2006 InfoWorld Security Survey: IT's confidence crisis

This year’s InfoWorld Security Survey shows an alarming and growing lack of confidence among IT security professionals — for the fourth year in a row.

It would be hard to find a better example of a distressed IT pro than Brent Oxley, the owner of the Web-hosting service HostGator. In September, Oxley found himself facing a potentially fatal catastrophe.

Of course it happened on Friday afternoon — and before long it turned into the biggest crisis in his company’s four-year history. What started as a handful of complaints from clients was starting to number in the hundreds, and each told a similar tale: People who tried to visit any of the legitimate Web sites that HostGator’s customers operated were redirected to rogue addresses that quickly dropped a virus onto the end-users’ PCs.

The next 12 hours were hell. Every time Oxley’s team scoured one machine clean, another system elsewhere in the network would get infected. “It was madness,” said Oxley, who began to feel he was trapped in a whack-a-mole game of incursion and parry — while simultaneously attempting to deflect the wrath of customers and end-users.

Metastasizing threat

Oxley isn’t alone. According to our survey, which polled 430 individuals responsible for their organization’s security, 56 percent are at most “somewhat confident” in their enterprise’s security system. And the rising tide of malware and phishing exploits is behind a great deal of that anxiety.

Click for larger view.

If 2005 marked the year that playful teenage hacker hobbyists gave way to more criminally minded professionals, 2006 is showing just how lethal this better-funded and -disciplined breed of thugs can be. Their malware is leaner and stealthier, and it burrows deeper into operating systems and applications to ferret out confidential information. You can even buy do-it-yourself malware and phishing kits online, including one called Web Attacker, which offers a maintenance contract for an extra fee. Sophisticated phishing attacks are targeting smaller enterprises, too.

“It’s not getting any better, and some would argue that it’s getting worse,” says Ed Skoudis, co-founder of security consultancy Intelguardians and an incident handler at the SANS Institute Internet Storm Center. Speaking of the security menace facing the average enterprise today, he adds, “The threat has metastasized in a very bad way, all based on the profit motive.”