Hackers Focus on Misconfigured Networks, Survey Finds

Ever wonder what IT resource is the easiest for hackers to exploit? According to a survey of attendees of the annual Defcon security conference, the answer is misconfigured networks.

The survey was conducted by Tufin Technologies, which polled 101 attendees of Defcon 18 in July. Seventy-six percent named misconfigured networks as the easiest IT resource to attack.

Fifty-seven percent of those surveyed said network misconfiguration was caused by IT staffers not knowing what to look for when assessing the security posture of the network. Another 18 percent said they believe misconfigured networks are the result of insufficient time or money for audits, while 14 percent felt compliance audits that fail to capture security best practices are a factor.

The rest said they do not think security can keep up with the threat landscape.

"The really big question coming out of the survey is how to manage the risk that organizations run dealing with the complexity that is part and parcel of any medium-to-large-sized company's security operations," Tufin CTO Reuven Harrison said in a statement.

Outside of attacking Websites, 43 percent agreed planting a malicious insider in a company is the latest and most successful form of commercial hacking.

The survey also found that 58 percent of attendees did not believe outsourcing security to a third party increased the chances of getting hacked, and almost half said they believe it would not increase the chances of any sort of security or compliance problem.

"This disproves the commonly held theory that the benefits of outsourcing security are cancelled out by an even greater set of risks," Harrison said. "Security outsourcing has matured to the point where companies can confidently outsource parts or all of their security operations—especially when service providers offer automated tools to help with network management and configuration. With cloud computing approaching in the fast lane, this has to be good news."

Tufin's 2009 survey focused on the when of hacking more than the how: Tufin reported that 56 percent of respondents cited Christmas as the best time of the year to launch attacks on corporations—something Tufin speculated was due to companies running on skeleton staffs during the holiday season.

Most of this year's respondents (67 percent) said they hack for fun, and 90 percent classified themselves as either white hats (44 percent) or gray hats (46 percent). The remainder counted themselves among the black hat crowd.