Report finds 37% jump in security incidents

IDG News Service - The number of computer security incidents and attacks detected at businesses worldwide soared by 37% between the fourth quarter of 2002 and the first quarter of this year, fueled in part by a surge in the number of mass-mailing worms, according to a report due out Monday from Internet Security Systems Inc. (ISS).
The full report is due to be available for free from Atlanta-based ISS's Web site.
"What we're seeing out there is a lot more folks being extremely active and a lot more malicious behavior," said Peter Allor, manager of ISS's X-Force Threat Analysis Services division, which compiled the report. "We've also seen a corresponding high degree of Web site defacements."
The large increase in worms and other security-related incidents point to a challenging year ahead for IT security staffs, the organization said in a statement. The tally includes relatively minor activities, such as scanning corporate networks for vulnerabilities, and more serious events, such as the Slammer worm, which emerged in January and according to some experts was the fastest-spreading worm yet (see story).
The number of worms and hybrid threats between Jan. 1 and March 31 totaled 752, compared with 101 in the fourth quarter of 2002, the report found. X-Force also noted an increase in the number of "zero day" attacks, in which hackers attack a software vulnerability that vendors don't know about yet.
Faced with such an abundance of activity, businesses can help themselves by focusing on the security threats that pose the most risk to them, Allor said. "When you have almost 300 issues a month coming out, the important part is, how do you focus on the ones that are significant to you?"
The severity ratings assigned by IT vendors are only one factor to consider when determining how to respond to a threat. Businesses should also look at where the affected system resides in the network, what level of risk they are prepared to tolerate for that system and how well the system is protected by firewalls and other technologies, he said.
The report tracked 20 industry sectors during the quarter. Retail businesses were attacked the most, accounting for 35% of attacks. Financial services accounted for 11.5%, health care and manufacturing 9% each, and federal and local government 1%, the report found.
The frequency of attacks on an industry may reflect several factors, including the proportion of IT dollars spent by that industry on security and how successful hackers have been in the past at targeting a particular sector. Hackers tend to "follow the path of least resistance," Allor said.
XForce's "Internet Risk Impact Summary" (IRIS) report draws information from more than 400 network- and server-based intrusion-detection sensors located at businesses on four continents and spanning all major industries, according to X-Force.
ISS found that of all the events reported by businesses in the quarter, the top categories were "suspicious activities" and unauthorized access attempts. Suspicious activities include scanning networks for vulnerabilities and accounted for 73.5% of total events; unauthorized access attempts accounted for 11% of the events.
Also, 26% of security events occurred over weekends in the first quarter of 2003, and most events occurred on a Friday. The Slammer worm began its propagation on Jan. 25, a Saturday.
Allor said it's hard to determine if the number of malicious hackers is increasing. "There are a lot of folks out there hacking, and quite honestly, there's a real lack of ethical behavior. A lot of it is against the law, but because of the anonymity, a lot of people think it's cool to do anyway.
"Do we have a lot more hackers? That's a real hard thing to quantify. We estimate there are upwards of 3 million in the U.S. Those aren't all the top class of hackers, which is good news. A lot of them are just taking tools that are out there, putting them together and seeing if they work. There are 3 million doing some kind of malicious behavior. That's our estimate," Allor said.