/01/2009